Polskie Forum Użytkowników Debiana

Kod: Zaznacz cały

auto eth1
iface eth1 inet static
	address 70.180.120.211
	netmask 255.255.255.248
	network 70.180.120.208
	broadcast 70.180.127.215
	gateway 70.180.120.209
	dns-nameservers 194.204.159.1 194.204.152.34

auto eth0
iface eth0 inet static
	address 172.16.1.99
	netmask	255.255.255.0
	network 172.16.1.0
auto eth0:1
iface eth0:1 inet static
	address 192.168.0.1
	netmask 255.255.255.0
	network 192.168.0.0
	
auto eth0:2
iface eth0:2 inet static
	address 172.17.0.1
	netmask 255.255.255.0
	network 172.17.0.0

Kod: Zaznacz cały

ddns-update-style none;
shared-network inet {
subnet 192.168.0.0 netmask 255.255.255.0 {
    autoritative;
    range 192.168.0.2 192.168.0.250;
    option domain-name-servers 194.204.159.1, 194.204.152.34;
    option domain-name "be.inet";
    option routers 192.168.0.1;
    option ntp-servers 192.168.0.1;
    #option broadcast-address 192.168.0.1;
    default-lease-time 86400;
    max-lease-time 172800;
}

subnet 172.17.0.0 netmask 255.255.255.0 {
    autoritative;
    option domain-name-servers 194.204.159.1, 194.204.152.34;
    option domain-name "fin.inet";
    option routers 172.17.0.1;
    default-lease-time 86400;
    max-lease-time 172800;
    option ip-forwarding off;
    option ntp-servers 172.17.0.1;
}

subnet 172.16.1.0 netmask 255.255.255.0 {
    autoritative;
    option domain-name-servers 194.204.159.1, 194.204.152.34;
    option domain-name "bz.inet";
    option routers 172.16.1.99;
    default-lease-time 86400;
    max-lease-time 172800;
    option ip-forwarding off;
    option ntp-servers 172.16.1.99;
    option netbios-node-type 8;

	host server {
	option host-name "test";
	hardware ethernet 00:07:E9:C2:2F:04;
	fixed-address 172.16.1.21;
       }
}


}

Kod: Zaznacz cały

00:00:E2:9F:1F:EF 172.16.1.20 53,80,443
00:07:E9:C2:2F:04 172.16.1.21 21,25,53,80,110
00:1D:7D:42:12:19 172.16.1.247 21,53,80,443

Kod: Zaznacz cały

#!/bin/sh
#WLACZAMY/WYLACZAMY DOSTEPY
SSH=1
#ZMIENNE
SSHPORT="22022";
LAN="172.16.1.0";
PODSIEC="$LAN/24";
LAN2=172.17.0.0";
PODSIEC2="$LAN2/24";
SRV="172.16.1.99";
SRVPOD="$SRV/24";
MGR="172.16.1.21/24";
WONSRV="192.168.0.1";
WON="192.168.0.0/24";
EXTIP="70.180.120.211";
DPORT="25,53,80,110,123";

iptables -F
iptables -X
iptables -t nat -X
iptables -t nat -F
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A OUTPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with icmp-port-unreachable
iptables -A INPUT -p tcp --dport 1080 -j REJECT --reject-with icmp-port-unreachable
iptables -A INPUT -p icmp --icmp-type echo-request -j REJECT --reject-with icmp-port-unreachable
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A FORWARD -o lo -j ACCEPT

if [ "$SSH" = "1" ]; then
iptables -A INPUT -s 0/0 -d $EXTIP -p tcp --dport $SSHPORT -j ACCEPT
iptables -A OUTPUT -s 0/0 -d $EXTIP -p tcp --dport $SSHPORT -j ACCEPT
iptables -A INPUT -s 0/0 -d $EXTIP -p udp --dport $SSHPORT -j ACCEPT
iptables -A OUTPUT -s 0/0 -d $EXTIP -p udp --dport $SSHPORT -j ACCEPT
iptables -A INPUT -p udp -s $MGR --dport $SSHPORT -j ACCEPT
iptables -A INPUT -p tcp -s $MGR --dport $SSHPORT -j ACCEPT
fi

#WYP UPIERDLIWCOW
iptables -A INPUT -s $WON -j ACCEPT
iptables -A FORWARD -s $WON -j ACCEPT
iptables -t nat -A POSTROUTING -s $WON  -j MASQUERADE
iptables -A FORWARD -s $WON -p udp --dport 53 -j ACCEPT
iptables -A PREROUTING -t nat -p tcp -s $WON --dport 1:52 -j DNAT --to-destination $WONSRV:80
iptables -A PREROUTING -t nat -p tcp -s $WON --dport 54:65535 -j DNAT --to-destination $WONSRV:80
iptables -A PREROUTING -t nat -p udp -s $WON --dport 1:52 -j DNAT --to-destination $WONSRV:80
iptables -A PREROUTING -t nat -p udp -s $WON --dport 54:65535 -j DNAT --to-destination $WONSRV:80
iptables -A INPUT -s $WON -p tcp --dport 80 -d $WONSRV -j ACCEPT
iptables -A INPUT -s $WON -p udp --dport 80 -d $WONSRV -j ACCEPT
iptables -A FORWARD -s $WON -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -s $WON -p tcp --dport 80 -d $WONSRV -j ACCEPT
iptables -A FORWARD -s $WON -p udp --dport 80 -d $WONSRV -j ACCEPT

iptables -N MAC_check
iptables -A FORWARD -s $PODSIEC -j MAC_check
cat /etc/firewall/local_ok | while read linia
do
    MAC_ALLOW="`echo $linia | grep -vE '^[[:space:]]*(#|$)'`"
    if [ "$MAC_ALLOW" != "" ]
	then
	    IP="`echo $MAC_ALLOW | cut -d ' ' -f2`"
	    MAC="`echo $MAC_ALLOW | cut -d ' ' -f1`"
    iptables -A MAC_check -m mac --mac-source $MAC -s $IP -p all -j RETURN
    iptables -A MAC_check -j DROP
    echo "Uprawniam IP: $IP z MAC: $MAC"
    fi
done;


iptables -t nat -A POSTROUTING -s $PODSIEC -j MASQUERADE
iptables -A FORWARD -s $PODSIEC -p udp --dport 53 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 80 -j REDIRECT --to-port 3128
iptables -A FORWARD -s $PODSIEC -j ACCEPT


iptables -t nat -A POSTROUTING -s $PODSIEC2 -j MASQUERADE
iptables -A FORWARD -s $PODSIEC2 -p udp --dport 53 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 80 -j REDIRECT --to-port 3128
iptables -A FORWARD -s $PODSIEC2 -j ACCEPT

iptables -A INPUT -p tcp -i eth1 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp -i eth1 -j REJECT --reject-with icmp-port-unreachable