iptables: http, ftp, icmp, pop, smtp

[stempher]

Помогите освоить зверя в лице iptables.
Есть два интерфейса. Один смотрит в локалку (eth0, 10.0.0.1), второй в инет (eth1, 195.x.x.x). Как правильно настроить iptables?

[romanex]

http://www.opennet.ru/docs/RUS/iptables/
возникнут вопросы - задавайте

[stempher]

Поначитался тут всякого и решил выложить свои "размышления" на всеобщее обсуждение. Буду благодарен на указание ошибок или тонких мест и описание пути их исправления.
Сначала:

Код: [Выделить]

# echo "1" > /proc/sys/net/ipv4/ip_forward
# iptables -F
А потом:

Код: [Выделить]

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
[0:0] -A POSTROUTING -s 10.0.0.0/24  -o eth1 -j MASQUERADE
COMMIT
#
#
*mangle
:PREROUTING ACCEPT [20:1995]
:INPUT ACCEPT [20:1995]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [11:821]
:POSTROUTING ACCEPT [11:821]
#
#
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:allowedws - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_packets - [0:0]
:udp_packets - [0:0]
[0:0] -A INPUT -p tcp -j bad_tcp_packets
[0:0] -A INPUT -s 127.0.0.1 -i lo -j ACCEPT
[0:0] -A INPUT -i eth1 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
[0:0] -A INPUT -s 10.0.0.0/24 -i eth0 -p tcp -j allowedws
[0:0] -A INPUT -i eth1 -p tcp -m tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
[0:0] -A INPUT -i eth1 -p tcp -m tcp --sport 20 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -i eth1 -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT
[0:0] -A INPUT -d 195.x.x.x -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -i eth0 -p udp -j udp_packets
[0:0] -A INPUT -i eth1 -p udp -j udp_packets
[0:0] -A INPUT -i eth0 -p icmp -j icmp_packets
[0:0] -A INPUT -d 224.0.0.0/255.0.0.0 -i eth1 -j DROP
[0:0] -A INPUT -s 10.0.0.0/255.0.0.0 -i eth1 -j DROP
[0:0] -A INPUT -s 192.168.0.0/255.255.0.0 -i eth1 -j DROP
[0:0] -A INPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT INPUT packet died: " --log-level 7
#
[0:0] -A FORWARD -p tcp -j bad_tcp_packets
[0:0] -A FORWARD -s 10.0.0.0/24 -i eth0 -j ACCEPT
[0:0] -A FORWARD -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -i eth1 -o eth0 -p tcp -m tcp -d 10.0.0.0/24 -m multiport --sports pop3,smtp -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp -s 10.0.0.0/24 -m multiport --dports pop3,smtp -j ACCEPT
[0:0] -A FORWARD -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT FORWARD packet died: " --log-level 7
#
[31:3164] -A OUTPUT -p tcp -j bad_tcp_packets
[0:0] -A OUTPUT -s 127.0.0.1 -j ACCEPT
[0:0] -A OUTPUT -s 10.0.0.1 -j ACCEPT
[0:0] -A OUTPUT -s 195.x.x.x -j ACCEPT
[0:0] -A OUTPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT OUTPUT packet died: " --log-level 7
#
[0:0] -A allowedws -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
[60:4512] -A allowedws -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
[0:0] -A bad_tcp_packets -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "New not sys with NEW:"
[0:0] -A icmp_packets -p icmp -m icmp --icmp-type 0 -j ACCEPT
[0:0] -A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT
[0:0] -A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
[0:0] -A udp_packets -p udp -m udp --dport 53 -j ACCEPT   
COMMIT