[root@centos ~]# vi iptables-router.shソス@ソスソスソス@iptablesソスン抵ソスXソスNソスソスソスvソスgソス成
#!/bin/bash
#---------------------------------------#
# ソスン抵ソスJソスn #
#---------------------------------------#
# LANソスCソスソスソス^ソスtソスFソス[ソスXソスソスソスソス`
LAN=eth0
# WANソスCソスソスソス^ソスtソスFソス[ソスXソスソスソスソス`
WAN=ppp0
# ソスソスソスJソスTソス[ソスoソス[ソスvソスソスソスCソスxソス[ソスgIPソスAソスhソスソスソスXソスソス`
SERVER=192.168.1.3
#---------------------------------------#
# ソスン抵ソスIソスソス #
#---------------------------------------#
# ソスソスソスzソスXソスgソスvソスソスソスCソスxソス[ソスgIPソスAソスhソスソスソスXソス謫セ
IPADDR=`ifconfig $LAN|sed -e 's/^.*inet addr:\([^ ]*\).*$/\1/p' -e d`
# LANソスlソスbソスgソス}ソスXソスNソス謫セ
LOCALNET_MASK=`ifconfig $LAN|sed -e 's/^.*Mask:\([^ ]*\)$/\1/p' -e d`
# LANソスlソスbソスgソスソスソス[ソスNソスAソスhソスソスソスXソス謫セ
LOCALNET_ADDR=`netstat -rn|grep $LAN|grep $LOCALNET_MASK|grep 0.0.0.0|cut -f1 -d' '`
LOCALNET=$LOCALNET_ADDR/$LOCALNET_MASK
# ソスヌみ搾ソスソスン対象ソスソスWソスソスソス[ソスソスソスヌ会ソス
sed -i '/IPTABLES_MODULES/d' /etc/sysconfig/iptables-config
modinfo ip_nat_pptp > /dev/null 2>&1
if [ $? -eq 0 ]; then
echo "IPTABLES_MODULES=\"ip_conntrack_ftp ip_nat_ftp ip_nat_pptp\"" >> /etc/sysconfig/iptables-config
else
echo "IPTABLES_MODULES=\"ip_conntrack_ftp ip_nat_ftp\"" >> /etc/sysconfig/iptables-config
fi
# ソスpソスPソスbソスgソス]ソスソスソスソス~
# ソスソスソスソスソス[ソスソスソスン定中ソスフパソスPソスbソスgソスハ過防ソス~
sysctl -w net.ipv4.ip_forward=0 > /dev/null
# ソスfソスtソスHソスソスソスgソスソスソス[ソスソス(ソスネ降ソスフソスソス[ソスソスソスノマソスbソス`ソスソスソスネゑソスソスソスソスソスソス鼾ソスノ適ソスpソスソスソス驛具ソス[ソスソス)ソスン抵ソス
IPTABLES_CONFIG_NAT=`mktemp`
IPTABLES_CONFIG_FILTER=`mktemp`
echo "*nat" >> $IPTABLES_CONFIG_NAT
echo ":PREROUTING ACCEPT [0:0]" >> $IPTABLES_CONFIG_NAT
echo ":POSTROUTING ACCEPT [0:0]" >> $IPTABLES_CONFIG_NAT
echo ":OUTPUT ACCEPT [0:0]" >> $IPTABLES_CONFIG_NAT
echo "*filter" >> $IPTABLES_CONFIG_FILTER
echo ":INPUT DROP [0:0]" >> $IPTABLES_CONFIG_FILTER # ソスソスMソスヘゑソスソスラて破ソスソス
echo ":FORWARD DROP [0:0]" >> $IPTABLES_CONFIG_FILTER # ソスハ過はゑソスソスラて破ソスソス
echo ":OUTPUT ACCEPT [0:0]" >> $IPTABLES_CONFIG_FILTER # ソスソスソスMソスヘゑソスソスラて具ソスソスソス
echo ":ACCEPT_COUNTRY - [0:0]" >> $IPTABLES_CONFIG_FILTER # ソスwソス閧オソスソスソスソスソスソスソスソスフアソスNソスZソスXソスソスソスソスソスソス
echo ":DROP_COUNTRY - [0:0]" >> $IPTABLES_CONFIG_FILTER # ソスwソス閧オソスソスソスソスソスソスソスソスフアソスNソスZソスXソスソスjソスソス
echo ":LOG_FRAGMENT - [0:0]" >> $IPTABLES_CONFIG_FILTER # ソスtソスソスソスOソスソスソスソスソスgソスソスソスソスソス黷スソスpソスPソスbソスgソスヘソスソスOソスソスソスLソス^ソスソスソスト破ソスソス
echo ":LOG_INGRESS - [0:0]" >> $IPTABLES_CONFIG_FILTER # ソスソスソスMソスソスIPソスAソスhソスソスソスXソスソスLANソスlソスbソスgソスソスソス[ソスNソスヘ囲外ソスフアソスNソスZソスXソスヘソスソスOソスソスソスLソス^ソスソスソスト破ソスソス
echo ":LOG_PINGDEATH - [0:0]" >> $IPTABLES_CONFIG_FILTER # Ping of DeathソスUソスソスソスヘソスソスOソスソスソスLソス^ソスソスソスト破ソスソス
echo ":LOG_SPOOFING - [0:0]" >> $IPTABLES_CONFIG_FILTER # WANソスソスソスソスフ托ソスソスMソスソスソスソスソスvソスソスソスCソスxソス[ソスgIPソスAソスhソスソスソスXソスフパソスPソスbソスgソスヘソスソスOソスソスソスLソス^ソスソスソスト破ソスソス
