forum.lissyara.su

Код: Выделить всё

man pkg_add

Код: Выделить всё

#!/bin/sh                       
#iptables rules                 

#path to iptables file
iptables="/usr/sbin/iptables"
#path to modeprobe
modprobe="/sbin/modprobe"
#external interface    
ext_if="eth1"       
#internal interface      
int_if="eth0"       
#external ip    
ext_ip="писать внешний ip"         
#our local network
int_net="192.168.0.0/24"
#our internal ip     
int_ip="192.168.0.98"        

#load necessary modules
$modprobe iptable_nat  
$modprobe nf_conntrack 
$modprobe nf_conntrack_ftp

#delete all rules in all chains
$iptables -F                   

#delete all chains except defaults
$iptables -X                      

#allow connection to host in our network
$iptables -t nat -A PREROUTING -p tcp -m tcp -d $ext_ip --dport 3389 -j DNAT --to-destination $int_ip:3389
$iptables -t nat -A PREROUTING -p tcp -m tcp -d $ext_ip --dport 80 -j DNAT --to-destination $int_ip:80    
$iptables -t nat -A PREROUTING -p tcp -m tcp -d $ext_ip --dport 8080 -j DNAT --to-destination $int_ip:8080

#default policy in chains
$iptables -P INPUT DROP  
$iptables -P FORWARD DROP
$iptables -P OUTPUT DROP 

# pass loopback traffic
$iptables -A INPUT -i lo -j ACCEPT

#allow ssh connection
$iptables -A INPUT -p tcp -m tcp -m state --state NEW --dport 22 -j ACCEPT

#allow local traffic
$iptables -A INPUT -i $int_if -p all -s $int_net -j ACCEPT

#allow new connection on local interface
$iptables -A INPUT -i $int_if -m state --state NEW -j ACCEPT

#allow established and related connection
$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#allow input rdp connection from our gate to any machine in local network 
$iptables -A INPUT -p tcp -m tcp -d $int_ip --dport 3389 -j ACCEPT
#allow input rdp connection from our gate to any machine in local network 
$iptables -A INPUT -p tcp -m tcp -d $int_ip --dport 80 -j ACCEPT
#allow input rdp connection from our gate to any machine in local network 
$iptables -A INPUT -p tcp -m tcp -d $int_ip --dport 8080 -j ACCEPT

#allow forward connection on local interface
$iptables -A FORWARD -i $int_if -m state --state NEW  -j ACCEPT
#allow forward established and related connection
$iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

$iptables -A FORWARD -p tcp -m tcp -d $int_ip --dport 3389 -j ACCEPT
$iptables -A FORWARD -p tcp -m tcp -s $int_ip --dport 3389 -j ACCEPT
#-------------------------------------------------------------------
$iptables -A FORWARD -p tcp -m tcp -d $int_ip --dport 80 -j ACCEPT
$iptables -A FORWARD -p tcp -m tcp -s $int_ip --dport 80 -j ACCEPT

$iptables -A FORWARD -p tcp -m tcp -d $int_ip --dport 8080 -j ACCEPT
$iptables -A FORWARD -p tcp -m tcp -s $int_ip --dport 8080 -j ACCEPT
#-------------------------------------------------------------------
$iptables -A FORWARD -p tcp -m tcp -s $int_ip -m state --state ESTABLISHED,RELATED -j ACCEPT

#allow output connection from our gate
$iptables -A OUTPUT -p tcp -m tcp -d $int_ip --dport 3389 -j ACCEPT
#allow output connection from our gate
$iptables -A OUTPUT -p tcp -m tcp -d $int_ip --dport 80 -j ACCEPT
#allow output connection from our gate
$iptables -A OUTPUT -p tcp -m tcp -d $int_ip --dport 8080 -j ACCEPT

#$iptables -t nat -A OUTPUT -p tcp -m tcp -d $ext_ip --dport 3389 -j DNAT --to-destination $int_ip

#allow output connection
$iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# allow connection from host in our network to inet on ports 3389,80,8080
$iptables -t nat -A POSTROUTING -p tcp -m tcp -d $int_ip --dport 3389 -j SNAT --to-source $ext_ip
$iptables -t nat -A POSTROUTING -p tcp -m tcp -d $int_ip --dport 80 -j SNAT --to-source $ext_ip
$iptables -t nat -A POSTROUTING -p tcp -m tcp -d $int_ip --dport 8080 -j SNAT --to-source $ext_ip

# allow connection from our network to inet
$iptables -t nat -A POSTROUTING -o $ext_if -j SNAT --to-source $ext_ip

Код: Выделить всё

[root@unit1 tftpboot]# ls -lahi /bin/ | grep sh
15975204 -rwxr-xr-x  1 root root 718K лЮИ 25  2008 bash
15975255 lrwxrwxrwx  1 root root    4 яЕМ 30 15:00 csh -> tcsh
15975199 -rwxr-xr-x  1 root root 980K лЮИ 24  2008 ksh
15975173 lrwxrwxrwx  1 root root    4 яЕМ 30 14:57 sh -> bash
15975182 -rwxr-xr-x  1 root root 338K лЮП 15  2007 tcsh
[root@unit1 tftpboot]#