由 agerlet 在 02-10-2004 22:25 发表:

ftp用被动模式，iptables作代理应该怎么写？

敬爱的版主先生，

ftp用被动模式，iptables作NAT的时候应该怎么写才会比较安全？如果把TCP的所有端口都开着好像很危险的。我找过一些帖子，但好像都没有很好的解决这个问题。

先谢谢了。

由大熊宝宝在 02-10-2004 22:56 发表:

nat_ftp

conntarck_nat_ftp

会协调的不需要开放端口只要开21就可以了

请兄弟们正确发贴,把问题发到相关版块发贴标题请简明扼要谢谢大家配合.

新会员发贴前请学会搜索论坛有可能你的问题已经有答案了

由 agerlet 在 02-11-2004 08:20 发表:

我的脚本是这样写的，可是就是不能连。我只得加了passive FTP那一段。请教版主怎么样写才好呢？谢谢

#!/bin/sh

firewall starting firewall

Serial: 2004021020

clear

echo "Staring iptables testing..."

echo "Setting refers..."

INNER_NET=192.168.1.0/24

FWALL_IP=172.16.92.128

INNER_PORT=eth0

OUTER_PORT=eth1

IPT="/sbin/iptables"

MODPROBE="/sbin/modprobe"

echo "Loading modules..."

$MODPROBE ip_tables

$MODPROBE iptable_filter

$MODPROBE ip_conntrack

$MODPROBE iptable_nat

$MODPROBE ip_nat_ftp

$MODPROBE ip_conntrack_ftp

$MODPROBE ipt_state

$MODPROBE ipt_MASQUERADE

$MODPROBE ipt_LOG

$MODPROBE ipt_REJECT

$MODPROBE ipt_limit

echo "Enable the functions..."

premit ip masquerade

echo 1 > /proc/sys/net/ipv4/ip_forward

reject ping broadcast

echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

check source ip

for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f; done

record impossible ip

for f in /proc/sys/net/ipv4/conf/*/log_martians; do echo "1" > $f; done

reject ICMP redirect message

for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 1 > $f; done

echo "Make all chaines DROP"

$IPT -P INPUT DROP

$IPT -P OUTPUT DROP

$IPT -P FORWARD DROP

$IPT -F

$IPT -F -t nat

$IPT -X

echo "Enabling NAT..."

$IPT -A FORWARD -o $OUTER_PORT -s $FWALL_IP -j ACCEPT

$IPT -A FORWARD -d $FWALL_IP -j ACCEPT

$IPT -t nat -A POSTROUTING -o $OUTER_PORT -s $INNER_NET -j MASQUERADE

$IPT -A FORWARD -i $INNER_PORT -o $OUTER_PORT -s $INNER_NET -j ACCEPT

$IPT -A FORWARD -d $INNER_NET -j ACCEPT

echo "Allow Outer_net connect localhost by firewall-ip."

$IPT -A INPUT -i $OUTER_PORT -p ICMP ! --icmp-type 8 -j ACCEPT

$IPT -A INPUT -i $INNER_PORT -p ICMP -j ACCEPT

$IPT -A INPUT -i lo -s $INNER_NET -j ACCEPT

$IPT -A INPUT -i $INNER_PORT -d $INNER_NET -j ACCEPT

$IPT -A INPUT -i $OUTER_PORT -p ICMP -j LOG --log-prefix "BAD INPUT PACKAGES:"

echo "Allow to connect outer_net."

$IPT -A OUTPUT -o $OUTER_PORT -s localhost -j ACCEPT

$IPT -A OUTPUT -d $INNER_NET -p ICMP -j ACCEPT

$IPT -A OUTPUT -s $FWALL_IP -p ICMP -j ACCEPT

$IPT -A OUTPUT -o $OUTER_PORT -d $INNER_NET -j ACCEPT

echo "Open TCP connection for this server to other server on the internet."

$IPT -A OUTPUT -o $OUTER_PORT -p tcp -d any/0 --dport 0:1024 -s $FWALL_IP -j ACCEPT

$IPT -A INPUT -i $OUTER_PORT -p tcp ! --syn -s any/0 --sport 0:1024 -d $FWALL_IP -j ACCEPT

echo "Open UDP connection for this server to other server on the internet."

$IPT -A OUTPUT -o $OUTER_PORT -p udp -d any/0 --dport 0:1024 -s $FWALL_IP -j ACCEPT

$IPT -A INPUT -i $OUTER_PORT -p udp -s any/0 --sport 0:1024 -d $FWALL_IP -j ACCEPT

echo "Allow passive mode FTP." #It's too dangers, but I have no idea.

$IPT -A OUTPUT -o $OUTER_PORT -p tcp -s $FWALL_IP --sport 1024:65535 -d any/0 --dport 1024:65535 -j ACCEPT

$IPT -A INPUT -i $OUTER_PORT -p tcp ! --syn -s any/0 --sport 1024:65535 -d $FWALL_IP --dport 1024:65535 -j ACCEPT

echo "Loading limits of ping..."

$IPT -A INPUT -m limit --limit 10/m --limit-burst 10 -p ICMP -j LOG --log-prefix "Ping packet died: "

echo

echo " ********** Congratulations! It works now! **********"

echo

ech