# ソスpソスXMTUソスソスソスホ擾ソス
echo "-A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu" >> $IPTABLES_CONFIG_FILTER
# SYN CookiesソスソスLソスソスソスノゑソスソスソス
# ソスソスTCP SYN FloodソスUソスソスソスホ搾ソス
sysctl -w net.ipv4.tcp_syncookies=1 > /dev/null
sed -i '/net.ipv4.tcp_syncookies/d' /etc/sysctl.conf
echo "net.ipv4.tcp_syncookies=1" >> /etc/sysctl.conf
# ソスuソスソスソス[ソスhソスLソスソスソスXソスgソスAソスhソスソスソスXソスソスpingソスノは会ソスソスソスソスソスソスネゑソス
# ソスソスSmurfソスUソスソスソスホ搾ソス
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1 > /dev/null
sed -i '/net.ipv4.icmp_echo_ignore_broadcasts/d' /etc/sysctl.conf
echo "net.ipv4.icmp_echo_ignore_broadcasts=1" >> /etc/sysctl.conf
# ICMP RedirectソスpソスPソスbソスgソスヘ具ソスソスソス
sed -i '/net.ipv4.conf.*.accept_redirects/d' /etc/sysctl.conf
for dev in `ls /proc/sys/net/ipv4/conf/`
do
sysctl -w net.ipv4.conf.$dev.accept_redirects=0 > /dev/null
echo "net.ipv4.conf.$dev.accept_redirects=0" >> /etc/sysctl.conf
done
# Source RoutedソスpソスPソスbソスgソスヘ具ソスソスソス
sed -i '/net.ipv4.conf.*.accept_source_route/d' /etc/sysctl.conf
for dev in `ls /proc/sys/net/ipv4/conf/`
do
sysctl -w net.ipv4.conf.$dev.accept_source_route=0 > /dev/null
echo "net.ipv4.conf.$dev.accept_source_route=0" >> /etc/sysctl.conf
done
# ソスtソスソスソスOソスソスソスソスソスgソスソスソスソスソス黷スソスpソスPソスbソスgソスヘソスソスOソスソスソスLソス^ソスソスソスト破ソスソス
echo "-A LOG_FRAGMENT -j LOG --log-tcp-options --log-ip-options --log-prefix \"[IPTABLES FRAGMENT] : \"" >> $IPTABLES_CONFIG_FILTER
echo "-A LOG_FRAGMENT -j DROP" >> $IPTABLES_CONFIG_FILTER
echo "-A INPUT -f -j LOG_FRAGMENT" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -f -j LOG_FRAGMENT" >> $IPTABLES_CONFIG_FILTER
# WANソスソスソスソスフ托ソスソスMソスソスソスソスソスvソスソスソスCソスxソス[ソスgIPソスAソスhソスソスソスXソスフパソスPソスbソスgソスヘソスソスOソスソスソスLソス^ソスソスソスト破ソスソス
# ソスソスIP spoofingソスUソスソスソスホ搾ソス
echo "-A LOG_SPOOFING -j LOG --log-tcp-options --log-ip-options --log-prefix \"[IPTABLES SPOOFING] : \"" >> $IPTABLES_CONFIG_FILTER
echo "-A LOG_SPOOFING -j DROP" >> $IPTABLES_CONFIG_FILTER
echo "-A INPUT -i ppp+ -s 127.0.0.0/8 -j LOG_SPOOFING" >> $IPTABLES_CONFIG_FILTER
echo "-A INPUT -i ppp+ -s 10.0.0.0/8 -j LOG_SPOOFING" >> $IPTABLES_CONFIG_FILTER
echo "-A INPUT -i ppp+ -s 172.16.0.0/12 -j LOG_SPOOFING" >> $IPTABLES_CONFIG_FILTER
echo "-A INPUT -i ppp+ -s 192.168.0.0/16 -j LOG_SPOOFING" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -i ppp+ -s 127.0.0.0/8 -j LOG_SPOOFING" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -i ppp+ -s 10.0.0.0/8 -j LOG_SPOOFING" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -i ppp+ -s 172.16.0.0/12 -j LOG_SPOOFING" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -i ppp+ -s 192.168.0.0/16 -j LOG_SPOOFING" >> $IPTABLES_CONFIG_FILTER
