linux iptable设置实践

发布时间：2014-09-05 14:16:23作者：知识屋

linux iptable设置实践

下面是设置网络时的基本状况：

主机3个网卡：

eth0 192.168.0.1/24 内网

eth1 192.168.20.1/24 外网

eth2 192.168.50.1/24 会议室网络

ppp0 （设置为 eth1 上拨号上网）

DHCP设置：

192.168.0.1/24 { 192.168.0.100----192.168.0.200 }

192.168.50.1/24 {192.168.50.100---192.168.50.200 }

VPN设置：

localip: 192.168.10.1

remoteip: 192.168.10. 100 192.168.10.150

下面是firewall的具体设置：

[root@yujiagw ~]# cat firewall

#!/bin/sh

iptables -F

iptables -t nat -F

iptables -P FORWARD ACCEPT

iptables -X poweruser

iptables -X qquser

iptables -X httpuser

# NAT

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

#iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE

iptables -t nat -A PREROUTING -p tcp --dport 53 -j ACCEPT

iptables -t nat -A PREROUTING -p udp --dport 53 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 25 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 110 -j ACCEPT

#iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 443

#iptables -t nat -A PREROUTING -p udp --dport 443 -j REDIRECT --to-port 443

# Port Forwarding

#iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 3389 -j DNAT --to 192.168.0.4:3389

#iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 80 -j DNAT --to 192.168.0.4:80

#iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 8080 -j DNAT --to 192.168.50.2:8080

#iptables -A FORWARD -d 192.168.50.2 -p tcp --dport 8080 -j ACCEPT

#iptables -t nat -A POSTROUTING -d 192.168.50.2 -p tcp --dport 8080 -j SNAT --to 192.168.0.1

# Basic Port Open

iptables -A FORWARD -p tcp --dport 53 -j ACCEPT

iptables -A FORWARD -p udp --dport 53 -j ACCEPT

iptables -A FORWARD -p tcp --dport 25 -j ACCEPT

iptables -A FORWARD -p tcp --dport 110 -j ACCEPT

# VPN

iptables -A FORWARD -s 192.168.10.0/24 -d 192.168.0.0/24 -j ACCEPT

iptables -A FORWARD -s 192.168.0.0/24 -d 192.168.10.0/24 -j ACCEPT

# Conference Room

iptables -A FORWARD -s 192.168.50.0/24 -d 192.168.0.0/24 -j ACCEPT

iptables -A FORWARD -s 192.168.0.0/24 -d 192.168.50.0/24 -j ACCEPT

# Set Connect WAN

iptables -A FORWARD -d 192.168.50.0/24 -j ACCEPT

# HeQuanXin

#iptables -A FORWARD -m mac --mac-source 00:1A:6B:35:A5:66 -j ACCEPT

#iptables -A FORWARD -m mac --mac-source 44:D8:84:0A:9F:5D -j ACCEPT

#-----------------------------------PowerUser-------define------------------------

