urodliv
Gold Member | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
#!/bin/bash
EXT_IF="eth-ext"
INT_IF="eth-int"
EXT_IP="192.168.0.100"
DNS_SRV="192.168.0.1"
NTP_SRV="192.168.0.1"
OLIMP="192.168.0.253"
DEBIAN_SRV="195.178.192.118 193.233.9.194 \
130.89.149.225 195.20.242.89 212.211.132.32 212.211.132.250 \
86.59.118.153 128.31.0.51 130.89.149.227"
lsmod nf_conntrack_ftp
#Sbros vseh pravil
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -t nat -F
iptables -t mangle -F
#Politiki: ne razresheno - zaprescheno
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT DROP
#Dopuskaem dlia ustanovleniya soedinenia tolko paketi s prisnakom "NEW"
iptables -A INPUT -p TCP ! --syn -m state --state NEW -j DROP
#Set` terminalov
iptables -A INPUT -i $INT_IF -j ACCEPT
iptables -A OUTPUT -o $INT_IF -j ACCEPT
#Vnutrennie sviasi
iptables -A INPUT -i lo+ -j ACCEPT
iptables -A OUTPUT -o lo+ -j ACCEPT
#Testirovanie olimp_oks
iptables -A OUTPUT -p TCP -d $OLIMP --dport www \
-m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p TCP -s $OLIMP --sport www \
-m state --state ESTABLISHED -j ACCEPT
#Zapros DNS k provaideru
for dns in $DNS_SRV
do
iptables -A OUTPUT -p UDP -d $dns -s $EXT_IP --dport domain \
-m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p UDP -s $dns -d $EXT_IP --sport domain \
-m state --state ESTABLISHED -j ACCEPT
done
#zapros na obnovlenie vremeni
for ntp in $NTP_SRV
do
iptables -A OUTPUT -p UDP -d $ntp -s $EXT_IP --dport ntp \
-m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p UDP -s $ntp -d $EXT_IP --sport ntp \
-m state --state ESTABLISHED -j ACCEPT
done
#Zapret na ustanovlenie soedineniy is ineta
iptables -A INPUT -d $EXT_IP -p TCP --syn ! --dport 22 -j DROP
#Upravlenie serverom isvne
iptables -A INPUT -i $EXT_IF -p TCP --dport 22 \
-m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o $EXT_IF -p TCP --sport 22 \
-m state --state ESTABLISHED -j ACCEPT
#Obnovlenie servera olimp
for deb in $DEBIAN_SRV
do
iptables -A OUTPUT -p TCP -s $EXT_IP -d $deb --dport www \
-m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p TCP -d $EXT_IP -s $deb --sport www \
-m state --state ESTABLISHED -j ACCEPT
done
#ICMP traffic
iptables -A INPUT -p ICMP -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p ICMP -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
----------
Очень скоро еда станет совершенно безвкусной, и тогда этот недостаток придётся компенсировать хорошо развитым воображением. |
|