# WANソスニゑソスNetBIOSソスヨ連ソスフアソスNソスZソスXソスヘソスソスOソスソスソスLソス^ソスソスソスソスソスノ破ソスソス
echo "-A INPUT -i ppp+ -p tcp -m multiport --dports 135,137,138,139,445 -j DROP" >> $IPTABLES_CONFIG_FILTER
echo "-A INPUT -i ppp+ -p udp -m multiport --dports 135,137,138,139,445 -j DROP" >> $IPTABLES_CONFIG_FILTER
echo "-A OUTPUT -o ppp+ -p tcp -m multiport --sports 135,137,138,139,445 -j DROP" >> $IPTABLES_CONFIG_FILTER
echo "-A OUTPUT -o ppp+ -p udp -m multiport --sports 135,137,138,139,445 -j DROP" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -i ppp+ -p tcp -m multiport --dports 135,137,138,139,445 -j DROP" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -i ppp+ -p udp -m multiport --dports 135,137,138,139,445 -j DROP" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -o ppp+ -p tcp -m multiport --sports 135,137,138,139,445 -j DROP" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -o ppp+ -p udp -m multiport --sports 135,137,138,139,445 -j DROP" >> $IPTABLES_CONFIG_FILTER
# 1ソスbソスヤゑソス4ソスソス超ゑソスソスソスpingソスヘソスソスOソスソスソスLソス^ソスソスソスト破ソスソス
echo "-A LOG_PINGDEATH -m limit --limit 1/s --limit-burst 4 -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A LOG_PINGDEATH -j LOG --log-prefix \"[IPTABLES PINGDEATH] : \"" >> $IPTABLES_CONFIG_FILTER
echo "-A LOG_PINGDEATH -j DROP" >> $IPTABLES_CONFIG_FILTER
echo "-A INPUT -p icmp --icmp-type echo-request -j LOG_PINGDEATH" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -o ! ppp+ -p icmp --icmp-type echo-request -j LOG_PINGDEATH" >> $IPTABLES_CONFIG_FILTER
# ソスソスソスMソスソスIPソスAソスhソスソスソスXソスソスLANソスlソスbソスgソスソスソス[ソスNソスヘ囲外ソスフアソスNソスZソスXソスヘソスソスOソスソスソスLソス^ソスソスソスト破ソスソス
# ソスソスIngressソスホ搾ソス
echo "-A LOG_INGRESS -j LOG --log-tcp-options --log-ip-options --log-prefix \"[IPTABLES INGRESS] : \"" >> $IPTABLES_CONFIG_FILTER
echo "-A LOG_INGRESS -j DROP" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -i $LAN -s ! $LOCALNET -j LOG_INGRESS" >> $IPTABLES_CONFIG_FILTER
# ソスソスソスzソスXソスgソスソスソスソスフアソスNソスZソスXソスソスソスソスソスラて具ソスソスソス
echo "-A INPUT -i lo -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
# LANソスソスソスソスフアソスNソスZソスXソスソスソスソスソスラて具ソスソスソス
echo "-A INPUT -i $LAN -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -i $LAN -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
# LANソスソスソスソスフイソスソスソス^ソス[ソスlソスbソスgソスヨの難ソスソスソスソスレ托ソスソスソスソスツ能ソスノゑソスソスソス
# ソスソスIP masquerade(NAPT)
WAN_INF=`ls /etc/sysconfig/network-scripts/ifcfg-*|sed -e 's/^.*ifcfg-\([^ ]*\).*$/\1/p' -e d|grep ppp`
for dev in $WAN_INF
do
echo "-A POSTROUTING -o $dev -j MASQUERADE" >> $IPTABLES_CONFIG_NAT
done
# LANソスソスソスソスsソスソスソスソスソスAソスNソスZソスXソスノ対ゑソスソスソスWANソスソスソスソスフ返難ソスソスAソスNソスZソスXソスソスソスソスソスソス
echo "-A INPUT -i ppp+ -m state --state ESTABLISHED,RELATED -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -i ppp+ -m state --state ESTABLISHED,RELATED -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