iptables -N poweruser

iptables -A poweruser -j ACCEPT

#---------------------------------httpuser define-----------------

# Set Http User

iptables -N httpuser

iptables -A httpuser -p tcp --dport 53 -j ACCEPT

iptables -A httpuser -p udp --dport 53 -j ACCEPT

# Reject QQZone

iptables -A httpuser -d user.qzone.qq.com -j REJECT

iptables -A httpuser -p tcp --dport 80 -j ACCEPT

iptables -A httpuser -p udp --dport 80 -j ACCEPT

iptables -A httpuser -p tcp --dport 25 -j ACCEPT

iptables -A httpuser -p tcp --dport 110 -j ACCEPT

iptables -A httpuser -p tcp --dport 443 -j ACCEPT

iptables -A httpuser -p udp --dport 443 -j ACCEPT

iptables -A httpuser -j DROP

#-----------------------------------User-------start------------------------

# HeQuanXin

iptables -A FORWARD -m mac --mac-source 00:1A:6B:35:A5:66 -j httpuser

# xiangshude

iptables -A FORWARD -m mac --mac-source 00:E0:4C:41:49:C4 -j httpuser

# shiyayun

iptables -A FORWARD -m mac --mac-source C8:9C:DC:D2:55:7A -j poweruser

# chenmingxiang

iptables -A FORWARD -m mac --mac-source 54:04:A6:58:A3:EE -j poweruser

# wangxiaoping

iptables -A FORWARD -m mac --mac-source 00:B0:C4:04:A1:7E -j httpuser

# chengmeirong

iptables -A FORWARD -m mac --mac-source 90:2B:34:2D:E6:5B -j httpuser

# zhangyinbo

iptables -A FORWARD -m mac --mac-source 14:DA:E9:D2:3F:DF -j httpuser

# luxiaoxiong

iptables -A FORWARD -m mac --mac-source 90:2B:34:CB:31:EE -j httpuser

#-----------------------------------HTTPUser-------end--------------------------

#-----------------------------------------------------------------------------------

# Block Xunlei

iptables -A FORWARD -d 58.61.39.0/24 -j REJECT

iptables -A FORWARD -d 121.9.209.6 -j REJECT

iptables -A FORWARD -d 121.9.209.7 -j REJECT

iptables -A FORWARD -d 121.9.209.3 -j REJECT

iptables -A FORWARD -d 61.183.55.216 -j REJECT

iptables -A FORWARD -d 61.183.55.218 -j REJECT

iptables -A FORWARD -d 61.183.55.222 -j REJECT

iptables -A FORWARD -d 220.172.191.36 -j REJECT

iptables -A FORWARD -d 121.11.69.108 -j REJECT

iptables -A FORWARD -d 125.91.8.77 -j REJECT

iptables -A FORWARD -d 218.6.13.134 -j REJECT

iptables -A FORWARD -d 219.133.48.0/24 -j REJECT

iptables -A FORWARD -d 219.133.49.0/24 -j REJECT

iptables -A FORWARD -d 219.129.83.0/24 -j REJECT

iptables -A FORWARD -d 219.133.60.0/24 -j REJECT

iptables -A FORWARD -d 210.21.118.141 -j REJECT

iptables -A FORWARD -d 210.21.118.147 -j REJECT

iptables -A FORWARD -d 210.21.118.149 -j REJECT

iptables -A FORWARD -d 221.238.251.118 -j REJECT

iptables -A FORWARD -d 221.238.252.127 -j REJECT

iptables -A FORWARD -d 221.238.252.154 -j REJECT

iptables -A FORWARD -d 221.238.252.155 -j REJECT

iptables -A FORWARD -d 221.238.252.233 -j REJECT

iptables -A FORWARD -d 221.238.253.246 -j REJECT

iptables -A FORWARD -d 222.208.156.0/24 -j REJECT

iptables -A FORWARD -d 203.110.168.233 -j REJECT

iptables -A FORWARD -d 208.115.244.194 -j REJECT

iptables -A FORWARD -d 65.19.183.185 -j REJECT

#Block BT

iptables -A FORWARD -p tcp --dport 6880:6881 -j REJECT

iptables -A FORWARD -p udp --dport 6880:6881 -j REJECT

# Invalid connect drop

iptables -A FORWARD -m state --state INVALID -j DROP

# Accept the already establised connection

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Set the FORWARD chain to DENY

iptables -P FORWARD DROP

（免责声明：文章内容如涉及作品内容、版权和其它问题，请及时与我们联系，我们将在第一时间删除内容，文章内容仅供参考）

上一篇:CentOS安装多音频解码器打造Linux全能播放器

下一篇:英文Ubantu系统安装中文输入法

软件推荐

更多 >

游戏推荐

更多 >

精选栏目

手机游戏

手机软件

电脑软件

猜你喜欢

网贷借钱腾讯放置音乐唱歌教育摄像奇迹手机美化借钱射击低息医疗办公卡牌购物分期动作抢票街机即时儿童钱包战国摄影传奇抖音二次元母婴魔幻体育影音恋爱阅读财经 WIFI 运动学习趣味角色扮演格斗健康闯关模拟战斗 3D 导航拍照直播小说

linux iptable设置实践

相关知识

软件推荐

游戏推荐

精选栏目

win10

YLMF—OS

Win—XP

windows8

linux

windows7

热门推荐

手机游戏

手机软件

电脑软件

猜你喜欢