Forum Debian Users Gang

iptables -t nat -A PREROUTING -i eth0 -p TCP -d xxx.xx.xxx.xxx --dport 81 -j DNAT --to 192.168.21.1:80

bin# ./firewall restart
./firewall: -t: command not found

#!/bin/sh
EXTIF="eth1"
EXTIP="xx.xx.xx.xxx"
INTIF="eth0"
INTIP="192.168.1.1"
INTNET="192.168.1.0/24"

UNIVERSE="0.0.0.0/0"
IPTABLES="/sbin/iptables"

case "$1" in
start)
if test -z "$(lsmod|grep ip_tables|awk '{print $1}')"; then
insmod ip_tables
fi
if test -z "$(lsmod|grep ip_conntrack|awk '{print $1}')"; then
insmod ip_conntrack
fi
if test -z "$(lsmod|grep ip_conntrack_ftp|awk '{print $1}')"; then
insmod ip_conntrack_ftp
fi
if test -z "$(lsmod|grep iptable_nat|awk '{print $1}')"; then
insmod iptable_nat
fi
if test -z "$(lsmod|grep ip_nat_ftp|awk '{print $1}')"; then
insmod ip_nat_ftp
fi

echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
#echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABLES -t nat -F
$IPTABLES -t mangle -F

$IPTABLES -X
$IPTABLES -Z

$IPTABLES -N test1 
$IPTABLES -F test1
 


##--------------------------------------------INPUT----------------------------------------##

$IPTABLES -A INPUT -j test1

#$IPTABLES -A INPUT -i $INTIF -j REJECT --reject-with icmp-net-prohibited
 



##-------------------------------------------FORWARD--------------------------------------##

$IPTABLES -A FORWARD -i $EXTIF -o $INTIF  -m state --state ESTABLISHED,RELATED -j ACCEPT

#$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
# lub filtr po MAC

$IPTABLES -A FORWARD -o $EXTIF -j test1

#$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j REJECT --reject-with icmp-net-prohibited


#-----translacja adresow------

# serwer proxy
$IPTABLES -t nat -A PREROUTING -i $INTIF -p tcp -d ! xx.xx.xxx.xxx --dport 80 -j REDIRECT --to-port 3128

# NAT        
#$IPTABLES -t nat -A POSTROUTING -o $EXTIF -s $INTNET -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -s $INTNET -j SNAT --to-source xx.xx.xxx.xxx 


#mapowanie portów  >>>>>>>>>>>>NIE DZIAŁA<<<<<<<<<<<<<<<<<
$iptables -t nat -A PREROUTING -i eth1 -p TCP -d xx.xx.xxx.xxx --dport 501 -j DNAT --to 192.168.1.200:501

##---------------------------------markowanie pakietow - statystyki------------------------##

#--------upload----------
$IPTABLES -t mangle -A PREROUTING -s 192.168.1.10 -j MARK --set-mark 810

;;

stop)
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABLES -t nat -F
$IPTABLES -t mangle -F

$IPTABLES -F test1 

$IPTABLES -X
$IPTABLES -Z

#rmmod iptable_nat
#rmmod ip_conntrack
#rmmod ip_table
echo "0" > /proc/sys/net/ipv4/ip_forward
;;

restart)
$0 stop
$0 start
;;

*)
echo "Uzycie: firewall {start|stop|restart}"
exit 1
;;
esac

exit 0