linux代理防火墙脚本[转载]
来源:互联网 发布:java 网盘系统源码 编辑:程序博客网 时间:2024/03/28 17:40
#!/bin/bash
/sbin/modprobe ip_tables
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_conntrack_ftp
/sbin/iptables -F
/sbin/iptables -F -t nat
/sbin/iptables -X
/sbin/iptables -Z
IP="61.150.0.1"
UPLINK="eth0"
ROUTER="yes"
NAT="61.150.0.1"
INTERFACES="lo eth0 eth1"
SERVICES="ssh rsync"
iptables -P INPUT DROP
iptables -A INPUT -i ! ${UPLINK} -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
for x in ${SERVICES}
do
iptables -A INPUT -p tcp --dport ${x} -m state --state NEW -j ACCEPT
done
iptables -A INPUT -p tcp -i ${UPLINK} -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp -i ${UPLINK} -j REJECT --reject-with icmp-port-unreachable
if [ -e /proc/sys/net/ipv4/tcp_ecn ]
then
echo 0 > /proc/sys/net/ipv4/tcp_ecn
fi
for x in ${INTERFACES}
do
echo 1 > /proc/sys/net/ipv4/conf/${x}/rp_filter
done
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 5899 -j DNAT --to 192.168.0.254:4899
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 9999 -j DNAT --to 192.168.0.233:9999
################## M U #########################
iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 44405 -j DNAT --to-destination 192.168.0.233:44405
iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 44405 -j SNAT --to-source 192.168.0.1
iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 55901 -j DNAT --to-destination 192.168.0.233:55901
iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 55901 -j SNAT --to-source 192.168.0.1
#iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 55902 -j DNAT --to-destination 192.168.0.233:55902
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 55902 -j SNAT --to-source 192.168.0.1
iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.233:80
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 80 -j SNAT --to-source 192.168.0.1
iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 81 -j DNAT --to-destination 192.168.0.233:81
iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 81 -j SNAT --to-source 192.168.0.1
#iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 82 -j DNAT --to-destination 192.168.0.233:82
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 82 -j SNAT --to-source 192.168.0.1
################## MU END #########################
################## CS SERVER Start ################
iptables -t nat -A PREROUTING -p udp -d ${IP} --dport 27015 -j DNAT --to 192.168.0.233:27015
#iptables -t nat -A POSTROUTING -p udp -d 192.168.0.233 --dport 27015 -j SNAT --to 192.168.0.1
iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 27015 -j DNAT --to-destination 192.168.0.233:27015
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 27015 -j SNAT --to-source 192.168.0.1
################## CS SERVER End #################
################## D2 SERVER Start ################
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 23 -j DNAT --to 192.168.0.233:23
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 23 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 4000 -j DNAT --to 192.168.0.233:4000
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 4000 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 6112 -j DNAT --to 192.168.0.233:6112
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 6112 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p udp -d ${IP} --dport 6112 -j DNAT --to 192.168.0.233:6112
#iptables -t nat -A POSTROUTING -p udp -d 192.168.0.233 --dport 6112 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 6113 -j DNAT --to 192.168.0.233:6113
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 6113 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 6114 -j DNAT --to 192.168.0.233:6114
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 6114 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p udp -d ${IP} --dport 6114 -j DNAT --to 192.168.0.233:6114
#iptables -t nat -A POSTROUTING -p udp -d 192.168.0.233 --dport 6114 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 6200 -j DNAT --to 192.168.0.233:6200
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 6200 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 6667 -j DNAT --to 192.168.0.233:6667
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 6667 -j SNAT --to 192.168.0.1
################## D2 SERVER END #################
################## Mir Server Start ###############
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 7000 -j DNAT --to 192.168.0.233:7000
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 7000 -j SNAT --to 192.168.0.1
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 7100 -j DNAT --to 192.168.0.233:7100
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 7100 -j SNAT --to 192.168.0.1
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 5999 -j DNAT --to 192.168.0.233:4899
