江苏龙网

  1. 主页 > 生活百科 > >

用 Ubuntu 自己设定软路由，不用现成的软路由系统( 三 )

软路由


# Reject spoofed packets
/sbin/iptables -A INPUT -i $EXTIF -s 169.254.0.0/16 -j DROP
/sbin/iptables -A INPUT -i $EXTIF -s 172.16.0.0/12 -j DROP
/sbin/iptables -A INPUT -i $EXTIF -s 127.0.0.0/8 -j DROP
#Multicast-adresses.
/sbin/iptables -A INPUT -i $EXTIF -s 224.0.0.0/4 -j DROP
/sbin/iptables -A INPUT -i $EXTIF -d 224.0.0.0/4 -j DROP
/sbin/iptables -A INPUT -i $EXTIF -s 240.0.0.0/5 -j DROP
/sbin/iptables -A INPUT -i $EXTIF -d 240.0.0.0/5 -j DROP
/sbin/iptables -A INPUT -i $EXTIF -s 0.0.0.0/8 -j DROP
/sbin/iptables -A INPUT -i $EXTIF -d 0.0.0.0/8 -j DROP
/sbin/iptables -A INPUT -i $EXTIF -d 239.255.255.0/24 -j DROP
/sbin/iptables -A INPUT -i $EXTIF -d 255.255.255.255 -j DROP
# SYN Flood Protection
/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn_flood
/sbin/iptables -A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -j RETURN
/sbin/iptables -A syn_flood -j DROP
##^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# Allow HTTP to this Router
/sbin/iptables -A INPUT -i $INTIF -p tcp --dport 80 -j ACCEPT -m comment --comment "Accept HTTP from LAN"
# Allow SSH with brute-force attack protection from WAN
/sbin/iptables -A INPUT -i $EXTIF -p tcp -m tcp --dport $SSHPORT -m state --state NEW -m recent --set --name SSH_LIMIT --rsource
/sbin/iptables -A INPUT -i $EXTIF -p tcp --dport $SSHPORT -m state --state NEW -m recent --update --seconds 60 --hitcount 3 --name SSH_LIMIT --rsource -j DROP
/sbin/iptables -A INPUT -p tcp -m tcp --dport $SSHPORT -j ACCEPT -m comment --comment "Accept ssh from both WAN and LAN"
# DHCP client requests - accept from LAN
/sbin/iptables -A INPUT -i $INTIF -p udp --dport 67:68 -j ACCEPT -m comment --comment "Accept DHCP requests from LAN"
# Allow ping from LAN
iptables -A INPUT -i $INTIF -p icmp --icmp-type echo-request -j ACCEPT -m comment --comment "Accept Ping request from LAN"
iptables -A OUTPUT -o $INTIF -p icmp --icmp-type echo-reply -j ACCEPT -m comment --comment "Accept Ping reply to LAN"
 
if-up.d 部分，创建
/etc/network/if-up.d/my-post-up :
#!/bin/sh
EXTIF=eth0
if [ "$IFACE" = "$EXTIF" ]; then
/bin/sh /usr/myscripts/iptables/post-up-rules
fi
 
创建
/usr/myscripts/iptables/post-up-rules ：
#!/bin/sh
EXTIF=eth0
INTIF=br0
LOG=/tmp/set-rules-router.log
WANIP=$(/sbin/ifconfig $EXTIF | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}')
echo "POST-UP : `date`" | tee -a $LOG
echo "$IFACE post-up, $EXTIF IP : $WANIP" | tee -a $LOG
echo | tee -a $LOG
if [ -z "$WANIP" ]; then
exit;
fi
get_network(){
ip=$1
baseip=$(echo $ip | cut -d"." -f1-3)
echo $baseip".0"
}
LANIP=$(/sbin/ifconfig $INTIF | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}')
NETWORK=$(get_network "$LANIP")
PC2="10.0.1.130"; # Web server internal IP
MAIL="10.0.1.131"; # mail server internal IP
HTTPS_PORT=12310;
IMAPS_PORT=12311;
POP3S_PORT=12312;
## PORT FORWARDING vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
# HTTPS to Web Server
/sbin/iptables -t nat -A PREROUTING -d $WANIP -p tcp --dport $HTTPS_PORT -j DNAT --to-destination $PC2:$HTTPS_PORT -m comment --comment "Port Forwarding to PC2"
/sbin/iptables -A FORWARD -p tcp -d $PC2 --dport $HTTPS_PORT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A POSTROUTING -t nat -s $NETWORK/24 -d $PC2/32 -p tcp -m tcp --dport $HTTPS_PORT -j SNAT --to-source $LANIP
# Mail Server
/sbin/iptables -t nat -A PREROUTING -d $WANIP -p tcp --dport 25 -j DNAT --to-destination $MAIL:25 -m comment --comment "Port Forwarding SMTP"
/sbin/iptables -t nat -A PREROUTING -d $WANIP -p tcp --dport 465 -j DNAT --to-destination $MAIL:465 -m comment --comment "Port Forwarding SMTPs"
/sbin/iptables -t nat -A PREROUTING -d $WANIP -p tcp --dport 587 -j DNAT --to-destination $MAIL:587 -m comment --comment "Port Forwarding Submission"
/sbin/iptables -t nat -A PREROUTING -d $WANIP -p tcp --dport $IMAPS_PORT -j DNAT --to-destination $MAIL:993 -m comment --comment "Port Forwarding IMAPs"
/sbin/iptables -t nat -A PREROUTING -d $WANIP -p tcp --dport $POP3S_PORT -j DNAT --to-destination $MAIL:995 -m comment --comment "Port Forwarding POP3s"
/sbin/iptables -A FORWARD -p tcp -d $MAIL -m multiport --dport 25,465,587,993,995 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


推荐阅读


上一篇：行业大数据有哪些安全风险

下一篇：刷乳胶漆前如何遮挡家具,装修的时候要保护哪些东西