Note, that this recipe is not updated long time and could be outdated!
Got it.

Iptables piemērs darbstacijai

Šis ir iptables konfigurācijas skripta piemērs, kas piemērots darbstacijai ar VmWare player.
Atšķirībā no parastas darbstacijas ir pievienotas papildus tīkla "saskarnes",  tiek ieslēgta pakešu "pārsutīšana", un ar "NAT" tiek mainīta pakešu avota adrese.
#!/bin/sh

# Enable forwarding
echo 1 >/proc/sys/net/ipv4/ip_forward

# Flush all specific rules
iptables -F
iptables -F -t mangle
iptables -F -t nat
iptables -F -t filter

# Set counters to zero
iptables -Z
iptables -Z -t mangle
iptables -Z -t nat
iptables -Z -t filter

# Configure default policies (-P), meaning default rule to apply if no
# more specific rule below is applicable.  These rules apply if a more specific rule below
# is not applicable.  Defaults are to DROP anything sent to firewall or internal
# network, permit anything going out.
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

##########
# Allow  #
##########
# Allow ICMP from anywhere
iptables -A INPUT -p icmp -j ACCEPT

# Allow ICMP ECHO Replies from Anywhere
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

# Permit packets in to firewall itself that are part of existing and related connections.
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Enable SSH on port 22 from anywhere
iptables -A INPUT -p tcp -s 0/0 -d 0/0 --destination-port 22 --syn -j ACCEPT

# Allow all inputs to firewall from the internal network and local interfaces
iptables -A INPUT -i lo -s 0/0 -d 0/0 -j ACCEPT
iptables -A INPUT -i vmnet1 -s 0/0 -d 0/0 -j ACCEPT
iptables -A INPUT -i vmnet8 -s 0/0 -d 0/0 -j ACCEPT

###############
# MASQUERADE  #
###############
# masquerade VmWare NAT subnet packets (10.0.0.** in this case)
iptables -A POSTROUTING -t nat -s 10.0.100.0/24 -o eth0 -j MASQUERADE

# Finally, DROP all connection requests not yet provided
iptables -A INPUT -s 0/0 -d 0/0 -p udp -j DROP
iptables -A INPUT -s 0/0 -d 0/0 -p tcp --syn -j DROP

 

Created by Valdis Vītoliņš on 2008-08-09 13:38
Last modified by Valdis Vītoliņš on 2013-09-27 07:34
 
Xwiki Powered
Creative Commons Attribution 3.0 Unported License