BlogもどきのWeblog

iptablesのシェルスクリプトのメモ。

#!/bin/sh

any='0.0.0.0/0'

iptables -F
iptables -X
iptables -Z

#Policy setting
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

#Loopback Accept
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

#Local Area Network
iptables -A INPUT -i ! ppp0 -s $any -j ACCEPT
iptables -A INPUT -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT

#FTP
iptables -A INPUT -i ppp0 -s $any -p tcp --dport 20 -j ACCEPT
iptables -A INPUT -i ppp0 -s $any -p tcp --dport 21 -j ACCEPT

#SSH
iptables -A INPUT -i ppp0 -s $any -p tcp --dport 22 -j ACCEPT

#DNS
iptables -A INPUT -i ppp0 -s $any -p udp --dport 53 -j ACCEPT
iptables -A INPUT -i ppp0 -s $any -p udp --sport 53 -j ACCEPT

#HTTP,HTTPS
iptables -A INPUT -i ppp0 -s $any -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i ppp0 -s $any -p tcp --dport 443 -j ACCEPT

#NTP
iptables -A INPUT -i ppp0 -p udp -s $any --dport 123 -j ACCEPT
iptables -A INPUT -i ppp0 -p udp --sport 123 -m state --state ESTABLISHED,RELATED -j ACCEP
T

#TOMCAT
iptables -A INPUT -i ppp0 -s $any -p tcp --dport 8080 -j ACCEPT

#ICMP
iptables -A INPUT -i ppp0 -s $any -p icmp -j ACCEPT

#IPMASQUERADE
iptables -A FORWARD -o ppp0 -s 192.168.1.0/24 -j ACCEPT
iptables -A FORWARD -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -F
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

#何かの穴開け
iptables -A PREROUTING -t nat -p tcp --dport xxxxx -j DNAT --to 192.168.1.yyy:xxxxx
iptables -A FORWARD -o eth1 -s $any -p tcp -d 192.168.1.yyy --dport xxxxx -j ACCEPT

echo 1 > /proc/sys/net/ipv4/ip_forward

参考文献
俺でも解るIPTABLES
iptables を使った IP Masquerade の設定例
Ubuntu/iptables(firewall)