Ok, im resetting up my home network, and hence the
reason for this letter :)
I have 2 linux boxes, and 2 windows boxes. One linux
box will be the firewall/gateway, internet on eth0 and
internal lan on eth1. What im looking for is basic
suggestions on my script, and also needing to know how
i can lets say have all external connections that try
to connect to me on port 10022 be forwarded to
192.168.1.8:22, so that i can be able to ssh into both
of my linux boxes, the firewall one, and an internal
one. Im pretty sure i have to either allow port 10022
on the INPUT, or allow port 22 on the FORWARD, then
also set up a PREROUTING, though each example ive
tried ive had no success with.
I have included my script below.
#!/bin/sh
#
#
# Todo: Setup loggin, allow access to ssh/smtp/web to
internal box
# test to make sure instant messengers can
send/receive files
# test to make sure irc dcc chats/sends work
# block certain ads from displaying
#
#
IPTABLES="/sbin/iptables" ## location to iptables
binary file
EXTDEV="eth0" ## external device that
connects to modem
INTDEV="eth1" ## internal device that
connects to lan
EXTIP=`ifconfig $EXTDEV | grep inet | cut -f2 -d: |
cut -f1 -d" "` ## external ip address
INTIP=`ifconfig $INTDEV | grep inet | cut -f2 -d: |
cut -f1 -d" "` ## internal ip address
case "$1" in
start)
#
## First we want to enable ip forwarding
#
echo -n "Enabling IP Forwarding ... "
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "done."
#
## Secondly we want to enable dynamic ips
#
echo -n "Enabling Dynamic Ips ... "
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "done."
#
## Now lets clear all the tables incase they were
improperly shutdown
#
echo -n "Flushing tables, Setting default policies to
DROP ... "
$IPTABLES -P INPUT DROP
$IPTABLES -F INPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABLES -P OUTPUT DROP
$IPTABLES -F OUTPUT
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
echo "done."
#
## Its time to start setting up our rules and policies
#
echo -n "Setting up the firewall now ... "
## First we want to allow only incoming connections
that we establish first
$IPTABLES -A INPUT -m state --state
ESTABLISHED,RELATED -j ACCEPT
## Next we want to allow ssh incoming connections as
well
$IPTABLES -A INPUT -p tcp --dport ssh -j ACCEPT
#
## Now we are going to allow our lan with access to
the external network
#
## First we allow all established connections to be
forwarded internally
$IPTABLES -A FORWARD -i $EXTDEV -m state --state
RELATED,ESTABLISHED -j ACCEPT
## Second we allow all connections from the lan to the
external network
$IPTABLES -A FORWARD -i $INTDEV -o $EXTDEV -j ACCEPT
## Masquerade from Internal Net to External Net
$IPTABLES -A POSTROUTING -t nat -o $EXTDEV -j
MASQUERADE
#
## And last thing we need to worry about is what the
internal network has access to do externally
#
$IPTABLES -P OUTPUT ACCEPT
echo "Firewall has been fully installed"
;;
stop)
echo -n "Flushin all rules ... "
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -F FORWARD
$IPTABLES -F OUTPUT
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
$IPTABLES -t nat -F PREROUTING
$IPTABLES -t nat -F POSTROUTING
$IPTABLES -t nat -F OUTPUT
echo "done."
;;
restart)
$0 stop
$0 start
;;
status)
$IPTABLES -L
;;
*)
echo "usage: $0 {start|stop|restart|status}"
exit 1
esac
exit 0
## EOF ##
-thanks-
__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com
