[问题求助]ipcop 如何实现red到green 的port forward [复制链接]

大家好
我用ipc.op 来做防火墙,目前只有两块网卡, 一块对外的red, 一.块对内的green, 现在默认情况下 .不能实现重 red到green的端口转发,所以很多服务没能发布出去. 有个脚本是关于iptables的, 我对iptables 只了.解大概, 大家一起帮忙看看投资

roo.t@ipcop:/etc/rc.d # more rc..firewall(广告)

#!/bin/sh

#

# $Id: rc.firewall,v 1.7.2.20 2006/01/12 01:24:30 fr.anck78. Exp $(广告)

#



eval $.(/usr/local/bin/readhash /va.r/ipcop/ppp/settings)--- 印刷

eval $(/usr/local/bin/read.hash /var/ipcop/ethernet/sett.ings)域名

IFACE=`/bin/ca.t /var/ipcop/red/iface 2> /.dev/null | /usr/bin/tr -d '\012'`<性病>



if .[ -f ./var/ipcop/red/device ]; then电影

     .   DEVICE=`/bin/cat /var/ipcop/red/device 2> ./dev/null | /usr/.bin/tr -d '\012'`健康

fi



iptables_i.nit() {.

        # Flush all rule.s and delete all custom chain.s             电子

        /sbin/ipta.bles -F.

        /sbin/iptabl.es. -t nat -F电脑

        /sbin/iptables -t man.gle. -F.

     .   /sbin/iptables -X    外汇

    .    ./sbin/iptables -t nat -X.

    .    /sbin/.iptables -t mangle -X    外汇



        .# Set up policies电脑

        /sbin/ip.tables -P INPUT DRO.P学习

        /sbin/iptabl.es .-P FORWARD DROP--------------彩票

  .  .    /sbin/iptables -P OUTPUT ACCEPT.



        # Empty LOG_DROP .and LOG_REJECT cha.ins教育

  .  .    /sbin/iptables -N LOG_DROP虚拟主机

        /sbin/iptable.s -A LOG_DROP   -m limit --limit 10/minute. -j LOG电脑

      .  /s.bin/iptables -A LOG_DROP   -j DROP.

        /s..bin/iptables -N LOG_REJECT.

        /sbin/.iptables -A LOG_REJECT -m li.mit --limit 10/minute -j LOG健康

        /sbin/iptables -A .LOG._REJECT -j REJECT(        游戏          )



        # This c..hain will log, then DROPs packets with c.ertain bad combinations.

  .      # of flags might indicate a port-scan attempt (xmas, null, e.tc)

        /sbin/i.ptables -N P.SCAN学习

        /sbin./iptables -A PSCAN -p tcp  -m limit --limit 10/minute -j LOG --log-prefix ".T.CP Scan? ".

        /sbin./.iptables -A PSCAN -p udp  -m limit --limit 10/minute -j LOG --log-prefix ".UDP Scan? "           女人

        /sbin/ipta.bles -A PSCAN -p icmp .-m limit --li.mit 10/minute -j LOG --log-prefix "ICMP Scan? "    美容

.  .     /sbin/iptables -A PSCAN -f .     -m limit --limit 10/minute -j LOG --log-prefix "FRAG Scan? "             电子

        /sbin/.iptables -A P.SCAN -j DROP健康



        # New tcp packets without SYN set - could wel.l be an obsc.ure type of .port scan           女人

        # that's not. covered above, may just be a broken. windows machine.

        /sbin/iptables .-.N NEWNOTSYN    外汇

    .    /sbin/iptables -A NEWNOTSYN  -m limit --limit 10/minute -j LOG  --log-pr.efix "NEW not SYN? ".--- 印刷

   .     /sbi.n/iptables -A NEWNOTSYN  -j DROP    美容



        # Chain to contain all. the rule.s relating to bad TCP flags学习

.       /sbin/i.ptables -N BADTCP教育



        # Disallow pa.ckets frequently used by p.ort-scanners            杀毒

        # nmap x.mas.

        /.sbin/iptables -A. B.ADTCP -p tcp --tcp-flags ALL FIN,URG,PSH  -j PSCAN服务器

        # Null

        /s.bin/iptables .-A BADTCP -p tcp --tcp-flags ALL NONE -j PSCAN(广告)

        # FIN

.       /sbin/iptables .-A BADTCP -p tcp --tcp-flags ALL FIN -j PSCAN    健康

.       # SYN/RST (also catches xmas variants that set SYN+RST.+...).

