From: cout at domain eircom.net
Date: Thu 27 Jun 2002 - 07:23:36 IST
iptables -F
##nuke that syn flood iptables -N syn-flood iptables -A INPUT -s ! 10.0.0.0/24 -p tcp --syn -j syn-flood
iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
iptables -A syn-flood -j DROP
#nuke any tcp connection that is not a syn
iptables -A INPUT -s ! 10.0.0.0/24 -p tcp ! --syn -m state --state NEW -j DROP
#
iptables -A INPUT -s ! 10.0.0.0/24 -p tcp --dport 139 -m state --state NEW -j DROP
iptables -A INPUT -s ! 10.0.0.0/24 -p tcp --dport 139 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -s 10.0.0.0/24 -d ! 10.0.0.0/24 -p tcp --dport 139 -m state --state NEW,ESTABLISHED -j ACCEPT
#http
iptables -A INPUT -s ! 10.0.0.0/24 -p tcp --dport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -s 10.0.0.0/24 -d ! 10.0.0.0/24 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
#ftp
iptables -A INPUT -s ! 10.0.0.0/24 -p tcp --dport 21 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -s 10.0.0.0/24 -d ! 10.0.0.0/24 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
#irc
iptables -A INPUT -s ! 10.0.0.0/24 -p tcp --dport 194 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -s 10.0.0.0/24 -d ! 10.0.0.0/24 -p tcp --dport 194 -m state --state NEW,ESTABLISHED -j ACCEPT
#allow dns
iptables -A INPUT -s ! 10.0.0.0/24 -p udp --dport 53 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -s 10.0.0.0/24 -d ! 10.0.0.0/24 -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
#outgoing ssh
iptables -A INPUT -s ! 10.0.0.0/24 -p tcp --dport 22 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -s 10.0.0.0/24 -d ! 10.0.0.0/24 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
#telnet out
iptables -A INPUT -s ! 10.0.0.0/24 -p tcp --dport 23 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -s 10.0.0.0/24 -d ! 10.0.0.0/24 -p tcp --dport 23 -m state --state NEW,ESTABLISHED -j ACCEPT
#smtp
iptables -t nat -A PREROUTING -s ! 192.168.0.0/24 -d 192.168.0.0/24 -p tcp --dport 22 -j DNAT --to 10.0.0.2
iptables -A FORWARD -i eth0 iptables -A FORWARD -i eth1
iptables -A FORWARD -o eth0 iptables -A FORWARD -o eth1
iptables -A INPUT -s ! 10.0.0.0/24 -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -s 10.0.0.0/24 -d ! 10.0.0.0/24 -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
#nameserver out
iptables -t filter -A INPUT -s ! 10.0.0.0/24 -p tcp --dport 42 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -s 10.0.0.0/24 -d ! 10.0.0.0/24 -p tcp --dport 42 -m state --state NEW,ESTABLISHED -j ACCEPT
#masquerading
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -d ! 10.0.0.0/24 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -d 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -s ! 10.0.0.0/24 -d 10.0.0.0/24 -p icmp -j LOG
#icmp
iptables -A INPUT -s ! 10.0.0.0/24 -d 10.0.0.0/24 -p icmp -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p icmp -s 10.0.0.0/24 -d ! 10.0.0.0/24 -m state --state NEW,ESTABLISHED -j ACCEPT
#drop
iptables -A INPUT -p tcp -s ! 10.0.0.0/24 -m state --state NEW -j LOG
iptables -A INPUT -p tcp -s ! 10.0.0.0/24 -m state --state NEW -j DROP
iptables -A INPUT -p udp -s ! 10.0.0.0/24 -m state --state NEW -j LOG
iptables -A INPUT -p udp -s ! 10.0.0.0/24 -m state --state NEW -j DROP
Righteo I need to figure out how to forward port 25 to 10.0.0.2 from eth1 call eth1's ip 192.168.0.1 for argument's sake and eth0's 10.0.0.33.
Can someone please tell me how the the hell I do this?
Brian
This archive was generated by hypermail 2.1.6 : Thu 06 Feb 2003 - 13:17:34 GMT