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 7200 -j DNAT --to 192.168.0.233:7200
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 7200 -j SNAT --to 192.168.0.1
##################### Mir3 Server ############
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 5600 -j DNAT --to 192.168.0.233:5600
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 5600 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 6000 -j DNAT --to 192.168.0.233:6000
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 6000 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 5100 -j DNAT --to 192.168.0.233:5100
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 5100 -j SNAT --to 192.168.0.1
#################### Mir3 End ##################
#################### Ftp Server ################
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 21 -j DNAT --to 192.168.0.233:21
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 2100 -j DNAT --to 192.168.0.254:21
################### Ftp Server End ##############
################### MoHuan #####################
#iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 4000 -j DNAT --to-destination 192.168.0.233:4000
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 4000 -j SNAT --to-source 192.168.0.1
#iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 4001 -j DNAT --to-destination 192.168.0.233:4001
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 4001 -j SNAT --to-source 192.168.0.1
#iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 4100 -j DNAT --to-destination 192.168.0.233:4100
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 4100 -j SNAT --to-source 192.168.0.1
#iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 4101 -j DNAT --to-destination 192.168.0.233:4101
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 4101 -j SNAT --to-source 192.168.0.1
#iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 4010 -j DNAT --to-destination 192.168.0.233:4010
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 4010 -j SNAT --to-source 192.168.0.1
################### MoHuan End ###############
/sbin/modprobe ip_tables
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_conntrack_ftp
/sbin/iptables -F
/sbin/iptables -F -t nat
/sbin/iptables -X
/sbin/iptables -Z
IP="61.150.0.1"
UPLINK="eth0"
ROUTER="yes"
NAT="61.150.0.1"
INTERFACES="lo eth0 eth1"
SERVICES="ssh rsync"
iptables -P INPUT DROP
iptables -A INPUT -i ! ${UPLINK} -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
for x in ${SERVICES}
do
iptables -A INPUT -p tcp --dport ${x} -m state --state NEW -j ACCEPT
done
iptables -A INPUT -p tcp -i ${UPLINK} -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp -i ${UPLINK} -j REJECT --reject-with icmp-port-unreachable
if [ -e /proc/sys/net/ipv4/tcp_ecn ]
then
echo 0 > /proc/sys/net/ipv4/tcp_ecn
fi
for x in ${INTERFACES}
do
echo 1 > /proc/sys/net/ipv4/conf/${x}/rp_filter
done
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 5899 -j DNAT --to 192.168.0.254:4899
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 9999 -j DNAT --to 192.168.0.233:9999
################## M U #########################
iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 44405 -j DNAT --to-destination 192.168.0.233:44405
iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 44405 -j SNAT --to-source 192.168.0.1
iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 55901 -j DNAT --to-destination 192.168.0.233:55901
iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 55901 -j SNAT --to-source 192.168.0.1
#iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 55902 -j DNAT --to-destination 192.168.0.233:55902
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 55902 -j SNAT --to-source 192.168.0.1
iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.233:80
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 80 -j SNAT --to-source 192.168.0.1
iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 81 -j DNAT --to-destination 192.168.0.233:81
iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 81 -j SNAT --to-source 192.168.0.1
#iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 82 -j DNAT --to-destination 192.168.0.233:82
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 82 -j SNAT --to-source 192.168.0.1
################## MU END #########################
################## CS SERVER Start ################
iptables -t nat -A PREROUTING -p udp -d ${IP} --dport 27015 -j DNAT --to 192.168.0.233:27015
#iptables -t nat -A POSTROUTING -p udp -d 192.168.0.233 --dport 27015 -j SNAT --to 192.168.0.1
iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 27015 -j DNAT --to-destination 192.168.0.233:27015
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 27015 -j SNAT --to-source 192.168.0.1
################## CS SERVER End #################
