Linuxでファイアウォール(iptables)を構築する設定内容確認と設定例

iptables設定内容下記:
echo “Enable IPForwarding…"

echo 1>/proc/sys/net/ipv4/ip_forward

echo “iptablesルール開始…"

/sbin/modprobe iptable_filter

/sbin/modprobe ip_tables

/sbin/modprobe iptable_nat

/sbin/modprobe ip_nat_ftp ;//FTPをサポート

/sbin/modprobe ip_conntrack_ftp ;

/sbin/modprobe ip_conntrack_h323 ;//NETMEETINGをサポート

/sbin/modprobe ip_nat_h323 ;

iptables -F INPUT

iptables -F FORWARD

iptables -F OUTPUT

iptables -F POSTROUTING -t nat

iptables -F PREROUTING -t nat

iptables -P INPUT DROP

iptables -P FORWARD DROP

iptables -P OUTPUT ACCEPT

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -i eth1 -j ACCEPT   //eth1内部ネットワーク

iptables -A INPUT -i eth0 -m state –stateESTABLISHED,RELATED -j ACCEPT  //eth0グローバルネットワーク

iptables -A FORWARD -s 192.168.0.0/24 -jACCEPT

iptables -A FORWARD -i eth0 -m state–state ESTABLISHED,RELATED -j ACCEPT

iptables -t nat -A POSTROUTING -o eth0 -s192.168.0.0/24 -j MASQUERADE

/etc/rc.d/init.d/iptables restart  //iptablesが再起動

iptables -L

 

 

#touch /etc/rc.d/firewall
# chmod u+x /etc/rc.d/firewall
# echo “/etc/rc.d/firewall" >> /etc/rc.d/rc.local
# vi /etc/rc.d/firewall
#!/bin/bash
echo “1" /proc/sys/net/ipv4/ip_forward
INET_IFACE="eth1″
INET_IP="10.19.51.182″
LAN_IFACE="eth0″
LAN_IP="192.168.0.1″
LAN_IP_RANGE="192.168.0.0/24″
IPT="/sbin/iptables"
SERVER="192.168.0.100″
DNS="192.168.0.99″
HTTP="80″
MAIL_SMTP="25″
MAIL_POP3="110″
DNS_PORT="53″
/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe iptable_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ipt_LOG
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
for TABLE in filter nat mangle ; do
$IPT -t $TABLE -F
$IPT -t $TABLE -X
done
$IPT -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
for DNS in $(grep ^n /etc/resolv.conf|awk '{print $2}’) ; do
$IPT -A INPUT -p udp -s $DNS –sport domain -j ACCEPT
done
$IPT -A INPUT -p tcp –sport $HTTP -j ACCEPT
$IPT -A INPUT -p tcp –sport $MAIL_25 -j ACCEPT
$IPT -A INPUT -p tcp –sport $MAIL_110 -j ACCEPT
$IPT -A INPUT -p tcp –sport $DNS_PORT -j ACCEPT
$IPT -N LOGDENY
$IPT -A LOGDENY -j LOG –log-prefix “iptables:"
$IPT -A LOGDENY -j DROP
$IPT -A INPUT -i ! lo -m state –state NEW,INVALID -j LOGDENY
#if [ “$INET_IFACE" = ppp0 ] ; then
#$IPT -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE
#else
#$IPT -t nat -A POSTROUTING -o $INET_IFACE -j SNAT –to $INET_IP
#fi
$IPT -t nat -A POSTROUTING -o $INET_IFACE -s 192.168.0.25 -j SNAT –to $INET_IP

$IPT -t net -A PRERROUTING -p tcp -d$INET_IP –dport $HTTP \
-j DNAT –to $SERVER:$HTTP
$IPT -t net -A PRERROUTING -p tcp -d $INET_IP –dport $MAIL_25 \
-j DNAT –to $SERVER:$MAIL_25
$IPT -t net -A PRERROUTING -p tcp -d $INET_IP –dport $MAIL_110 \
-j DNAT –to $SERVER:$MAIL_110
$IPT -t net -A PRERROUTING -p tcp -d $INET_IP –dport $DNS_PORT \
-j DNAT –to $DNS:$DNS_PORT
:wq
#/etc/rc.d/firewall

Linux

Posted by arkgame