Filtrovani paketu

[Petr Šobáň]

Dne pá 21. únor 2003 16:30 jste napsal(a):

Když už jsme u těch firewalů mužete nekdo skontrolovat ten můj ?

#!/bin/sh

echo "0" > /proc/sys/net/ipv4/ip_forward

MOJE_IP=192.168.3.67
DNS_SERVER=192.168.1.254

# Firevall
/sbin/iptables -X
/sbin/iptables -F INPUT
/sbin/iptables -F OUTPUT
/sbin/iptables -F FORWARD
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP

/sbin/iptables -A INPUT -i eth0 -d 127.0.0.1/255.0.0.0 -j LOG --log-level 6
/sbin/iptables -A INPUT -i eth0 -d 127.0.0.1/255.0.0.0 -j REJECT

# local
/sbin/iptables -A OUTPUT -o lo -j ACCEPT
/sbin/iptables -A INPUT -i lo -j ACCEPT

# to co jsme navázali my
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -s $MOJE_IP -j ACCEPT

/sbin/iptables -A OUTPUT -p icmp -j ACCEPT
#/sbin/iptables -A INPUT -p icmp -j ACCEPT
#/sbin/iptables -A FORWARD -p icmp -j ACCEPT

# max5 pingu za s
/sbin/iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s 
--limit-burst 5 -j ACCEPT

/sbin/iptables -A INPUT -p ICMP -i eth0 --icmp-type 0 -j ACCEPT
/sbin/iptables -A INPUT -p ICMP -i eth0 --icmp-type 3 -j ACCEPT
/sbin/iptables -A INPUT -p ICMP -i eth0 --icmp-type 8 -j ACCEPT
/sbin/iptables -A INPUT -p ICMP -i eth0 --icmp-type 11 -j ACCEPT

# DNS
/sbin/iptables -A INPUT -p udp -s $DNS_SERVER --sport 53 -j ACCEPT

# WWW
/sbin/iptables -A INPUT -p tcp -s 0/0 --sport 80 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -d 0/0 --dport 80 -j ACCEPT

# odmitne port 113 auth
/sbin/iptables -A INPUT -i eth0 -p TCP --dport 113 -j REJECT

# LOGUJ OSTATNI
/sbin/iptables -A OUTPUT -j LOG --log-level 6
/sbin/iptables -A INPUT -j LOG --log-level 6
/sbin/iptables -A FORWARD -j LOG --log-level 6



-- 

/----------------------------------------\
|            Petr Šobáň                  |
|            Olomouc                     |
|----------------------------------------|
|    e-mail soban na centrum.cz             |
|    jabber soban na jabber.cz              |
|    ICQ    179223500                    |
\----------------------------------------/