>примерно так:
># Port Forwarding is enabled, so accept forwarded traffic
>$IPT -A FORWARD -p udp -i $INET_IFACE --destination-port 6667:6669 \
> --destination 192.168.1.2 -j ACCEPT
>
>$IPT -A FORWARD -p tcp -i $INET_IFACE --destination-port 6667:6669 \
> --destination 192.168.1.2 -j ACCEPT
># Port Forwarding
>$IPT -t nat -A PREROUTING -p udp -i $INET_IFACE --destination-port 6667:6669 \
>
> -j DNAT --to-destination 192.168.1.2
>
>$IPT -t nat -A PREROUTING -p tcp -i $INET_IFACE --destination-port 6667:6669 \
>
> -j DNAT --to-destination 192.168.1.2
>
>$IPT -t nat -A PREROUTING -p udp -i $LOCAL_IFACE --destination-port 6667:6669 \
>
> --destination $INET_ADDRESS -j DNAT --to-destination 192.168.1.2
>
>$IPT -t nat -A PREROUTING -p tcp -i $LOCAL_IFACE --destination-port 6667:6669 \
>
> --destination $INET_ADDRESS -j DNAT --to-destination 192.168.1.2
>
>возможно придется нарисовать еще правила для ident запросов irc сервера, то есть
>открыть ident port 113
>$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 113 -j ACCEPT
>$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 113 -j ACCEPT
>
>
таже фигня :( Невозможно подключиться к серверу (Соединение прервано по тайм-ауту)
вот все что у меня делается:
может я чето напортачил :(
#! /bin/sh
INET_IP="a.a.a.a"
INET_IFACE="eth0"
INET_BROADCAST="a.a.a.255"
LAN_IP="192.168.1.1"
LAN_IP_RANGE="192.168.1.0/24"
LAN_IFACE="eth1"
LO_IFACE="lo"
LO_IP="127.0.0.1"
VPN_LAN="193.168.3.0/24"
IPTABLES="/sbin/iptables"
/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state
/sbin/modprobe ipt_owner
/sbin/modprobe ipt_REJECT
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -N bad_tcp_packets
$IPTABLES -N allowed
$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets
# bad_tcp_packets chain
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
# allowed chain
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP
# TCP rules
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 443 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 1723 -j allowed
# UDP ports
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 53 -j ACCEPT
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 123 -j ACCEPT
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 2074 -j ACCEPT
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 4000 -j ACCEPT
$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d $INET_BROADCAST --destination-port 135:139 -j DROP
# ICMP rules
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
#
# Bad TCP packets we don't want.
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets
# Rules for special networks not part of the Internet
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT
# Rules for incoming packets from the internet.
$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED \
-j ACCEPT
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
$IPTABLES -A INPUT -i $INET_IFACE -d 224.0.0.0/8 -j DROP
$IPTABLES -A INPUT -i $LAN_IFACE -d 224.0.0.0/8 -j DROP
# Log weird packets that don't match the above.
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
iptables -A FORWARD -s $VPN_LAN -j ACCEPT
iptables -A FORWARD -d $VPN_LAN -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "
## Пропуск в инет после авторизации на VPN и получении своего IP ##
## Вкл/Выкл считалкой ##
$IPTABLES -t nat -A POSTROUTING -s 192.168.3.10 -o $INET_IFACE -j SNAT --to-source $INET_IP
Вариант для распечатки
OpenNET: Виртуальная конференция (Public)
(ok) on
06-Апр-04, 13:53 (MSK)
