| |
1 #! /bin/sh
2
3 trusthost='192.168.0.20'
4 internal_ip='192.168.0.0/24'
5
6 my_internet_ip='1.2.3.4'
7 my_internal_ip='192.168.0.1'
8
9
10 proxy_ip='192.168.0.100'
11 proxy_port='3128'
12
13 echo 1 > /proc/sys/net/ipv4/ip_forward
14
15 ##############
16 #Flush & Reset
17 ##############
18 iptables -F
19 iptables -t nat -F
20 iptables -X
21
22 ##############
23 #Deafult Rule
24 ##############
25 iptables -P INPUT DROP
26 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
27
28 iptables -P OUTPUT ACCEPT
29
30 iptables -P FORWARD DROP
31 iptables -A FORWARD -i eth1 -o eth0 -s $internal_ip -j ACCEPT
32 iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
33
34 #########
35 #loopback
36 #########
37 iptables -A INPUT -i lo -j ACCEPT
38 iptables -A OUTPUT -o lo -j ACCEPT
39 #######################
40 #ICMP trusthost->myhost
41 #######################
42 iptables -A INPUT -p icmp --icmp-type echo-request -s $trusthost -d $my_internal_ip -j ACCEPT
43 iptables -A OUTPUT -p icmp --icmp-type echo-reply -s $my_internal_ip -d $trusthost -j ACCEPT
44 #######################
45 #ICMP myhost->trusthost
46 #######################
47 iptables -A OUTPUT -p icmp --icmp-type echo-request -s $my_internal_ip -d $trusthost -j ACCEPT
48 iptables -A INPUT -p icmp --icmp-type echo-reply -s $trusthost -d $my_internal_ip -j ACCEPT
49 #######################
50 #ssh trusthost-> myhost
51 #######################
52 iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
53 iptables -A INPUT -p tcp -m state --state NEW,ESTABLISHED,RELATED -s $trusthost -d $my_internal_ip --dport 22 -j ACCEPT
54 iptables -A OUTPUT -p tcp -s $my_internal_ip --sport 22 -d $trusthost -j ACCEPT
55
56 #################
57 #SNAT(masquerade)
58 #################
59 iptables -t nat -A POSTROUTING -o eth0 -s $internal_ip -j MASQUERADE
60 ####################
61 #Transparently proxy
62 ####################
63 iptables -t nat -A PREROUTING -i eth1 -s ! $proxy_ip -p tcp --dport 80 -j DNAT --to $proxy_ip:$proxy_port
64 iptables -t nat -A POSTROUTING -o eth1 -s $internal_ip -d $proxy_ip -j SNAT --to $my_internal_ip
65 iptables -A FORWARD -s $internal_ip -d $proxy_ip -i eth1 -o eth1 -p tcp --dport $proxy_port -j ACCEPT
66
67 ################################################
68 #Outgoing packet should be real internet Address
69 ################################################
70 #iptables -A OUTPUT -o eth0 -d 10.0.0.0/8 -j DROP
71 iptables -A OUTPUT -o eth0 -d 176.16.0.0/12 -j DROP
72 iptables -A OUTPUT -o eth0 -d 192.168.0.0/16 -j DROP
73 iptables -A OUTPUT -o eth0 -d 127.0.0.0/8 -j DROP
74
75 #########
76 #logging
77 #########
78 iptables -N LOGGING
79 iptables -A LOGGING -j LOG --log-level warning --log-prefix "DROP:" -m limit
80 iptables -A LOGGING -j DROP
81 iptables -A INPUT -j LOGGING
82 iptables -A FORWARD -j LOGGING |
|