Ребята, у меня проблема такая, после перехода на анлим появилось куча новых возможностей
, а torrent не работает. Сам firewall писал мне хороший друг, я лишь попытался сиволапо дописать правила, чтоб торрент-клиент на виндовой машине работал, но не получается, не работает торрент, не хочет качать. Вот что у меня есть, в чем проблема?
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe iptable_nat
modprobe ip_nat_ftp
#--Constants
IPTABLES="/sbin/iptables"
INET_IFACE="ppp0"
INET_ADDR="x.x.x.x"
LOCAL_IFACE="eth1"
LOCAL_ADDR="192.168.0.1"
LOCAL_NWORK="192.168.0.0/24"
LOCAL_NWORK_MASK="24"
LOCAL_BCAST="192.168.0.255"
ADMIN_ADDR="192.168.0.53"
ADMIN_ADDR2="192.168.0.199"
#--Flush all chains in all tables
$IPTABLES -t filter -F
$IPTABLES -t filter -X
$IPTABLES -t nat -F
$IPTABLES -t nat -X
$IPTABLES -t mangle -F
$IPTABLES -t mangle -X
#--setting up default policies
$IPTABLES -t filter -P INPUT DROP
$IPTABLES -t filter -P OUTPUT DROP
$IPTABLES -t filter -P FORWARD DROP
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
$IPTABLES -t mangle -P INPUT ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT
$IPTABLES -t mangle -P FORWARD ACCEPT
$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P POSTROUTING ACCEPT
#--Creating chains
$IPTABLES -N bad_tcp_packets
#--Enable local trafic
$IPTABLES -t filter -A INPUT -i lo -j ACCEPT
$IPTABLES -t filter -A OUTPUT -o lo -j ACCEPT
#--Enfull service chains
$IPTABLES -t filter -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state \
--state NEW -j REJECT
#--Check all tcp trafic in the service chain
$IPTABLES -t filter -A INPUT -p tcp -j bad_tcp_packets
$IPTABLES -t filter -A OUTPUT -p tcp -j bad_tcp_packets
$IPTABLES -t filter -A FORWARD -p tcp -j bad_tcp_packets
$IPTABLES -t filter -A INPUT -p icmp -j ACCEPT
$IPTABLES -t filter -A OUTPUT -p icmp -j ACCEPT
$IPTABLES -t filter -A FORWARD -p icmp -j ACCEPT
#--Enable DNS service access to localhost and internal network
$IPTABLES -t filter -A OUTPUT -p udp --dport domain -o $INET_IFACE \
-m state ! --state INVALID -j ACCEPT
$IPTABLES -t filter -A INPUT -p udp --sport domain -i $INET_IFACE \
-m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -t filter -A FORWARD -p udp --dport domain -o $INET_IFACE -s $LOCAL_NWORK \
-m state ! --state INVALID -j ACCEPT
$IPTABLES -t filter -A FORWARD -p udp --sport domain -i $INET_IFACE -d $LOCAL_NWORK \
-m state --state ESTABLISHED,RELATED -j ACCEPT
#--Services, allowed to localhost from internet
$IPTABLES -t filter -A OUTPUT -p tcp -m multiport \
--dports http,https -o $INET_IFACE -m state ! --state INVALID -j ACCEPT
$IPTABLES -t filter -A INPUT -p tcp -m multiport \
--sports http,https -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -t filter -A OUTPUT -p tcp -m multiport \
--dports ftp,ftp-data -o $INET_IFACE -m state ! --state INVALID -j ACCEPT
$IPTABLES -t filter -A INPUT -p tcp -m multiport \
--sports ftp,ftp-data -i $INET_IFACE -m state ! --state INVALID -j ACCEPT
#--TCP services, allowed to local nwork from localhost
$IPTABLES -t filter -A OUTPUT -p tcp -m multiport --sports 8080,1024,2802,http-proxy,10000 \
-o $LOCAL_IFACE -d $LOCAL_NWORK -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -t filter -A INPUT -p tcp -m multiport --dports 8080,1024,2802,http-proxy,10000 \
-i $LOCAL_IFACE -s $LOCAL_NWORK -m state ! --state INVALID -j ACCEPT
#--TCP services, directly allowed to local nwork
$IPTABLES -t filter -A FORWARD -p tcp -m multiport \
--dports smtp,pop3,imap,5190,6667,2802 \
-o $INET_IFACE -s $LOCAL_NWORK -m state ! --state INVALID -j ACCEPT
$IPTABLES -t filter -A FORWARD -p tcp -m multiport \
--sports smtp,pop3,imap,5190,6667,2802 \
-i $INET_IFACE -d $LOCAL_NWORK -m state --state ESTABLISHED,RELATED -j ACCEPT
#--TCP services, directly allowed to admin
$IPTABLES -t filter -A FORWARD -p tcp -m multiport \
--dports http,https \
-o $INET_IFACE -s $ADMIN_ADDR -m state ! --state INVALID -j ACCEPT
$IPTABLES -t filter -A FORWARD -p tcp -m multiport \
--sports http,https \
-i $INET_IFACE -d $ADMIN_ADDR -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -t filter -A FORWARD -p tcp -m multiport \
--dports http,https,6881 \
-o $INET_IFACE -s $ADMIN_ADDR2 -m state ! --state INVALID -j ACCEPT
$IPTABLES -t filter -A FORWARD -p tcp -m multiport \
--sports http,https,6881 \
-i $INET_IFACE -d $ADMIN_ADDR2 -m state --state ESTABLISHED,RELATED -j ACCEPT
#--NAT operations on local net
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -s $LOCAL_NWORK \
-j SNAT --to-source $INET_ADDR
#--Rules for torrent
$IPTABLES -A INPUT -s 0.0.0.0/0 -p tcp --dport 6880:6999 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -p tcp --dport 6880:6999 \
-j DNAT --to $ADMIN_ADDR2
$IPTABLES -A FORWARD -i $INET_IFACE -o $LOCAL_IFACE -p tcp -d $ADMIN_ADDR2 \
--dport 6880:6999 -j ACCEPT
Тема: HOWTO: Iptables для новичков (Прочитано 530305 раз)
