linux防火墙应用网关,Linux网关防火墙简单版本

#!bin/sh

IFCONFIG=/sbin/ifconfig

IP=/sbin/ip

IPTABLES=/sbin/iptables

if [ ! -x $IFCONFIG ]; then

echo "$IFCONFIG does not exist."

exit 1

fi

if [ ! -x $IP ]; then

echo "$IP does not exist."

exit 1

fi

if [ ! -x $IPTABLES ]; then

echo "$IPTABLES does not exist."

exit 1

fi

# BASE is the lowest IP address your server is allowed

# to hand out.

LOCT=`ifconfig eth0|grep 'inet addr:'|awk -F: '{print $2}'|awk '{print $1}'`

# NAT is the set of addresses which your server will

# NAT behind it. Other addresses behind your server

# WILL NOT be NATed.

NAT=`ip route list|grep 'dev eth0'|awk '{print $1}'`

# MYIP is the public IP address of this server.

MYIP=`ifconfig eth1|grep 'inet addr:'|awk -F: '{print $2}'|awk '{print $1}'`

#clear firewall rule

$IPTABLES -t filter -F

$IPTABLES -t mangle -F

$IPTABLES -t nat -F

$IPTABLES -t raw -F

#mangle PREROUTING

$IPTABLES -t mangle -P PREROUTING ACCEPT

#nat PREROUTING

$IPTABLES -t nat -P PREROUTING ACCEPT

$IPTABLES -t nat -A PREROUTING -p tcp --dport 80 -m mark ! --mark 0x8 -j DNAT --to-destination $LOCT:80

#filter FORWARD

$IPTABLES -P FORWARD DROP

$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -p icmp -j ACCEPT

$IPTABLES -A FORWARD -p tcp --dport 22 -j ACCEPT

$IPTABLES -A FORWARD -p tcp --sport 22 -j ACCEPT

$IPTABLES -A FORWARD -p udp --dport 53 -j ACCEPT

$IPTABLES -A FORWARD -p udp --sport 53 -j ACCEPT

$IPTABLES -A FORWARD -p udp --dport 68 -j ACCEPT

$IPTABLES -A FORWARD -p udp --sport 68 -j ACCEPT

$IPTABLES -A FORWARD -p udp --dport 1812 -j ACCEPT

$IPTABLES -A FORWARD -p udp --sport 1812 -j ACCEPT

$IPTABLES -A FORWARD -p udp --dport 1813 -j ACCEPT

$IPTABLES -A FORWARD -p udp --sport 1813 -j ACCEPT

$IPTABLES -A FORWARD -s $LOCT -j ACCEPT

$IPTABLES -A FORWARD -d $LOCT -j ACCEPT

#nat POSTROUTING

$IPTABLES -t nat -P POSTROUTING ACCEPT

$IPTABLES -t nat -A POSTROUTING -s $NAT -j SNAT --to-source $MYIP