4815l1.txt100664 2046 330 603 7323341351 11117 0ustar jillljedit4815l1 Listing 1. Needs caption #!/bin/sh # first, declare our trusted path PATH=/sbin:/usr/sbin:/usr/local/sbin:/bin:/usr/bin:/usr/local/bin export PATH # modify the following to point to your iptables binary: IPT=/usr/local/sbin/iptables echo 0 > /proc/sys/net/ipv4/ip_forward # some modules we'll want to install modprobe ip_tables modprobe ip_nat_ftp modprobe ip_conntrack_ftp 4815l2.txt100664 2046 330 4057 7323341351 11147 0ustar jillljedit4815l2 Listing 2. rc.iptables.dynamic #!/bin/sh PATH=/sbin export PATH IPT=`which` iptables # define interfaces # internal interface IINT=eth0 # external interface (can be ppp+, eth#, ippp+, etc.) IEXT=eth1 # internal network INTNET=192.168.0.0/24 # first, turn off forwarding echo 0 > /proc/sys/net/ipv4/ip_forward modprobe ip_tables modprobe ip_nat_ftp modprobe ip_conntrack_ftp # flush all chains and delete user chains for i in filter nat mangle do $IPT -t $i -F $IPT -t $i -X done # if your ISP blocks "fragmentation needed" ICMP packets, i.e.,: # web browsers connect, then hand with no data received # small e-mail works OK, but large e-mails hang # ssh works OK, but scp hangs after initial handshake # uncomment the following: # $IPT -t filter -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu # create new user chain $IPT -t filter -N tcprules $IPT -A tcprules -i $IEXT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A tcprules -i ! $IEXT -m state --state NEW -j ACCEPT $IPT -A tcprules -i $IEXT -m state --state NEW,INVALID -j LOG --log-prefix "IPT DROP " $IPT -A tcprules -i $IEXT -m state --state NEW,INVALID -j DROP $IPT -A INPUT -j tcprules $IPT -A FORWARD -j tcprules # now for masquerading $IPT -t nat -A POSTROUTING -o $IEXT -s $INTNET -j MASQUERADE # a few mangle rules you might or might not want to try out # note that ssh does its own TOS, so is not required below $IPT -t mangle -A PREROUTING -m multiport -p tcp --dport 80,21,22 -j TOS --set-tos 16 $IPT -t mangle -A PREROUTING -m multiport -p tcp --sport 80,21,22 -j TOS --set-tos 16 $IPT -t mangle -A PREROUTING -p tcp --dport ftp-data -j TOS --set-tos 8 $IPT -t mangle -A PREROUTING -p tcp --sport ftp-data -j TOS --set-tos 8 $IPT -t mangle -A PREROUTING -p tcp --dport 25 -j TOS --set-tos 4 $IPT -t mangle -A PREROUTING -p tcp --dport 110 -j TOS --set-tos 2 # if you have a line in your /etc/sysctl.conf like this: # net.ipv4.ip_forward = 1 # uncomment the following and comment out the echo line below it #/sbin/sysctl -p > /dev/null echo 1 > /proc/sys/net/ipv4/ip_forward 4815l3.txt100664 2046 330 5763 7323341351 11155 0ustar jillljedit4815l3 Listing 3. rc.iptables.static #!/bin/sh PATH=/sbin export PATH IPT=`which` iptables # define interfaces # internal interface IINT=eth0 # external interface (can be ppp+, eth#, ippp+, etc.) IEXT=eth1 # internal network INTNET=192.168.0.0/24 # external interface IP(s) EXTIP=10.0.0.2-10.0.0.6 # web servers for public use: # WEB=192.168.0.2-192.168.0.6:80 # if the above or below is a range of servers, netfilter will perform # a rudimentary form of load balancing # DNS servers: # DNS=192.168.0.8-192.168.0.9:53 ### # first, turn off forwarding echo 0 > /proc/sys/net/ipv4/ip_forward modprobe ip_tables modprobe ip_nat_ftp modprobe ip_conntrack_ftp # flush all chains and delete user chains for i in filter nat mangle do $IPT -t $i -F $IPT -t $i -X done # if your ISP blocks "fragmentation needed" ICMP packets, i.e.,: # web browsers connect, then hang with no data received # small e-mail works OK, but large e-mails hang # ssh works OK, but scp hangs after initial handshake # uncomment the following: # $IPT -t filter -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu # create new user chain $IPT -t filter -N tcprules ### ## ACCEPT HERE ANY PORTS YOU WISH TO DNAT BELOW ## # $IPT -A tcprules -i $IEXT -p tcp --dport 80 -m state --state NEW -j ACCEPT # $IPT -A tcprules -i $IEXT -p udp --dport 53 -m state --state NEW -j ACCEPT ### # Note: you may want to change the above rules to limit the number of # connections per minute or else run portsentry, etc., to watch for and # block bad guys: # $IPT -A tcprules -i $IEXT -p tcp --dport 80 -m limit --limit 3/second -m state --state NEW -j ACCEPT $IPT -A tcprules -i $IEXT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A tcprules -i ! $IEXT -m state --state NEW -j ACCEPT $IPT -A tcprules -i $IEXT -m state --state NEW,INVALID -j LOG --log-prefix "IPT DROP " $IPT -A tcprules -i $IEXT -m state --state NEW,INVALID -j DROP $IPT -A INPUT -j tcprules $IPT -A FORWARD -j tcprules ### ## DNAT RULES GO HERE ## # $IPT -t nat -A PREROUTING -d $EXTIP -p tcp --dport 80 -j DNAT --to-destination $WEB # $IPT -t nat -A PREROUTING -d $EXTIP -p udp --dport 53 -j DNAT --to-destination $DNS ### # now for snat: $IPT -t nat -A POSTROUTING -o $IEXT -s $INTNET -j SNAT --to-source $EXTIP # a few mangle rules you might or might not want to try out # note that ssh sets its own TOS value, so is not required below $IPT -t mangle -A PREROUTING -m multiport -p tcp --dport 80,21 -j TOS --set-tos 16 $IPT -t mangle -A PREROUTING -m multiport -p tcp --sport 80,21 -j TOS --set-tos 16 $IPT -t mangle -A PREROUTING -p tcp --dport ftp-data -j TOS --set-tos 8 $IPT -t mangle -A PREROUTING -p tcp --sport ftp-data -j TOS --set-tos 8 $IPT -t mangle -A PREROUTING -p tcp --dport 25 -j TOS --set-tos 4 $IPT -t mangle -A PREROUTING -p tcp --dport 110 -j TOS --set-tos 2 # if you have a line in your /etc/sysctl.conf like this: # net.ipv4.ip_forward = 1 # uncomment the following and comment out the echo line below it #/sbin/sysctl -p > /dev/null echo 1 > /proc/sys/net/ipv4/ip_forward 4815l4.txt100664 2046 330 1211 7323341351 11136 0ustar jillljedit4815l4 Listing 4. DNS Entry for Mail Server $IPT -t filter -N tcprules $IPT -A tcprules -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A tcprules -i ! eth1 -m state --state NEW -j ACCEPT $IPT -A tcprules -i eth1 -p tcp --dport 25 -m state --state NEW -j ACCEPT $IPT -A tcprules -i eth1 -m state --state NEW,INVALID -j DROP $IPT -t nat -A PREROUTING -d 209.127.112.17 -p tcp --dport 25 -j DNAT --to-desti nation 192.168.0.2:25 $IPT -t nat -A POSTROUTING -o eth1 -s 192.168.0.0/24 -j SNAT --to-source 209.127 .112.17 $IPT -A INPUT -j tcprules $IPT -A FORWARD -j tcprules echo 1 > /proc/sys/net/ipv4/ip_forward