Если у Вас есть минутка времени. Сейчас все прекрасно работает, но интересует, есть ли дыры или можно ли как-то оптимизировать то, что мной приведено ниже. Цель скрипта: выход локалки в интернет без ограничений, а с интернета попасть на комп(ы) нельзя.
#!/bin/sh
/sbin/depmod -a
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe ipt_owner
/sbin/modprobe ipt_REJECT
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
for file in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $file
done
for file in /proc/sys/net/ipv4/conf/*/accept_redirects; do
echo 0 > $file
done
for file in /proc/sys/net/ipv4/conf/*/accept_source_route; do
echo 0 > $file
done
function get_addr()
{
IFCONFIG='/sbin/ifconfig';
HEAD='head -2';
TAIL='tail -1';
CUT='cut -d: -f2';
IP=`$IFCONFIG $1 | $HEAD | $TAIL | awk '{print $2}' | $CUT`;
echo $IP;
}
EXTDEV="ppp0"
EXTERNALIP=`get_addr $EXTDEV`
ENETWORKIP=$EXTERNALIP+"/255.255.255.255"
INTDEV="ppp+"
INTERNALIP=`get_addr $INTDEV`
INETWORKIP="192.168.0.0/255.255.255.0"
LOOPBACK="127.0.0.1"
ANYWHERE="0.0.0.0/0"
PORTS="1024:65535"
/sbin/iptables -F
/sbin/iptables -F -t nat
/sbin/iptables -N ALLOW_ICMP
/sbin/iptables -N ALLOW_PORTS
/sbin/iptables -N CHECK_FLAGS
/sbin/iptables -N DENY_PORTS
/sbin/iptables -N DST_EGRESS
/sbin/iptables -N KEEP_STATE
/sbin/iptables -N SRC_EGRESS
/sbin/iptables -P INPUT DROP
/sbin/iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
/sbin/iptables -A INPUT -j ACCEPT -s $EXTERNALIP -d $ANYWHERE
/sbin/iptables -A INPUT -j ACCEPT -s $ANYWHERE -d $ANYWHERE -i $INTDEV
/sbin/iptables -A INPUT -j ACCEPT -s $ANYWHERE -d $ANYWHERE -i lo
/sbin/iptables -A INPUT -j ACCEPT -s $ANYWHERE -d $ANYWHERE -i $EXTDEV -m state --state RELATED,ESTABLISHED
/sbin/iptables -A INPUT -j ACCEPT -p icmp -s $ANYWHERE -d $ANYWHERE
/sbin/iptables -A INPUT -j ACCEPT -p udp -s $INETWORKIP --sport 53 -d $ANYWHERE
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -A OUTPUT -j ACCEPT -s $ANYWHERE -d $ANYWHERE -o $INTDEV
/sbin/iptables -A OUTPUT -j ACCEPT -s $ANYWHERE -d $EXTERNALIP
/sbin/iptables -A OUTPUT -j ACCEPT -s $ANYWHERE -d $ANYWHERE -o lo
/sbin/iptables -A OUTPUT -j ACCEPT -s $ANYWHERE -d $ANYWHERE -o $EXTDEV -m state --state RELATED,ESTABLISHED
/sbin/iptables -A OUTPUT -j ACCEPT -p tcp -s $EXTERNALIP -d $ANYWHERE --dport 25 -o $EXTDEV
/sbin/iptables -A OUTPUT -j ACCEPT -p tcp -s $EXTERNALIP --sport $PORTS -d $ANYWHERE --dport 80
/sbin/iptables -A OUTPUT -j ACCEPT - /sbin/iptables -A OUTPUT -j ACCEPT -p tcp -s $EXTERNALIP --sport $PORTS -d $ANYWHERE --dport 1720
/sbin/iptables -A OUTPUT -j ACCEPT -p tcp -s $EXTERNALIP --sport $PORTS -d $ANYWHERE --dport 9123
/sbin/iptables -A OUTPUT -j ACCEPT -p udp -s $EXTERNALIP -d $ANYWHERE --dport 1717
/sbin/iptables -A OUTPUT -j ACCEPT -p udp -s $EXTERNALIP -d $ANYWHERE --dport 1718
/sbin/iptables -A OUTPUT -j ACCEPT -p udp -s $EXTERNALIP -d $ANYWHERE --dport 1719
/sbin/iptables -A OUTPUT -j ACCEPT -p udp -s $EXTERNALIP -d $ANYWHERE --dport 4000:5600
/sbin/iptables -A OUTPUT -j ACCEPT -p udp -s $EXTERNALIP -d $ANYWHERE --dport 25793
/sbin/iptables -A OUTPUT -j ACCEPT -p icmp -s $ANYWHERE -d $ANYWHERE
/sbin/iptables -A OUTPUT -j ACCEPT -s $ANYWHERE -d $ANYWHERE -o $EXTDEV -m state --state RELATED,ESTABLISHED
/sbin/iptables -A OUTPUT -j ACCEPT -p tcp -s $ANYWHERE --sport 40000:43000 -d $ANYWHERE --dport 40000:43000
/sbin/iptables -A OUTPUT -j ACCEPT -p tcp -s $ANYWHERE --sport 40000:43000 -d $ANYWHERE -o $EXTDEV
/sbin/iptables -P FORWARD ACCEPT
#защита от Syn-flood:
/sbin/iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
#защита от скрытого сканирования портов:
/sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
#защита от Ping of death:
/sbin/iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
/sbin/iptables -A FORWARD -j ACCEPT -s $ANYWHERE -d $ANYWHERE -i $INTDEV
/sbin/iptables -A FORWARD -j ACCEPT -p icmp -s $ANYWHERE -d $ANYWHERE -i $INTDEV
/sbin/iptables -A INPUT -j DROP -p udp -s $ANYWHERE -d $ANYWHERE --dport 136:140
/sbin/iptables -A OUTPUT -j DROP -p udp -s $ANYWHERE -d $ANYWHERE --dport 136:140
/sbin/iptables -A FORWARD -j DROP -p udp -s $ANYWHERE -d $ANYWHERE --dport 136:140
/sbin/iptables -A INPUT -j DROP -p udp -s $ANYWHERE -d $ANYWHERE --sport 136:140
/sbin/iptables -A OUTPUT -j DROP -p udp -s $ANYWHERE -d $ANYWHERE --sport 136:140
/sbin/iptables -A FORWARD -j DROP -p udp -s $ANYWHERE -d $ANYWHERE --sport 136:140
/sbin/iptables -t nat -A PREROUTING -j REDIRECT -p tcp -s $INETWORKIP -d ! $INETWORKIP --dport 80 --to-port 3128
/sbin/iptables -t nat -A PREROUTING -j REDIRECT -p tcp -s $INETWORKIP -d ! $INETWORKIP --dport 81 --to-port 3128
/sbin/iptables -t nat -A POSTROUTING -j SNAT -s 192.168.100.0/255.255.255.0 -d $ANYWHERE -o $EXTDEV --to $EXTERNALIP
/sbin/iptables -t nat -A POSTROUTING -j MASQUERADE -s 192.168.100.0/255.255.255.0 -d $ANYWHERE -o $EXTDEV
Буду очень признателен.
Вариант для распечатки
OpenNET: Виртуальная конференция (Public)
on
03-Дек-03, 12:43 (MSK)
