Добрый день.
Есть такой вопросик. Стоит шлюз на котором все настроено через iptables вот этим скриптом:
#!/bin/sh
echo "Starting firewalling..."
INET_IP="AA.BB.CC.DD"
INET_IFACE="ppp0"
LAN_IP="192.168.0.9"
LAN_IFACE="eth0"
DMZ_SERVER_IP="192.168.0.1"
LO_IFACE="lo"
LO_IP="127.0.0.1"
IPTABLES="/sbin/iptables"
echo "Cheking module dependencies..."
/sbin/depmod -a
echo "Loading additional modules..."
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
###############################################################
# Enable IPv4 forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Enable broadcast echo Protection
#echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Disable Source Routed Packets
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
echo 0 > $f
done
# Enable TCP SYN Cookie Protection
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
# Disable ICMP Redirect Acceptance
#for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
echo 0 > $f
done
# Dont send Redirect Messages
for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
echo 0 > $f
done
# Drop Spoofed Packets coming in on an interface, which if replied to,
# would result in the reply going out a different interface.
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $f
done
# Log packets with impossible addresses.7
#for f in /proc/sys/net/ipv4/conf/*/log_martians; do
# echo 1 > $f
#done
###############################################################
echo "Flushing chains..."
$IPTABLES -F
$IPTABLES -X
$IPTABLES -F -t nat
$IPTABLES -X -t nat
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
#
# 4.1.4 INPUT chainn
#
$IPTABLES -A INPUT -i $INET_IFACE -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A INPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -i $INET_IFACE -p UDP --dport 53 -j ACCEPT
$IPTABLES -A INPUT -i $INET_IFACE -p TCP --dport 53 -j ACCEPT
$IPTABLES -A INPUT -p TCP --dport 22 -j ACCEPT
$IPTABLES -A INPUT -i $LAN_IFACE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -d 192.168.0.255 --dport 135:139 -j DROP
$IPTABLES -A INPUT -p UDP -i $LAN_IFACE -d 255.255.255.255 --dport 67 -j ACCEPT
#
# 4.1.5 FORWARD chain
#
$IPTABLES -A FORWARD -i $INET_IFACE -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
$IPTABLES -A FORWARD -i $INET_IFACE -p tcp ! --syn -m state --state NEW -j DROP
##############
$IPTABLES -A FORWARD -i $INET_IFACE -o $LAN_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -p TCP -i $LAN_IFACE -o $INET_IFACE -s 192.168.0.11 --dport 60179 -j ACCEPT
$IPTABLES -A FORWARD -p TCP -i $LAN_IFACE -o $INET_IFACE -s 192.168.0.57 -m multiport --dport 23,25,110,443,3389,2000,4490,10153,12992 -j ACCEPT
$IPTABLES -A FORWARD -p TCP -i $LAN_IFACE -o $INET_IFACE -s 192.168.0.57 --dport 60179 -j ACCEPT
$IPTABLES -A FORWARD -p all -i $LAN_IFACE -o $INET_IFACE -s 192.168.0.1 -j ACCEPT
#$IPTABLES -A FORWARD -p TCP -i $INET_IFACE -o $LAN_IFACE -d $DMZ_SERVER_IP -m multiport --dport 20,21,143,25,465,995,9090,5222,5223 -j ACCEPT
$IPTABLES -A FORWARD -i $LAN_IFACE -o $INET_IFACE -s $DMZ_SERVER_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i ppp0 -o eth0 -j ACCEPT
$IPTABLES -A FORWARD -i eth0 -o ppp0 -j ACCEPT
#$IPTABLES -A FORWARD -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died:"
#
# 4.1.6 OUTPUT chain
#
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -o ppp0 -j ACCEPT
$IPTABLES -A OUTPUT -p udp -m udp -o $INET_IFACE --dport 53 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m tcp -o $INET_IFACE --dport 53 -j ACCEPT
#
# Log weird packets that don't match the above.
#
#$IPTABLES -A OUTPUT -j LOG --log-prefix "IPT OUTPUT packet died: "
#
# 4.2 NAT table
#
$IPTABLES -t nat -A PREROUTING -d $INET_IP -p TCP -m multiport --dport 21,22,25,80,81,143,465,995,9090,5222,5223 -j DNAT --to-destination $DMZ_SERVER_IP
$IPTABLES -t nat -A PREROUTING -i $LAN_IFACE -p TCP --dport 80 -j REDIRECT --to-ports 3128
$IPTABLES -t nat -A PREROUTING -d $INET_IP -p tcp --dport 8080 -j DNAT --to-destination 192.168.0.9:8080
$IPTABLES -t nat -A PREROUTING -d $INET_IP -p tcp --dport 4899 -j DNAT --to-destination 192.168.0.59:4899
$IPTABLES -t nat -A PREROUTING -d $INET_IP -p tcp --dport 4891 -j DNAT --to-destination 192.168.0.157:4891
$IPTABLES -t nat -A POSTROUTING -s 192.168.0.0/24 -o $INET_IFACE -j SNAT --to-source $INET_IP
Вопросов несколько:
Первый - при таком скрипте все работает, но я не могу открыть порт 53 tcp во внутрь (для ДНС, ДНС стоит на этом же сервере).
Второй - если закоментировать строку
$IPTABLES -t nat -A PREROUTING -d $INET_IP -p TCP -m multiport --dport 21,22,25,80,81,143,465,995,9090,5222,5223 -j DNAT --to-destination $DMZ_SERVER_IP
то порты 21,80,143,995,9090 становяться закрытими.
Подскажите как правильно открыть порты во внутрь.
Тема: Помогите разобраться с iptables (Прочитано 2634 раз)
