firewall - povoleni https

[Jiri Drasnar]

PRAVIDLA:

Skript vypada takhle:

****************

# odstraneni modulu

rmmod iptable_filter
rmmod ip_conntrack
rmmod ip_conntrack_ftp
rmmod ip_nat_ftp

# natazeni potrebnych modulu

cd /lib/modules/2.4.7-10/kernel/net/ipv4/netfilter/
modprobe iptable_filter
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp

# vycisteni pravidel filtrovani

iptables -F
iptables -t nat -F


# imlicitni odmitnuti paketu

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP


#
echo "1" > /proc/sys/net/ipv4/ip_forward

# povoleni ip forwardingu a prekladu sitovych adres
# by drlik na asd-software.cz

iptables -t nat -A POSTROUTING -o eth0 -s 192.168.0.1/24 -j SNAT --to 194.213.252.155


# povoleni veskere lokalni komunikace

iptables -I INPUT -i lo -j ACCEPT
iptables -I OUTPUT -o lo -j ACCEPT

# povoleni veskere komunikace na eth1 - lokalni LAN

iptables -I INPUT -i eth1 -j ACCEPT
iptables -I OUTPUT -o eth1 -j ACCEPT

# povoleni odchozich paketu bez omezeni

iptables -A OUTPUT -o eth0 -p tcp -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp -j ACCEPT
iptables -A OUTPUT -o eth0 -p icmp -j ACCEPT

# povoleni paketu vsech tcp navazanych spojeni

iptables -m state -A INPUT -i eth0 --state ESTABLISHED -j ACCEPT

# povoleni DNS

iptables -A INPUT -i eth0 -p udp --sport 53 -j ACCEPT
iptables -A FORWARD -i eth0 -p udp --sport 53 -j ACCEPT
iptables -A FORWARD -i eth1 -p udp --dport 53 -j ACCEPT

 *** ***
Potom jsou definovana pravidla pro jednotlive porty.