################## D2 SERVER Start ################
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 23 -j DNAT --to 192.168.0.233:23
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 23 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 4000 -j DNAT --to 192.168.0.233:4000
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 4000 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 6112 -j DNAT --to 192.168.0.233:6112
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 6112 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p udp -d ${IP} --dport 6112 -j DNAT --to 192.168.0.233:6112
#iptables -t nat -A POSTROUTING -p udp -d 192.168.0.233 --dport 6112 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 6113 -j DNAT --to 192.168.0.233:6113
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 6113 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 6114 -j DNAT --to 192.168.0.233:6114
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 6114 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p udp -d ${IP} --dport 6114 -j DNAT --to 192.168.0.233:6114
#iptables -t nat -A POSTROUTING -p udp -d 192.168.0.233 --dport 6114 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 6200 -j DNAT --to 192.168.0.233:6200
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 6200 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 6667 -j DNAT --to 192.168.0.233:6667
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 6667 -j SNAT --to 192.168.0.1
################## D2 SERVER END #################
################## Mir Server Start ###############
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 7000 -j DNAT --to 192.168.0.233:7000
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 7000 -j SNAT --to 192.168.0.1
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 7100 -j DNAT --to 192.168.0.233:7100
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 7100 -j SNAT --to 192.168.0.1
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 5999 -j DNAT --to 192.168.0.233:4899
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 7200 -j DNAT --to 192.168.0.233:7200
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 7200 -j SNAT --to 192.168.0.1
##################### Mir3 Server ############
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 5600 -j DNAT --to 192.168.0.233:5600
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 5600 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 6000 -j DNAT --to 192.168.0.233:6000
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 6000 -j SNAT --to 192.168.0.1
#iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 5100 -j DNAT --to 192.168.0.233:5100
#iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.233 --dport 5100 -j SNAT --to 192.168.0.1
#################### Mir3 End ##################
#################### Ftp Server ################
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 21 -j DNAT --to 192.168.0.233:21
iptables -t nat -A PREROUTING -p tcp -d ${IP} --dport 2100 -j DNAT --to 192.168.0.254:21
################### Ftp Server End ##############
################### MoHuan #####################
#iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 4000 -j DNAT --to-destination 192.168.0.233:4000
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 4000 -j SNAT --to-source 192.168.0.1
#iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 4001 -j DNAT --to-destination 192.168.0.233:4001
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 4001 -j SNAT --to-source 192.168.0.1
#iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 4100 -j DNAT --to-destination 192.168.0.233:4100
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 4100 -j SNAT --to-source 192.168.0.1
#iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 4101 -j DNAT --to-destination 192.168.0.233:4101
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 4101 -j SNAT --to-source 192.168.0.1
#iptables -t nat -A PREROUTING -d ${IP} -p tcp -m tcp --dport 4010 -j DNAT --to-destination 192.168.0.233:4010
#iptables -t nat -A POSTROUTING -d 192.168.0.233 -p tcp -m tcp --dport 4010 -j SNAT --to-source 192.168.0.1
################### MoHuan End ###############
- linux代理防火墙脚本[转载]
- 网吧linux代理防火墙脚本
- Linux 防火墙-代理 HOWTO
- linux防火墙脚本
- linux防火墙配置shell脚本
- 教你将Linux配置为代理防火墙
- 如何将Linux配置成为代理防火墙
- 防火墙代理
- linux+shell+脚本+过滤NetScreen防火墙日志
- 简单的Linux防火墙配置脚本例子
- Linux之防火墙的两个脚本文件
- 防火墙脚本
- Linux非法ip通过脚本执行定时任务加入防火墙
- Linux下开启/关闭防火墙命令(转载)
- linux防火墙脚本,一键解决防火墙规则带来的痛苦。
- HTTP代理与防火墙
- Linux防火墙-单机防火墙
- Linux查看网络流量的脚本(转载)
- TCP/IP和Internet Windows 2000注册表[转载]
- 想不到的隐患
- 算法学习[转载]
- 网络基本命令[转载]
- 代理服务器的源程序[转载]
- linux代理防火墙脚本[转载]
- 嗅探的基本原理[转载]
- 一些术语[转载]
- Microsoft .NET Remoting:技术概述
- Beej网络socket编程指南[转载]
- 利用操作系统提供的API编写防火墙[转载]
- 简单批处理简介[转载]
- IP欺骗技术介绍[转载]
- 在TCP三次握手后插入伪造的TCP包[转载]