        /sbi.n/iptables -A. BADTCP -p tcp --tcp-.flags SYN,RST SYN,RST -j PSCAN外贸

        # SYN/FIN (QueSO or nma.p OS. probe).

     .   /sbi.n/iptables -A BADTCP -p tcp --tcp-flags SYN,FIN SYN,FIN .-j PSCAN.

.       # NEW TCP with.out SYN健康

      .  /sbin/iptables -A BADTCP -p tcp .! --syn -m stat.e --state NEW -j NEWNOTSYN.



        /sbin/iptables -A .I.NPUT   -j BADTCP.

     .   /sbin/iptables -A FOR.WARD -j BADTCP           建材



}



iptables._red() {.

      .  /sbin/iptables -F REDINPUT.           建材

        /sbi.n/i.ptables -F REDFORWARD<性病>

        /sb.in/iptables .-t nat -F REDNAT              乙肝



       . # PPPoE / PPTP Devic.e.

        if [ ".$IFACE". != "" ]; then[成人用品]

    .      .      # PPPoE / PPTP.

                if [ ."$DEVICE" .!= "" ]; then服务器

                        ./sbin/iptables -A REDINPUT -i $.DEVICE -j ACCEPT电影

.               fi             电子

        .        if [ "$RED_TYPE" == "PPTP" -o "$RED_TYPE" == ".PPPOE" ]; th.en教育

                        if [ "$RED_D.EV" != "" ];. then服务器

    .                           . /sbin/ipta.bles -A REDINPUT -i $RED_DEV -j ACCEPT                        fi<性病>

               . fi.

        fi



        # P.PTP over DHCP             汽车

        if [ ."$DEVICE". != "" -a "$TYPE" == "PPTP" -a "$METHOD" == "DHCP" .]; then.                /sbin/iptables -A REDINPUT -p tcp -.-source-port 67 --destination-port 68 -i $DEVICE -j ACCEPT<性病>

     .           /sbin/iptables -A REDINPUT -p udp --source-port 67 --destinati.on-port 68 -i $DE.VICE -j ACCEPT           女人

        fi



        #. Orange pinholes<性病>

        if [ "$ORANGE_DEV" !.= "". ]; then    健康

                # This ru.le enables a host on ORANGE network to c.o.nnect to the outside健康

.               # (only if we hav.e a red connection).

  .          .    if [ "$IFACE" != "" ]; then.

               ..         /sbin/iptables -A REDFORWARD -i $ORANGE_DEV -p tcp -o. $IFACE -j ACCEPT虚拟主机

             ..       .    /sbin/iptables -A REDFORWARD -i $ORANGE_DEV -p udp -o $IFACE -j ACCEPT          婚庆

   .             fi           建材

        fi



        if [ "$I.FACE". != "" -a -f /var/ipcop/red/active ]; then           鲜花

                # DHC.P外贸

                if [ "$RED_DEV" != "" .-a "$RED_TYPE" == "DHCP" ]; th.en电影

                        /sbin/iptables -A REDINPUT -p tcp --source-port 67. --des.tination-port 68 -i $IFACE -j AC.CEPT.

                        /sbin/iptab.les -A REDINPUT -p udp --source-port 67 --destination-por..t 68 -i $IFACE -j ACCEPT教育

     .           fi[成人用品]

                if [ ".$METHOD" == "DHCP"  -a "$P.ROTOCOL" == "RFC14.83" ]; then    健康

                        /sbin/i.ptables -A REDI.NPUT -p tcp --source-port 67 --destina.tion-port 68 -i $IFACE -j ACCEPT<性病>

                        /sbin/ipta.bles. -A REDINPUT -p udp --source-port 67 --destination-port. 68 -i $IFACE -j ACCEPT           建材

          .      fi.



