PATH=$PATH:/usr/sbin:/sbin
CTC_IF="eth1"
INT_IF="eth0"
CTC_IP="61.185.0.05"
INT_IP="192.168.0.1"
LAN_IP="192.168.0.0/16"
# SSH
TRUSTED_LOCAL_TCP_PORT="22"
TRUSTED_LOCAL_UDP_PORT="22"
# FTP GAME
FWD_TCP_PORT="21"
SERVER_IP="192.168.0.2"
# load any special modules
depmod -a
modprobe ip_tables
modprobe iptable_nat
modprobe iptable_filter
modprobe ipt_limit
modprobe ipt_state
modprobe ip_nat_ftp
modprobe ip_nat_irc
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_conntrack_irc
# delete any existing chains
iptables -F
iptables -X
iptables -Z
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
iptables -F -t mangle
iptables -X -t mangle
iptables -Z -t mangle
# setting up default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P POSTROUTING ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
# allow ping from internet and DDOS DOS FLOOD
iptables -A INPUT -i $CTC_IF -p icmp -j ACCEPT
iptables -A INPUT -i $INT_IF -p icmp -j ACCEPT
iptables -A INPUT -i $CTC_IF -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -i $INT_IF -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -i $CTC_IF -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -i $INT_IF -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT
iptables -A FORWARD -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP
iptables -A FORWARD -p tcp --tcp-flags ALL ALL -j DROP
iptables -A FORWARD -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
iptables -A FORWARD -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A FORWARD -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
# enable local traffic
iptables -N allowed
iptables -A allowed ! -i $CTC_IF -m state --state NEW -j ACCEPT
iptables -A allowed -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -j allowed
iptables -A FORWARD -j allowed
for PORT in $TRUSTED_LOCAL_TCP_PORT; do
iptables -A INPUT -i $CTC_IF -p tcp --dport $PORT -m state --state NEW -j ACCEPT
done
for PORT in $TRUSTED_LOCAL_UPD_PORT; do
iptables -A INPUT -i $CTC_IF -p udp --dport $PORT -m state --state NEW -j ACCEPT
done
#------------nat---------------
#ip forwarding
for PORT in $FWD_TCP_PORT; do
iptables -A FORWARD -i $CTC_IF -o $INT_IF -d $SERVER_IP -p tcp --dport $PORT -m state --state NEW -j ACCEPT
iptables -t nat -A PREROUTING -d $CTC_IP -p tcp --dport $PORT -j DNAT --to $SERVER_IP
iptables -t nat -A POSTROUTING -s $LAN_IP -d $SERVER_IP -p tcp --dport $PORT -j SNAT --to-source $INT_IP
done
#for PORT in $FWD_UDP_PORT; do
#iptables -A FORWARD -i $CNC_IF -o $INT_IF -d $SERVER_IP -p udp --dport $PORT -m state --state NEW -j ACCEPT
#iptables -A FORWARD -i $CTC_IF -o $INT_IF -d $SERVER_IP -p udp --dport $PORT -m state --state NEW -j ACCEPT
#iptables -t nat -A PREROUTING -d $CNC_IP -p udp --dport $PORT -j DNAT --to $SERVER_IP
#iptables -t nat -A PREROUTING -d $CTC_IP -p udp --dport $PORT -j DNAT --to $SERVER_IP
#iptables -t nat -A POSTROUTING -s $LAN_IP -d $SERVER_IP -p udp --dport $PORT -j SNAT --to-source $INT_IP
#done
# MASQUERADE
iptables -t nat -A POSTROUTING -o $CTC_IF -s $LAN_IP -j MASQUERADE
iptables -t nat -A PREROUTING -i $CTC_IF -s $LAN_IP -j DROP
iptables -t mangle -I PREROUTING -d 224.0.0.0/8 -j DROP
# turn on ip forwarding
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "262144" > /proc/sys/net/ipv4/ip_conntrack_max
sysctl -w net.ipv4.tcp_max_syn_backlog="2048"
# setting up ip spoofing protection
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $f
done
# end
这是我的nat脚本,大家帮我看看,那里设置不太恰当.别的都没改啥