# DNSソスソスソスソスソスAソスNソスZソスXソスソスソスソスソスソス
echo "-A INPUT -p udp --sport 53 -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
# WANソスソスソスソスフ必ソス{ICMPソスpソスPソスbソスgソスソスソスソスソスソス
echo "-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A INPUT -p icmp --icmp-type source-quench -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -p icmp --icmp-type destination-unreachable -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -p icmp --icmp-type source-quench -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -p icmp --icmp-type time-exceeded -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -p icmp --icmp-type parameter-problem -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
# 113ソスヤポソス[ソスg(IDENT)ソスヨのアソスNソスZソスXソスノは具ソスソスロ会ソスソスソス
# ソスソスソスソスソス[ソスソスソスTソス[ソスoソスソスソスフソスソスXソス|ソスソスソスXソス瘟コソスhソス~
echo "-A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -p tcp --dport 113 -j REJECT --reject-with tcp-reset" >> $IPTABLES_CONFIG_FILTER
# ACCEPT_COUNTRY_MAKEソスヨ撰ソスソスソス`
# ソスwソス閧ウソス黷スソスソスソスソスIPソスAソスhソスソスソスXソスソスソスソスフアソスNソスZソスXソスソスソスソスソスツゑソスソス驛ソス[ソスUソスソス`ソス`ソスFソスCソスソスソス成
ACCEPT_COUNTRY_MAKE(){
for addr in `cat /tmp/cidr.txt|grep ^$1|awk '{print $2}'`
do
echo "-A ACCEPT_COUNTRY -s $addr -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
done
grep ^$1 $IP_LIST >> $CHK_IP_LIST
}
# DROP_COUNTRY_MAKEソスヨ撰ソスソスソス`
# ソスwソス閧ウソス黷スソスソスソスソスIPソスAソスhソスソスソスXソスソスソスソスフアソスNソスZソスXソスソスjソスソスソスソスソス驛ソス[ソスUソスソス`ソス`ソスFソスCソスソスソス成
DROP_COUNTRY_MAKE(){
for addr in `cat /tmp/cidr.txt|grep ^$1|awk '{print $2}'`
do
echo "-A DROP_COUNTRY -s $addr -m limit --limit 1/s -j LOG --log-prefix \"[IPTABLES DENY_COUNTRY] : \"" >> $IPTABLES_CONFIG_FILTER
echo "-A DROP_COUNTRY -s $addr -j DROP" >> $IPTABLES_CONFIG_FILTER
done
grep ^$1 $IP_LIST >> $CHK_IP_LIST
}
# IPソスAソスhソスソスソスXソスソスソスXソスgソス謫セ
IP_LIST=/tmp/cidr.txt
CHK_IP_LIST=/tmp/IPLIST
if [ ! -f $IP_LIST ]; then
wget -q http://nami.jp/ipv4bycc/cidr.txt.gz
gunzip -c cidr.txt.gz > $IP_LIST
rm -f cidr.txt.gz
fi
rm -f $CHK_IP_LIST
# ソスソスソス{ソスソスソスソスフアソスNソスZソスXソスソスソスソスソスツゑソスソス驛ソス[ソスUソスソス`ソス`ソスFソスCソスソスACCEPT_COUNTRYソス成
ACCEPT_COUNTRY_MAKE JP
# ソスネ降,ソスソスソス{ソスソスソスソスフみアソスNソスZソスXソスソスソスソスソスツゑソスソスソスソスソスソス鼾ソスソスACCEPTソスフゑソスソスソスソスソスACCEPT_COUNTRYソスソスソスwソス閧キソスソス
# ソスSソスソスソスxソス@ソス{ソスンへの攻ソスソスソスソスソスソスハ5ソスJソスソス(ソスソスソス{ソスEソスAソスソスソスソスソスJソスソスソスソスソスソス)ソスソスソスソスフアソスNソスZソスXソスソスソスソスソスOソスソスソスLソス^ソスソスソスト破ソスソス
# http://www.cyberpolice.go.jp/detect/observation.htmlソスソスソス
DROP_COUNTRY_MAKE CN
DROP_COUNTRY_MAKE CA
DROP_COUNTRY_MAKE IR
DROP_COUNTRY_MAKE NL
DROP_COUNTRY_MAKE TW
echo "-A INPUT -j DROP_COUNTRY" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -j DROP_COUNTRY" >> $IPTABLES_CONFIG_FILTER
