Dan Egli wrote: > > 1) Block all ports EXCEPT: > FTP, SSH, TELNET (yes there is a reason for telnet!), SMTP, DNS, NNTP, NTP, > ROUTED (520), PRINTER (515), POP3, IMAP, HTTP, HTTPS, and ports 4000 & 5000 > (special programs run on those ports and they need to be open). You do realize that many of these protocols are very insecure, and should not be opend to the public. Also do you really want to allow everyone (on the intra- and inter-net ) to use your printers? > > 2) Forward Inbound traffic from port 5000 to IP 192.168.0.5. Should be a > Transparent NAT (If I hit 192.168.0.1 port 5000, then the firewall forwards > it to 192.168.0.5 5000, and any packets sent from 192.168.0.5:5000 [which > would only be in reply to an inbound packet] should appear as coming from > 192.168.0.1:5000). Here's a basic setup of the machine so you have that to > go on: This is impossible. A machine with IP 192.168.0.6 cannot be redirected to 192.168.0.5 through 192.168.0.1. But in the example below, all connections to 64.122.31.38:5000 (through eth1) will be redirected to 192.168.0.5. > > EXTERNAL IP: 64.122.31.38 on eth1 > internal IP: 192.168.0.1 on eth0 > > 3) Perform basic IP Masquerading for unlisted machines on the 192.168.0.x > net. So if a machine addressed as 192.168.0.26 requests www.yahoo.com, it > goes in from eth0, then goes out eth1 as from eth1's address, and the return > comes in eth1 and goes back out eth0 to the correct machine. > > 4) Log any blocked traffic in the syslog. > > Your help is greatly appreciated! > Here is your rules. I have not tested them, so minor changes may be nessesary. -------------------------------- # Set default policies. iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -P FORWARD DROP # Flush all tables. iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -t NAT -F PREROUTING iptables -t NAT -F POSTROUTING iptables -t NAT -F OUTPUT iptables -A INPUT -p tcp -m multiport --dports \ SMTP,DNS,NNTP,NTP,ROUTED,520,PRINTER,POP3,IMAP,HTTP,\ HTTPS,4000,5000 -j ACCEPT iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -j LOG iptables -A FORWARD -i eth0 -j ACCEPT iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -j LOG iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 5000 \ -j DNAT --to-destination 192.168.0.5:5000 iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 64.122.31.38 echo 1 > /proc/sys/net/ipv4/ip_forward ------------------------- Regards Anders Fugmann
