1612.html

著名的linux英雄站点的文档打包

<br>
#<br>
# 4.1.1 Set policies<br>
#<br>
<br>
$IPTABLES -P INPUT DROP<br>
$IPTABLES -P OUTPUT DROP<br>
$IPTABLES -P FORWARD DROP<br>
<br>
#<br>
# 4.1.2 Create userspecified chains<br>
#<br>
<br>
#<br>
# Create chain for bad tcp packets<br>
#<br>
<br>
$IPTABLES -N bad_tcp_packets<br>
<br>
#<br>
# Create separate chains for ICMP, TCP and UDP to traverse<br>
#<br>
<br>
$IPTABLES -N allowed<br>
$IPTABLES -N icmp_packets<br>
$IPTABLES -N tcp_packets<br>
$IPTABLES -N udpincoming_packets<br>
<br>
#<br>
# 4.1.3 Create content in userspecified chains<br>
#<br>
<br>
#<br>
# bad_tcp_packets chain<br>
#<br>
<br>
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG <br>
--log-prefix "New not syn:"<br>
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP<br>
<br>
#<br>
# allowed chain<br>
#<br>
<br>
$IPTABLES -A allowed -p TCP --syn -j ACCEPT<br>
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT<br>
$IPTABLES -A allowed -p TCP -j DROP<br>
<br>
#<br>
# ICMP rules<br>
#<br>
<br>
# Changed rules totally<br>
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT<br>
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT<br>
<br>
#<br>
# TCP rules<br>
#<br>
<br>
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed<br>
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed<br>
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed<br>
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed<br>
<br>
#<br>
# UDP ports<br>
#<br>
<br>
# nondocumented commenting out of these rules<br>
$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT<br>
#$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 123 -j ACCEPT<br>
$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 2074 -j ACCEPT<br>
$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 4000 -j DROP #禁止客户使用OICQ<br>
<br>
#<br>
# 4.1.4 INPUT chain<br>
#<br>
<br>
#<br>
# Bad TCP packets we don't want.<br>
#<br>
<br>
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets<br>
<br>
#<br>
# Rules for incoming packets from the internet.<br>
#<br>
<br>
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets<br>
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets<br>
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udpincoming_packets<br>
<br>
#<br>
# Rules for special networks not part of the Internet<br>
#<br>
<br>
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_BCAST_ADRESS -j ACCEPT<br>
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT<br>
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT<br>
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT<br>
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT<br>
$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED <br>
-j ACCEPT<br>
#<br>
# Log weird packets that don't match the above.<br>
#<br>
<br>
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG <br>
--log-level DEBUG --log-prefix "IPT INPUT packet died: "<br>
<br>
#<br>
# 4.1.5 FORWARD chain<br>
#<br>
<br>
#<br>
# Bad TCP packets we don't want<br>
#<br>
<br>
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets<br>
<br>
#<br>
# Accept the packets we actually want to forward<br>
#<br>
<br>
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT<br>
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT<br>
<br>
#<br>
# Log weird packets that don't match the above.<br>
#<br>
<br>
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG <br>
--log-level DEBUG --log-prefix "IPT FORWARD packet died: "<br>
<br>
#<br>
# 4.1.6 OUTPUT chain<br>
#<br>
<br>
#<br>
# Bad TCP packets we don't want.<br>
#<br>
<br>
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets<br>
<br>
#<br>
# Special OUTPUT rules to decide which IP's to allow.<br>
#<br>
<br>
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT<br>
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT<br>
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT<br>
<br>
#<br>
# Log weird packets that don't match the above.<br>
#<br>
<br>
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG <br>
--log-level DEBUG --log-prefix "IPT OUTPUT packet died: "<br>
<br>
######<br>
# 4.2 nat table<br>
#<br>
<br>
#<br>
# 4.2.1 Set policies<br>
#<br>
<br>
#<br>
# 4.2.2 Create user specified chains<br>
#<br>
<br>
#<br>
# 4.2.3 Create content in user specified chains<br>
#<br>
<br>
#<br>
# 4.2.4 PREROUTING chain<br>
#<br>
$IPTABLES -t nat -I PREROUTING -m mac --mac-source 00:50:4c:3b:e6:fb -j DROP #禁止网卡的MAC为<br>
#00:50:4c:3b:e6:fb访问internet<br>
#<br>
# 4.2.5 POSTROUTING chain<br>
#<br>
#$IPTABLES -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128<br>
#<br>
$IPTABLES -t nat -A PREROUTING -s 192.168.100.0/24 -d 0/0 -p tcp --dport 80 -j DNAT --to 192.168.100.4:3128<br>
#把客户的http的请求转发到squid的3128端口上（透明代理）<br>
<br>
# Enable simple IP Forwarding and Network Address Translation<br>
#<br>
<br>
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP<br>
<br>
#<br>
# 4.2.6 OUTPUT chain<br>
#<br>
<br>
######<br>
# 4.3 mangle table<br>
#<br>
<br>
#<br>
# 4.3.1 Set policies<br>
#<br>
<br>
#<br>
# 4.3.2 Create user specified chains<br>
#<br>
<br>
#<br>
# 4.3.3 Create content in user specified chains<br>
#<br>
<br>
#<br>
# 4.3.4 PREROUTING chain<br>
#<br>
$IPTABLES -t nat -A PREROUTING -s 0/0 -d 0/0 -p udp --destination-port 8000 -j DROP<br>
#禁止客户访问OICQ服务器<br>
<br>
文章选项： 友善列印   将这篇文章放置于备忘录中，待有空时回覆   通知板主  <br>
linux<br>
注册会员<br>
<br>
Reged: 11/11/02<br>
篇文章: 17<br>
Re: squid+iptables建立internet网关 [re: linux]<br>
      11/12/02 03:28 PM ()<br>
编辑文章 编辑   回应这篇文章 回覆  <br>
<br>
# NETWORK OPTIONS<br>
# -----------------------------------------------------------------------------<br>
<br>
#http_port 3128<br>
<br>
<br>
#icp_port 3130<br>
<br>
<br>
#htcp_port 4827<br>
<br>
<br>
#mcast_groups 239.128.16.128<br>
<br>
<br>
#<br>
#tcp_outgoing_address 0.0.0.0<br>
#udp_incoming_address 0.0.0.0<br>
#udp_outgoing_address 0.0.0.0<br>
<br>
<br>
<br>
#cache_peer hostname type 3128 3130<br>
<br>
<br>
<br>
#icp_query_timeout 0<br>
<br>
<br>
#maximum_icp_query_timeout 2000<br>
<br>
<br>
#mcast_icp_query_timeout 2000<br>
<br>
<br>
#dead_peer_timeout 10 seconds<br>
<br>
<br>
#hierarchy_stoplist cgi-bin ?<br>
<br>
<br>
#acl QUERY urlpath_regex cgi-bin ?<br>
#no_cache deny QUERY<br>
<br>
<br>
<br>
cache_mem 16 MB<br>
<br>
<br>
#cache_swap_low 90<br>
#cache_swap_high 95<br>
<br>
<br>
#maximum_object_size 4096 KB<br>
<br>
<br>
#ipcache_size 1024<br>
#ipcache_low 90<br>
#ipcache_high 95<br>
<br>
# TAG: fqdncache_size (number of entries)<br>
# Maximum number of FQDN cache entries.<br>
#fqdncache_size 1024<br>
<br>
<br>
<br>
#<br>
cache_dir ufs /var/spool/squid 100 16 256<br>
<br>
cache_access_log /var/log/squid/access.log<br>
<br>
<br>
#cache_log /var/log/squid/cache.log<br>
<br>
#<br>
#cache_store_log /var/log/squid/store.log<br>
<br>
<br>
#<br>
#cache_swap_log<br>
<br>
<br>
#emulate_httpd_log off<br>
<br>
<br>
#mime_table /etc/squid/mime.conf<br>
<br>
#log_mime_hdrs off<br>
<br>
#useragent_log none<br>
<br>
<br>
#pid_filename /var/run/squid.pid<br>
<br>
#debug_options ALL,1<br>
<br>
<br>
#log_fqdn off<br>
<br>
<br>
#client_netmask 255.255.255.255<br>
<br>
<br>
<br>
#ftp_user Squid@<br>
<br>
#ftp_list_width 32<br>
<br>
#ftp_passive on<br>
<br>
#cache_dns_program /usr/lib/squid/dnsserver<br>
<br>
<br>
#dns_children 5<br>
<br>
<br>
#dns_defnames off<br>
<br>
<br>
#dns_nameservers none<br>