#----------------------------------------------------------#
# ソスソスソスzソスXソスgソスソスソスeソスソスTソス[ソスrソスXソスソスソスソスソスJソスソスソスソス鼾ソスフ設抵ソス(ソスソスソスソスソスソスソスソス) #
#----------------------------------------------------------#
router_eq_server(){
# WANソスソスソスソスソス22ソスヤポソス[ソスg(SSH)ソスヨのアソスNソスZソスXソスソスソスソスソスソス
# ソスソスSSHソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A INPUT -i $WAN -p tcp --dport 22 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
# WANソスソスソスソスソスTCP/UDP53ソスヤポソス[ソスg(DNS)ソスヨのアソスNソスZソスXソスソスソスソスソスソス
# ソスソスWANソスソスソスソスDNSソスTソス[ソスoソス[ソスソスソス^ソスpソスソスソスソス鼾ソスフゑソス
echo "-A INPUT -i $WAN -p tcp --dport 53 -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A INPUT -i $WAN -p udp --dport 53 -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
# WANソスソスソスソスソス80ソスヤポソス[ソスg(HTTP)ソスヨのアソスNソスZソスXソスソスソスソスソスソス
# ソスソスWebソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A INPUT -i $WAN -p tcp --dport 80 -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
# WANソスソスソスソスソス443ソスヤポソス[ソスg(HTTPS)ソスヨのアソスNソスZソスXソスソスソスソスソスソス
# ソスソスWebソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A INPUT -i $WAN -p tcp --dport 443 -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
# WANソスソスソスソスソス21ソスヤポソス[ソスg(FTP)ソスヨのアソスNソスZソスXソスソスソスソスソスソス
# ソスソスFTPソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A INPUT -i $WAN -p tcp --dport 21 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
# WANソスソスソスソスソスPASVソスpソス|ソス[ソスg(FTP-DATA)ソスヨのアソスNソスZソスXソスソスソスソスソスソス
# ソスソスFTPソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
# ソスソスPASVソスpソス|ソス[ソスg60000:60030ソスヘ難ソスソスTソスCソスgソスフ設抵ソスソス
echo "-A INPUT -i $WAN -p tcp --dport 60000:60030 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
# WANソスソスソスソスソス25ソスヤポソス[ソスg(SMTP)ソスヨのアソスNソスZソスXソスソスソスソスソスソス
# ソスソスSMTPソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A INPUT -i $WAN -p tcp --dport 25 -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
# WANソスソスソスソスソス465ソスヤポソス[ソスg(SMTPS)ソスヨのアソスNソスZソスXソスソスソスソスソスソス
# ソスソスSMTPSソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A INPUT -i $WAN -p tcp --dport 465 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
# WANソスソスソスソスソス110ソスヤポソス[ソスg(POP3)ソスヨのアソスNソスZソスXソスソスソスソスソスソス
# ソスソスPOP3ソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A INPUT -i $WAN -p tcp --dport 110 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
# WANソスソスソスソスソス995ソスヤポソス[ソスg(POP3S)ソスヨのアソスNソスZソスXソスソスソスソスソスソス
# ソスソスPOP3SソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A INPUT -i $WAN -p tcp --dport 995 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
# WANソスソスソスソスソス143ソスヤポソス[ソスg(IMAP)ソスヨのアソスNソスZソスXソスソスソスソスソスソス
# ソスソスIMAPソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A INPUT -i $WAN -p tcp --dport 143 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
# WANソスソスソスソスソス993ソスヤポソス[ソスg(IMAPS)ソスヨのアソスNソスZソスXソスソスソスソスソスソス
# ソスソスIMAPSソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A INPUT -i $WAN -p tcp --dport 993 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
}
