Forum Debian Users Gang

#!/bin/sh

IPTABLES=/sbin/iptables

#dsl

EXT_IP=
EXT_INT=ppp0

#lan

LAN_IP=192.168.0.1
LAN_INT=eth0

#siec

SIEC_IP=192.168.0.0
SIEC_MASKA=255.255.255.0

#HOSTY KTORE DOSTANA NET
HOST1=192.168.0.1
HOST2=192.168.0.2

#PORTY
TCP_LAN=20,21,80,443,515
UDP_LAN=53,123,515
TCP_INET=20,21,80,443

#przekazywanie pakietow
echo "1" > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/conf/all/accept.redirects


#tablice

$IPTABLES -F -t nat
$IPTABLES -X -t nat
$IPTABLES -F -t filter
$IPTABLES -F -t filter

$IPTABLES -P INPUT DROP
$IPTABLES P FORWARD DROP
#$IPTABLES -P OUTPUT DROP
$IPTABLES -P OUTPUT ACCEPT

#Przepusc wszystko na loopbacku
$IPTABLES -A INPUT -i lo -j ACCEPT

#Przepusc pakiety wracajace
$IPTABLES A INPUT i $EXT_INT j ACCEPT m state state ESTABLISHED,RELATED
$IPTABLES A INPUT i $LAN_INT j ACCEPT m state state ESTABLISHED,RELATED

# Dopuszczone z Lanu
$IPTABLES -A -i $LAN_INT -p tcp -s $LAN_IP -j ACCEPT -m multiport 
--destination-port $TCP_LAN
$IPTABLES -A -i $LAN_INT -p udp -s $LAN_IP -j ACCEPT -m multiport 
--destination-port $UDP_LAN

#Dopuszczone z netu

$IPTABLES A INPUT i $EXT-INT p tcp d $INET_IP j ACCEPT -m multiport 
--destination-port $TCP_INET


$IPTABLES -t filter -P FORWARD DROP
$IPTABLES -t filter -A FORWARD -s $SIEC_IP/$SIEC_MASKA -d 0/0 -j ACCEPT
$IPTABLES -t filter -A FORWARD -s 0/0 -d $SIEC_IP/$SIEC_MASKA -j ACCEPT

#moduly ftp i irc
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack.ftp

# iptables -t filter -A FORWARD -s 192.168.1.0/24 -j ACCEPT
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT