: 19 października 2011, 20:45
Kod: Zaznacz cały
#!/bin/bash
echo "Starting firewall..."
IPTABLES=/sbin/iptables
$IPTABLES -t filter -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
$IPTABLES -X
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
##### MAC CONTROL ACCESS LIST
$IPTABLES -N MACCONTROL
$IPTABLES -A MACCONTROL -s 192.168.1.2 -m mac --mac-source 00:20:20:47:42 :D 9 -j RETURN
$IPTABLES -A MACCONTROL -s 192.168.1.102 -m mac --mac-source 00:20:20:AE:FE:0A -j RETURN
$IPTABLES -A MACCONTROL -s 192.168.1.110 -m mac --mac-source 00:20:20:4E:8D:A0 -j RETURN
$IPTABLES -A MACCONTROL -s 192.168.1.111 -m mac --mac-source 00:20:20:A7:A2:65 -j RETURN
$IPTABLES -A MACCONTROL -s 192.168.1.113 -m mac --mac-source 00:20:20:FA:49:A6 -j RETURN
$IPTABLES -A MACCONTROL -s 192.168.1.114 -m mac --mac-source 00:20:20:C7:79:BF -j RETURN
$IPTABLES -A MACCONTROL -s 192.168.1.115 -m mac --mac-source 00:20:20:E8:CB:0B -j RETURN
(...)
(...)
(...)
$IPTABLES -A MACCONTROL -j DROP
$IPTABLES -A FORWARD -i eth1 -s 192.168.1.2 -j ACCEPT
$IPTABLES -A FORWARD -i eth0 -d 192.168.1.2 -j ACCEPT
$IPTABLES -A FORWARD -i eth1 -s 192.168.1.112 -p tcp -j MACCONTROL
$IPTABLES -A FORWARD -i eth1 -s 192.168.1.153 -p tcp -j MACCONTROL
$IPTABLES -A FORWARD -i eth1 -s 192.168.1.154 -p tcp -j MACCONTROL
$IPTABLES -A FORWARD -i eth1 -m iprange --src-range 192.168.1.1-192.168.1.30 -p tcp -j MACCONTROL
$IPTABLES -A FORWARD -i eth1 -m iprange --src-range 192.168.1.100-192.168.1.111 -p tcp -m multiport --dport 80,443,465,995 -j MACCONTROL
$IPTABLES -A FORWARD -i eth1 -m iprange --src-range 192.168.1.113-192.168.1.152 -p tcp -m multiport --dport 80,443,465,995 -j MACCONTROL
$IPTABLES -A FORWARD -i eth1 -m iprange --src-range 192.168.1.155-192.168.1.179 -p tcp -m multiport --dport 80,443,465,995 -j MACCONTROL
$IPTABLES -A FORWARD -i eth1 -m iprange --src-range 192.168.1.181-192.168.1.254 -p tcp -m multiport --dport 80,443,465,995 -j MACCONTROL
$IPTABLES -A FORWARD -i eth1 -s 192.168.1.0/24 -p udp --dport 53 -j MACCONTROL
$IPTABLES -A FORWARD -i eth1 -s 192.168.1.0/24 -p tcp -j ACCEPT
##### NAT
$IPTABLES -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-ports 3128
$IPTABLES -t nat -A POSTROUTING -o eth0 -s 192.168.1.0/24 -j MASQUERADE
echo "Firewall started..."