#----------------------------------------------------------#
# ソスソスソスzソスXソスgソスソスソスeソスソスTソス[ソスrソスXソスソスソスソスソスJソスソスソスソス鼾ソスフ設抵ソス(ソスソスソスソスソスワゑソス) #
#----------------------------------------------------------#
#----------------------------------------------------------#
# ソスソスソスzソスXソスgソスソスソスeソスソスTソス[ソスrソスXソスソスソスソスソスJソスソスソスソス鼾ソスフ設抵ソス(ソスソスソスソスソスソスソスソス) #
#----------------------------------------------------------#
router_ne_server(){
# WANソスソスソスソスフ鯉ソスソスJソスTソス[ソスoソス[ソスソス22ソスヤポソス[ソスg(SSH)ソスヨのアソスNソスZソスXソスソスソスソスソスソス&ソス]ソスソス
# ソスソスSSHソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A FORWARD -i $WAN -p tcp -d $SERVER --dport 22 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
echo "-A PREROUTING -i $WAN -p tcp --dport 22 -j DNAT --to $SERVER" >> $IPTABLES_CONFIG_NAT
# WANソスソスソスソスフ鯉ソスソスJソスTソス[ソスoソス[ソスソスTCP/UDP53ソスヤポソス[ソスg(DNS)ソスヨのアソスNソスZソスXソスソスソスソスソスソス&ソス]ソスソス
# ソスソスWANソスソスソスソスDNSソスTソス[ソスoソス[ソスソスソス^ソスpソスソスソスソス鼾ソスフゑソス
echo "-A FORWARD -i $WAN -p tcp -d $SERVER --dport 53 -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A PREROUTING -i $WAN -p tcp --dport 53 -j DNAT --to $SERVER" >> $IPTABLES_CONFIG_NAT
echo "-A FORWARD -i $WAN -p udp -d $SERVER --dport 53 -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A PREROUTING -i $WAN -p udp --dport 53 -j DNAT --to $SERVER" >> $IPTABLES_CONFIG_NAT
# WANソスソスソスソスフ鯉ソスソスJソスTソス[ソスoソス[ソスソス80ソスヤポソス[ソスg(HTTP)ソスヨのアソスNソスZソスXソスソスソスソスソスソス&ソス]ソスソス
# ソスソスWebソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A FORWARD -i $WAN -p tcp -d $SERVER --dport 80 -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A PREROUTING -i $WAN -p tcp --dport 80 -j DNAT --to $SERVER" >> $IPTABLES_CONFIG_NAT
# WANソスソスソスソスフ鯉ソスソスJソスTソス[ソスoソス[ソスソス443ソスヤポソス[ソスg(HTTPS)ソスヨのアソスNソスZソスXソスソスソスソスソスソス&ソス]ソスソス
# ソスソスWebソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A FORWARD -i $WAN -p tcp -d $SERVER --dport 443 -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A PREROUTING -i $WAN -p tcp --dport 443 -j DNAT --to $SERVER" >> $IPTABLES_CONFIG_NAT
# WANソスソスソスソスフ鯉ソスソスJソスTソス[ソスoソス[ソスソス21ソスヤポソス[ソスg(FTP)ソスヨのアソスNソスZソスXソスソスソスソスソスソス&ソス]ソスソス
# ソスソスFTPソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A FORWARD -i $WAN -p tcp -d $SERVER --dport 21 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
echo "-A PREROUTING -i $WAN -p tcp --dport 21 -j DNAT --to $SERVER" >> $IPTABLES_CONFIG_NAT
# WANソスソスソスソスフ鯉ソスソスJソスTソス[ソスoソス[ソスソスPASVソスpソス|ソス[ソスg(FTP-DATA)ソスヨのアソスNソスZソスXソスソスソスソスソスソス&ソス]ソスソス
# ソスソスFTPソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
# ソスソスPASVソスpソス|ソス[ソスg60000:60030ソスヘ難ソスソスTソスCソスgソスフ設抵ソスソス
echo "-A FORWARD -i $WAN -p tcp -d $SERVER --dport 60000:60030 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
echo "-A PREROUTING -i $WAN -p tcp --dport 60000:60030 -j DNAT --to $SERVER" >> $IPTABLES_CONFIG_NAT
# WANソスソスソスソスフ鯉ソスソスJソスTソス[ソスoソス[ソスソス25ソスヤポソス[ソスg(SMTP)ソスヨのアソスNソスZソスXソスソスソスソスソスソス&ソス]ソスソス
# ソスソスSMTPソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A FORWARD -i $WAN -p tcp -d $SERVER --dport 25 -j ACCEPT" >> $IPTABLES_CONFIG_FILTER
echo "-A PREROUTING -i $WAN -p tcp --dport 25 -j DNAT --to $SERVER" >> $IPTABLES_CONFIG_NAT
# WANソスソスソスソスフ鯉ソスソスJソスTソス[ソスoソス[ソスソス465ソスヤポソス[ソスg(SMTPS)ソスヨのアソスNソスZソスXソスソスソスソスソスソス&ソス]ソスソス
# ソスソスSMTPSソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A FORWARD -i $WAN -p tcp -d $SERVER --dport 465 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
echo "-A PREROUTING -i $WAN -p tcp --dport 465 -j DNAT --to $SERVER" >> $IPTABLES_CONFIG_NAT
# WANソスソスソスソスフ鯉ソスソスJソスTソス[ソスoソス[ソスソス110ソスヤポソス[ソスg(POP3)ソスヨのアソスNソスZソスXソスソスソスソスソスソス&ソス]ソスソス
# ソスソスPOP3ソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A FORWARD -i $WAN -p tcp -d $SERVER --dport 110 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
echo "-A PREROUTING -i $WAN -p tcp --dport 110 -j DNAT --to $SERVER" >> $IPTABLES_CONFIG_NAT
# WANソスソスソスソスフ鯉ソスソスJソスTソス[ソスoソス[ソスソス995ソスヤポソス[ソスg(POP3S)ソスヨのアソスNソスZソスXソスソスソスソスソスソス&ソス]ソスソス
# ソスソスPOP3SソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A FORWARD -i $WAN -p tcp -d $SERVER --dport 995 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
echo "-A PREROUTING -i $WAN -p tcp --dport 995 -j DNAT --to $SERVER" >> $IPTABLES_CONFIG_NAT
# WANソスソスソスソスフ鯉ソスソスJソスTソス[ソスoソス[ソスソス143ソスヤポソス[ソスg(IMAP)ソスヨのアソスNソスZソスXソスソスソスソスソスソス&ソス]ソスソス
# ソスソスIMAPソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A FORWARD -i $WAN -p tcp -d $SERVER --dport 143 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
echo "-A PREROUTING -i $WAN -p tcp --dport 143 -j DNAT --to $SERVER" >> $IPTABLES_CONFIG_NAT
# WANソスソスソスソスフ鯉ソスソスJソスTソス[ソスoソス[ソスソス993ソスヤポソス[ソスg(IMAPS)ソスヨのアソスNソスZソスXソスソスソスソスソスソス&ソス]ソスソス
# ソスソスIMAPSソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A FORWARD -i $WAN -p tcp -d $SERVER --dport 993 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
echo "-A PREROUTING -i $WAN -p tcp --dport 993 -j DNAT --to $SERVER" >> $IPTABLES_CONFIG_NAT
# WANソスソスソスソスフ鯉ソスソスJソスTソス[ソスoソス[ソスソスUDP1194ソスヤポソス[ソスg(OpenVPN)ソスヨのアソスNソスZソスXソスソスソスソスソスソス&ソス]ソスソス
# ソスソスOpenVPNソスTソス[ソスoソス[ソスソスソスソスソスJソスソスソスソス鼾ソスフゑソス
echo "-A FORWARD -i $WAN -p udp -d $SERVER --dport 1194 -j ACCEPT_COUNTRY" >> $IPTABLES_CONFIG_FILTER
echo "-A PREROUTING -i $WAN -p udp --dport 1194 -j DNAT --to $SERVER" >> $IPTABLES_CONFIG_NAT
}
#----------------------------------------------------------#
# ソスソスソスzソスXソスgソスソスソスeソスソスTソス[ソスrソスXソスソスソスソスソスJソスソスソスソス鼾ソスフ設抵ソス(ソスソスソスソスソスワゑソス) #
#----------------------------------------------------------#
# ソスソスソスソスIPソスAソスhソスソスソスXソスソスソスソスフアソスNソスZソスXソスヘソスソスOソスソスソスLソス^ソスソスソスソスソスノ破ソスソス
# ソスソスソスソスソスソスIPソスAソスhソスソスソスXソスソス/root/deny_ipソスソス1ソスsソスソスソスニに記ソスqソスソスソストゑソスソスソスソスソスソスソス
# (/root/deny_ipソスソスソスネゑソスソスソスホなにゑソスソスソスソスネゑソス)
if [ -s /root/deny_ip ]; then
for ip in `cat /root/deny_ip`
do
echo "-I INPUT -s $ip -j DROP" >> $IPTABLES_CONFIG_FILTER
done
fi
# ソスソスソスJソスTソス[ソスoソス[ソスソスソスソスソスzソスXソスgソスフ場合ソスフソスソス[ソスソスソスン抵ソスソスソスsソスソス
[ "$SERVER" = "$IPADDR" ] || [ $SERVER = 127.0.0.1 ] && router_eq_server
# ソスソスソスJソスTソス[ソスoソス[ソスソスソスソスソスzソスXソスgソスフ場合ソスフソスソス[ソスソスソスン抵ソスソスソスsソスソス
[ "$SERVER" != "$IPADDR" ] && [ $SERVER != 127.0.0.1 ] && router_ne_server
# ソスソスLソスフソスソス[ソスソスソスノマソスbソス`ソスソスソスネゑソスソスソスソスソスソスAソスNソスZソスXソスヘソスソスOソスソスソスLソス^ソスソスソスト破ソスソス
echo "-A INPUT -j LOG --log-tcp-options --log-ip-options --log-prefix \"[IPTABLES INPUT] : \"" >> $IPTABLES_CONFIG_FILTER
echo "-A INPUT -j DROP" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -j LOG --log-tcp-options --log-ip-options --log-prefix \"[IPTABLES FORWARD] : \"" >> $IPTABLES_CONFIG_FILTER
echo "-A FORWARD -j DROP" >> $IPTABLES_CONFIG_FILTER
# ソスtソス@ソスCソスAソスEソスHソス[ソスソスソスNソスソス
echo "COMMIT" >> $IPTABLES_CONFIG_NAT
echo "COMMIT" >> $IPTABLES_CONFIG_FILTER
cat $IPTABLES_CONFIG_NAT $IPTABLES_CONFIG_FILTER > /etc/sysconfig/iptables
if [ -f /usr/libexec/iptables/iptables.init ]; then
/usr/libexec/iptables/iptables.init restart
else
/etc/rc.d/init.d/iptables restart
fi
rm -f $IPTABLES_CONFIG_NAT $IPTABLES_CONFIG_FILTER
# ソスpソスPソスbソスgソス]ソスソスソスJソスn
sysctl -w net.ipv4.ip_forward=1 > /dev/null
sed -i '/net.ipv4.ip_forward/d' /etc/sysctl.conf
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
[root@centos ~]# chmod 700 iptables-router.shソス@ソスソスソス@iptablesソスン抵ソスXソスNソスソスソスvソスgソスヨ趣ソスソスsソスソスソスソスソスtソスソス
[root@centos ~]# ./iptables-router.shソス@ソスソスソス@iptablesソスン抵ソスXソスNソスソスソスvソスgソスソスソスs
ソスtソス@ソスCソスAソスEソスHソス[ソスソスソスソスソス[ソスソスソスソスKソスpソスソス: [ OK ]
ソス`ソスFソスCソスソスソス|ソスソスソスVソス[ソスソス ACCEPT ソスノ設定中filter nat [ OK ]
iptables ソスソスソスWソスソスソス[ソスソスソスソスソスソスソスOソスソスソスソス [ OK ]
ソスtソス@ソスCソスAソスEソスHソス[ソスソスソスフソスソス[ソスソスソスソス /etc/sysconfig/iptables ソスノ保托ソスソスソス[ OK ]
ソスtソス@ソスCソスAソスEソスHソス[ソスソスソスソスソス[ソスソスソスソスKソスpソスソス: [ OK ]
ソス`ソスFソスCソスソスソス|ソスソスソスVソス[ソスソス ACCEPT ソスノ設定中nat filter [ OK ]
iptables ソスソスソスWソスソスソス[ソスソスソスソスソスソスソスOソスソスソスソス [ OK ]
iptables ソスtソス@ソスCソスAソスEソスHソス[ソスソスソスソスソス[ソスソスソスソスKソスpソスソス: [ OK ]
iptables ソスソスソスWソスソスソス[ソスソスソスソスヌみ搾ソスソスン抵ソスip_conntrack_ftp ip_nat_ftp [ OK ]
|
|