              .  # Outgoing masquer.ading服务器

     .           /sbin/iptables -t nat -A REDNAT -.o $IFACE -j MASQUERADE电影



        fi

}
复制代码

续上
# See how we were called.

case "$1" in

  start)

        iptables_init



        # Limit Packets- helps reduce dos/syn attacks

        # original do nothing line

        #/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 10/sec

        # the correct one, but the negative '!' do nothing...

        #/sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit ! --limit 10/sec -j DROP



        # Fix for braindead ISP's

        /sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu



        # CUSTOM chains, can be used by the users themselves

        /sbin/iptables -N CUSTOMINPUT

        /sbin/iptables -A INPUT -j CUSTOMINPUT

        /sbin/iptables -N CUSTOMFORWARD

        /sbin/iptables -A FORWARD -j CUSTOMFORWARD

        /sbin/iptables -N CUSTOMOUTPUT

        /sbin/iptables -A OUTPUT -j CUSTOMOUTPUT

        /sbin/iptables -t nat -N CUSTOMPREROUTING

        /sbin/iptables -t nat -A PREROUTING -j CUSTOMPREROUTING

        /sbin/iptables -t nat -N CUSTOMPOSTROUTING

        /sbin/iptables -t nat -A POSTROUTING -j CUSTOMPOSTROUTING



        # filtering from GUI

        /sbin/iptables -N GUIINPUT

        /sbin/iptables -A INPUT -j GUIINPUT



        # Accept everything connected

        /sbin/iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT        /sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

        # localhost and ethernet.

        /sbin/iptables -A INPUT   -i lo          -m state --state NEW -j ACCEPT

        /sbin/iptables -A INPUT   -s 127.0.0.0/8 -m state --state NEW -j DROP

# Loopback not on lo

        /sbin/iptables -A INPUT   -d 127.0.0.0/8 -m state --state NEW -j DROP

        /sbin/iptables -A FORWARD -i lo          -m state --state NEW -j ACCEPT

        /sbin/iptables -A FORWARD -s 127.0.0.0/8 -m state --state NEW -j DROP

        /sbin/iptables -A FORWARD -d 127.0.0.0/8 -m state --state NEW -j DROP

        /sbin/iptables -A INPUT   -i $GREEN_DEV  -m state --state NEW -j ACCEPT

-p ! icmp

        /sbin/iptables -A FORWARD -i $GREEN_DEV  -m state --state NEW -j ACCEPT



        # If a host on orange tries to initiate a connection to IPCop's red IP and

        # the connection gets DNATed back through a port forward to a server on

orange

        # we end up with orange -> orange traffic passing through IPCop

        [ "$ORANGE_DEV" != "" ] && /sbin/iptables -A FORWARD -i $ORANGE_DEV -o $ORANGE_DEV -m state --state NEW -j ACCEPT



