До это во как бы уже поднимал чудесную головоломку, и бросил!
Так вот вчера решил ещё разик в неё поиграться....
Самое интересное на Debian 5.00 lenny IpTables v1.4.2 работает без проблем сей скриптик:
/etc/firewall/rules.sh - правила
#!/bin/bash
# Flush all and delete non build-in chains
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
#accept loopback interface traffic
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
#set traffic priority to high
iptables -t mangle -A OUTPUT -j DSCP --set-dscp 50
#Accept incoming traffic from established connection
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state INVALID -j DROP
#accept ssh from admins ips
ADMIN_IPS="172.16.32.0/16 78.81.40.211"
for ADMIN_IP in $ADMIN_IPS ; do
iptables -A INPUT -p tcp --destination-port 22 --source $ADMIN_IP -j ACCEPT
done
#accept mysql remote connection
ADMIN_IPS="78.81.40.211"
for ADMIN_IP in $ADMIN_IPS ; do
iptables -A INPUT -p tcp --destination-port 3306 --source $ADMIN_IP -j ACCEPT
done
#allow dns
iptables -A OUTPUT -p tcp --destination-port 53 -j ACCEPT
iptables -A OUTPUT -p udp --destination-port 53 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 53 -j ACCEPT
iptables -A INPUT -p udp --destination-port 53 -j ACCEPT
# Allow HTTP
iptables -A INPUT -p tcp --destination-port 80 -j ACCEPT
#iptables -A INPUT -p tcp --destination-port 8080 -j ACCEPT
# Webmin
#iptables -A INPUT -p tcp --destination-port 10000 -j ACCEPT
# FTP
iptables -A INPUT -p tcp --destination-port 20 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 21 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --destination-ports 49152:52152 -j ACCEPT
/sbin/modprobe nf_conntrack_ftp
#default policy
iptables -P FORWARD DROP
iptables -P INPUT DROP
#iptables -P OUTPUT DROP
#iptables -P FORWARD ACCEPT
#iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
/etc/init.d/firewall
#!/bin/sh
# Begin /etc/init.d/
case "$1" in
start)
echo -n "Starting firewall ..."
source /etc/firewall/rules.sh
echo "done."
;;
stop)
echo -n "Stoping firewall ..."
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -P FORWARD ACCEPT
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
echo "done."
;;
restart)
$0 stop
$0 start
;;
*)
echo "Usage: $0 {start|reload|restart}"
exit 1
;;
esac
А вот на Debian 6 Squeeze IpTables v1.4.8 возникли проблемы, была ошибка Starting firewall .../etc/init.d/firewall: 33: source: not found... ...но всё таки нашёл выход =) Fixed:
/etc/init.d/firewall Fixed
#!/bin/sh
# Begin /etc/init.d/
case "$1" in
start)
echo -n "Starting firewall ..."
/etc/firewall/rules.sh
echo "done."
;;
stop)
echo -n "Stoping firewall ..."
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -P FORWARD ACCEPT
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
echo "done."
;;
restart)
$0 stop
$0 start
;;
*)
echo "Usage: $0 {start|reload|restart}"
exit 1
;;
esac
а также небольшая модификация!
/etc/init.d/firewall modif
#!/bin/sh
# Begin /etc/init.d/
case "$1" in
start)
echo -n "Starting firewall ..."
/etc/firewall/rules.sh
echo "done."
;;
stop)
echo -n "Stoping firewall ..."
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -P FORWARD ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -s 172.16.32.0/16 -j ACCEPT
echo "done."
;;
restart)
$0 stop
$0 start
;;
*)
echo "Usage: $0 {start|reload|restart}"
exit 1
;;
esac
Так вот вчера решил ещё разик в неё поиграться....
Самое интересное на Debian 5.00 lenny IpTables v1.4.2 работает без проблем сей скриптик:
/etc/firewall/rules.sh - правила
#!/bin/bash
# Flush all and delete non build-in chains
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
#accept loopback interface traffic
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
#set traffic priority to high
iptables -t mangle -A OUTPUT -j DSCP --set-dscp 50
#Accept incoming traffic from established connection
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state INVALID -j DROP
#accept ssh from admins ips
ADMIN_IPS="172.16.32.0/16 78.81.40.211"
for ADMIN_IP in $ADMIN_IPS ; do
iptables -A INPUT -p tcp --destination-port 22 --source $ADMIN_IP -j ACCEPT
done
#accept mysql remote connection
ADMIN_IPS="78.81.40.211"
for ADMIN_IP in $ADMIN_IPS ; do
iptables -A INPUT -p tcp --destination-port 3306 --source $ADMIN_IP -j ACCEPT
done
#allow dns
iptables -A OUTPUT -p tcp --destination-port 53 -j ACCEPT
iptables -A OUTPUT -p udp --destination-port 53 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 53 -j ACCEPT
iptables -A INPUT -p udp --destination-port 53 -j ACCEPT
# Allow HTTP
iptables -A INPUT -p tcp --destination-port 80 -j ACCEPT
#iptables -A INPUT -p tcp --destination-port 8080 -j ACCEPT
# Webmin
#iptables -A INPUT -p tcp --destination-port 10000 -j ACCEPT
# FTP
iptables -A INPUT -p tcp --destination-port 20 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 21 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --destination-ports 49152:52152 -j ACCEPT
/sbin/modprobe nf_conntrack_ftp
#default policy
iptables -P FORWARD DROP
iptables -P INPUT DROP
#iptables -P OUTPUT DROP
#iptables -P FORWARD ACCEPT
#iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
/etc/init.d/firewall
#!/bin/sh
# Begin /etc/init.d/
case "$1" in
start)
echo -n "Starting firewall ..."
source /etc/firewall/rules.sh
echo "done."
;;
stop)
echo -n "Stoping firewall ..."
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -P FORWARD ACCEPT
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
echo "done."
;;
restart)
$0 stop
$0 start
;;
*)
echo "Usage: $0 {start|reload|restart}"
exit 1
;;
esac
А вот на Debian 6 Squeeze IpTables v1.4.8 возникли проблемы, была ошибка Starting firewall .../etc/init.d/firewall: 33: source: not found... ...но всё таки нашёл выход =) Fixed:
/etc/init.d/firewall Fixed
#!/bin/sh
# Begin /etc/init.d/
case "$1" in
start)
echo -n "Starting firewall ..."
/etc/firewall/rules.sh
echo "done."
;;
stop)
echo -n "Stoping firewall ..."
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -P FORWARD ACCEPT
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
echo "done."
;;
restart)
$0 stop
$0 start
;;
*)
echo "Usage: $0 {start|reload|restart}"
exit 1
;;
esac
а также небольшая модификация!
/etc/init.d/firewall modif
#!/bin/sh
# Begin /etc/init.d/
case "$1" in
start)
echo -n "Starting firewall ..."
/etc/firewall/rules.sh
echo "done."
;;
stop)
echo -n "Stoping firewall ..."
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -P FORWARD ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -s 172.16.32.0/16 -j ACCEPT
echo "done."
;;
restart)
$0 stop
$0 start
;;
*)
echo "Usage: $0 {start|reload|restart}"
exit 1
;;
esac
