dongli001

这是一个linux下的实现客戽机上网的代码

#!/bin/sh
# define iptables exec
IPTABLES="/usr/sbin/iptables"
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT
# reset the defaule policies in the nat table
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT

#reset the default policies in the mangle table
$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT
#flush all the rules in the filter and nat tables
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F

#erase all chains thats not defaule in filter and nat table
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -F
# load modules
/sbin/depmod -a


/sbin/modprobe ip_tables
/sbin/modporbe ip_conntrack
/sbin/modprobe iptables_filter
/sbin/modprobe iptables_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe iptables_mangle
# enable ip forward
echo 1 > /proc/sys/net/ipv4/ip_forward
# nei wang tong xun
#set default rule
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
#create new chains
$IPTABLES -N bad_tcp_packets
$IPTABLES -N allowed
$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets
# define new chines
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
#allowed
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP
#TCP
$IPTABLES -A tcp_packets -p tcp -s 0/0 --dport 22 -j allowed
$IPTABLES -A tcp_packets -p tcp -s 0/0 --dport 80 -j allowed
$IPTABLES -A tcp_packets -p tcp -s 0/0 --dport 137 -j allowed
$IPTABLES -A tcp_packets -p tcp -s 0/0 --dport 138 -j allowed
$IPTABLES -A tcp_packets -p tcp -s 0/0 --dport 139 -j allowed
#UDP
$IPTABLES -A udp_packets -p UDP -S 0/0 --dport 53 -j allowed #bind
$IPTABLES -A udp_packets -p UDP -s 0/0 --dport 137 -j allowed
$IPTABLES -A udp_packets -p UDP -s 0/0 --dport 138 -j allowed
$IPTABLES -A udp_packets -p UDP -s 0/0 --dport 139 -j allowed
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 2074 -j ACCEPT
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 4000 -j ACCEPT
#ICMP
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
#IPPUT 
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets
$IPTABLES -A INPUT -p ALL -i eth1 -j ACCEPT
$IPTABLES -A INPUT -p ALL -i lo -j ACCEPT
#FPXDDG
$IPTABLES -A INPUT -p ALL -i eth0 -m --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p TCP -i eth0 -j tcp_packets
$IPTABLES -A INPUT -P UDP -i eth0 -j udp_packets
$IPTABLES -A INPUT -p ICMP -i eth0 -j icmp_packets

#nat tables
$IPTABLES -t nat -A POSTROUTING -o eth0 -j MASQUERADE