        # accept all traffic from ipsec interfaces

        /sbin/iptables -A INPUT   -i ipsec+ -j ACCEPT

        /sbin/iptables -A FORWARD -i ipsec+ -j ACCEPT



        # allow DHCP on BLUE to be turned on/off

        /sbin/iptables -N DHCPBLUEINPUT

        /sbin/iptables -A INPUT -j DHCPBLUEINPUT



        # IPSec chains

        /sbin/iptables -N IPSECRED

        /sbin/iptables -A INPUT -j IPSECRED

        /sbin/iptables -N IPSECBLUE

        /sbin/iptables -A INPUT -j IPSECBLUE



        # WIRELESS chains

        /sbin/iptables -N WIRELESSINPUT

        /sbin/iptables -A INPUT -m state --state NEW -j WIRELESSINPUT

        /sbin/iptables -N WIRELESSFORWARD

        /sbin/iptables -A FORWARD -m state --state NEW -j WIRELESSFORWARD



        # RED chain, used for the red interface

        /sbin/iptables -N REDINPUT

        /sbin/iptables -A INPUT -j REDINPUT

        /sbin/iptables -N REDFORWARD

        /sbin/iptables -A FORWARD -j REDFORWARD

        /sbin/iptables -t nat -N REDNAT

        /sbin/iptables -t nat -A POSTROUTING -j REDNAT



        iptables_red



        # DMZ pinhole chain.  setdmzholes setuid prog adds rules here to allow

        # ORANGE to talk to GREEN / BLUE.

        /sbin/iptables -N DMZHOLES

        if [ "$ORANGE_DEV" != "" ]; then

                /sbin/iptables -A FORWARD -i $ORANGE_DEV -m state --state NEW -j DMZHOLES

        fi



        # XTACCESS chain, used for external access

        /sbin/iptables -N XTACCESS

        /sbin/iptables -A INPUT -m state --state NEW -j XTACCESS



        # PORTFWACCESS chain, used for portforwarding

        /sbin/iptables -N PORTFWACCESS

        /sbin/iptables -A FORWARD -m state --state NEW -j PORTFWACCESS



        # Custom prerouting chains (for transparent proxy and port forwarding)

        /sbin/iptables -t nat -N SQUID

        /sbin/iptables -t nat -A PREROUTING -j SQUID

        /sbin/iptables -t nat -N PORTFW

        /sbin/iptables -t nat -A PREROUTING -j PORTFW





        # Custom mangle chain (for port fowarding)

        /sbin/iptables -t mangle -N PORTFWMANGLE

        /sbin/iptables -t mangle -A PREROUTING -j PORTFWMANGLE



        # Postrouting rules (for port forwarding)

        /sbin/iptables -t nat -A POSTROUTING -m mark --mark 1 -j SNAT \

         --to-source $GREEN_ADDRESS

        if [ "$BLUE_DEV" != "" ]; then

                /sbin/iptables -t nat -A POSTROUTING -m mark --mark 2 -j SNAT --to-source $BLUE_ADDRESS

        fi

        if [ "$ORANGE_DEV" != "" ]; then

                /sbin/iptables -t nat -A POSTROUTING -m mark --mark 3 -j SNAT --to-source $ORANGE_ADDRESS

        fi





        # run local firewall configuration, if present

        if [ -x /etc/rc.d/rc.firewall.local ]; then

                /etc/rc.d/rc.firewall.local start

        fi



        # last rule in input and forward chain is for logging.

        /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "INPUT "

        /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "OUTPUT "

        ;;

  stop)

        iptables_init

        # Accept everyting connected

        /sbin/iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT

        # localhost and ethernet.

        /sbin/iptables -A INPUT -i lo -j ACCEPT

        /sbin/iptables -A INPUT -i $GREEN_DEV -m state --state NEW -j ACCEPT



        if [ "$RED_DEV" != "" -a "$RED_TYPE" == "DHCP" ]; then

                /sbin/iptables -A INPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT

                /sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT

        fi

        if [ "$PROTOCOL" == "RFC1483" -a "$METHOD" == "DHCP" ]; then

                /sbin/iptables -A INPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT

                /sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT

        fi



        # run local firewall configuration, if present

        if [ -x /etc/rc.d/rc.firewall.local ]; then

                /etc/rc.d/rc.firewall.local stop

        fi



        /sbin/iptables -A INPUT   -m limit --limit 10/minute -j LOG --log-prefix "INPUT "

        /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "OUTPUT "

        ;;

  reload)

        iptables_red



        # run local firewall configuration, if present

        if [ -x /etc/rc.d/rc.firewall.local ]; then

                /etc/rc.d/rc.firewall.local reload

        fi

        ;;

  restart)

        $0 stop

        $0 start

        ;;

  *)

        echo "Usage: $0 {start|stop|reload|restart}"

        exit 1

        ;;

esac



exit 0
复制代码