Forum Debian Users Gang

iptables -m time --help

  
iptables -t nat -A PREROUTING -p tcp --dport 80 -m set --match-set zablokowani src -m hashlimit  --hashlimit 1  --limit-burst 1 -j DNAT --to-destination 125.1.1.1:100
iptables -t nat -A PREROUTING -i eth0   -m set --match-set pacjenci src -j ACCEPT

#!/bin/bash
cd /var/hasiok
wget -N http://www.spamhaus.org/drop/drop.lasso
if [ -n "$1" ]; then
    DropList="$1"
else
    DropList="/var/hasiok/drop.lasso"
fi
if [ ! -x /usr/sbin/ipset ]; then
    echo "Missing ipset command line tool, exiting." >&2
    exit 1
fi
if [ -s "$DropList" ]; then
    /usr/sbin/ipset create spamhaus hash:net  2>/dev/null
    /usr/sbin/ipset flush spamhaus   2>/dev/null
else     
    echo "Unable to find drop list file $DropList .  Perhaps do:" >&2
    echo "wget http://www.spamhaus.org/drop/drop.lasso -O $DropList"
    echo "exiting." >&2
    exit 1
fi;
cat "$DropList" \
 | sed -e 's/;.*//' \
 | grep -v '^ *$' \
 | while read OneNetBlock ; do
sleep 0.01;    /usr/sbin/ipset add spamhaus "$OneNetBlock";
done;
exit 0;

hashlimit match options:
  --hashlimit-upto <avg>           max average match rate
                                   [Packets per second unless followed by
                                   /sec /minute /hour /day postfixes]
  --hashlimit-above <avg>          min average match rate
  --hashlimit-mode <mode>          mode is a comma-separated list of
                                   dstip,srcip,dstport,srcport (or none)
  --hashlimit-srcmask <length>     source address grouping prefix length
  --hashlimit-dstmask <length>     destination address grouping prefix length
  --hashlimit-name <name>          name for /proc/net/ipt_hashlimit
  --hashlimit-burst <num>           number to match in a burst, default 5
  --hashlimit-htable-size <num>    number of hashtable buckets
  --hashlimit-htable-max <num>     number of hashtable entries
  --hashlimit-htable-gcinterval    interval between garbage collection runs
  --hashlimit-htable-expire        after which time are idle entries expired?

#! /bin/sh

### BEGIN INIT INFO
# Provides:          firewall
# Required-Start:    $syslog $network
# Required-Stop:     $syslog $network
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: firewall
# Description:       firewall
### END INIT INFO

start_f(){
echo "Uruchomienie firewall..."

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -F
iptables -X
iptables -t nat -X
iptables -t nat -F
iptables -t mangle -F
iptables -t mangle -X

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A OUTPUT -j ACCEPT -m state --state ESTABLISHED,RELATED

iptables -t nat -A POSTROUTING -s 100.1.1.0/24 -j MASQUERADE
iptables -A FORWARD -s 100.1.1.0/24 -j ACCEPT

iptables -t nat -A POSTROUTING -s 125.1.1.0/24 -j MASQUERADE
iptables -A FORWARD -s 125.1.1.0/24 -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 8525 -j ACCEPT

iptables -t nat -A PREROUTING -i wlan0 -p tcp -s 125.1.1.100 --dport 80 -m hashlimit --hashlimit-upto 5/sec  --hashlimit-burst 10 --hashlimit-name block --hashlimit-mode srcip   -j DNAT --to-destination 125.1.1.1:100





}

stop_f() {
echo "Zatrzymywanie firewall..."

iptables -F
iptables -F -t nat
iptables -X -t nat
iptables -F -t filter
iptables -X -t filter
iptables -Z

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

}

case "$1" in

start)
start_f
;;

stop)
stop_f
;;

restart)
stop_f
start_f
;;

*)
echo "Użycie firewalla: etc/init.d/firewall start|stop|restart"
;;

esac

exit 0

root@debian:~# /etc/init.d/firewall restart
Zatrzymywanie firewall...
Uruchomienie firewall...
iptables v1.4.8: option `limit' requires an argument
Try `iptables -h' or 'iptables --help' for more information.

iptables -t nat -A PREROUTING -i wlan0 -p tcp -s 125.1.1.100 --dport 80 -m limit --limit 30/sec --limit-burst 3 -j DNAT --to-destination 125.1.1.1:100