由 下流砥柱 在 12-12-2003 15:24 发表:
【求助】一个iptables脚本，做ftp端口映射，请大家帮忙看看！
这个脚本做ftp端口影射之后，内网那台提供ftp服务的机器，看到的IP都是网关上的内网IP，这样一旦做了IP线程设置之后，就麻烦了，每个外部连接，对这台ftp服务器而言都看成了同一个IP(内网网关的IP)，这个脚本怎么回事？先谢谢了。。。
>
> 源码:
>
> * * *
>
>
> >
> SYSCTL="/sbin/sysctl -w"
> >
>
> >
> IPT="/sbin/iptables"
> >
> IPTS="/sbin/iptables-save"
> >
> IPTR="/sbin/iptables-restore"
> >
>
> >
> INET_IFACE="eth1"
> >
> INET_ADDRESS="61.xxx.xxx.xxx"
> >
>
> >
> LOCAL_IFACE="eth0"
> >
> LOCAL_IP="172.16.1.2"
> >
> LOCAL_NET="172.16.1.0/24"
> >
> LOCAL_BCAST="172.16.1.255"
> >
>
> >
> LO_IFACE="lo"
> >
> LO_IP="127.0.0.1"
> >
>
> >
> if [ "$1" = "save" ]
> >
> then
> >
> echo -n "Saving firewall to /etc/sysconfig/iptables ... "
> >
> $IPTS > /etc/sysconfig/iptables
> >
> echo "done"
> >
> exit 0
> >
> elif [ "$1" = "restore" ]
> >
> then
> >
> echo -n "Restoring firewall from /etc/sysconfig/iptables ... "
> >
> $IPTR < /etc/sysconfig/iptables
> >
> echo "done"
> >
> exit 0
> >
> fi
> >
>
> >
> echo "Loading kernel modules ..."
> >
>
> >
> /sbin/modprobe ip_tables
> >
>
> >
> /sbin/modprobe ip_conntrack fxp=1
> >
>
> >
> /sbin/modprobe ipt_MASQUERADE
> >
>
> >
> /sbin/modprobe ip_nat_ftp
> >
>
> >
> /sbin/modprobe iptable_nat
> >
>
> >
> #allow poptop vpn clien in modules ^_^
> >
> /sbin/modprobe ppp_mppe
> >
>
> >
> /sbin/modprobe ip_conntrack_ftp
> >
>
> >
> /sbin/modprobe ip_conntrack_irc
> >
>
> >
> if [ "$SYSCTL" = "" ]
> >
> then
> >
> echo "1" > /proc/sys/net/ipv4/ip_forward
> >
> else
> >
> $SYSCTL net.ipv4.ip_forward="1"
> >
> fi
> >
>
> >
> if [ "$SYSCTL" = "" ]
> >
> then
> >
> echo "1" > /proc/sys/net/ipv4/tcp_syncookies
> >
> else
> >
> $SYSCTL net.ipv4.tcp_syncookies="1"
> >
> fi
> >
>
> >
> if [ "$SYSCTL" = "" ]
> >
> then
> >
> echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
> >
> else
> >
> $SYSCTL net.ipv4.conf.all.rp_filter="1"
> >
> fi
> >
>
> >
> if [ "$SYSCTL" = "" ]
> >
> then
> >
> echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
> >
> else
> >
> $SYSCTL net.ipv4.icmp_echo_ignore_broadcasts="1"
> >
> fi
> >
>
> >
> if [ "$SYSCTL" = "" ]
> >
> then
> >
> echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
> >
> else
> >
> $SYSCTL net.ipv4.conf.all.accept_source_route="0"
> >
> fi
> >
>
> >
> if [ "$SYSCTL" = "" ]
> >
> then
> >
> echo "1" > /proc/sys/net/ipv4/conf/all/secure_redirects
> >
> else
> >
> $SYSCTL net.ipv4.conf.all.secure_redirects="1"
> >
> fi
> >
>
> >
> if [ "$SYSCTL" = "" ]
> >
> then
> >
> echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
> >
> else
> >
> $SYSCTL net.ipv4.conf.all.log_martians="1"
> >
> fi
> >
>
> >
>
> >
> echo "Flushing Tables ..."
> >
>
> >
> $IPT -P INPUT ACCEPT
> >
> $IPT -P FORWARD ACCEPT
> >
> $IPT -P OUTPUT ACCEPT
> >
> $IPT -t nat -P PREROUTING ACCEPT
> >
> $IPT -t nat -P POSTROUTING ACCEPT
> >
> $IPT -t nat -P OUTPUT ACCEPT
> >
> $IPT -t mangle -P PREROUTING ACCEPT
> >
> $IPT -t mangle -P OUTPUT ACCEPT
> >
>
> >
> $IPT -F
> >
> $IPT -t nat -F
> >
> $IPT -t mangle -F
> >
>
> >
> $IPT -X
> >
> $IPT -t nat -X
> >
> $IPT -t mangle -X
> >
>
> >
> if [ "$1" = "stop" ]
> >
> then
> >
> echo "Firewall completely flushed! Now running with no firewall."
> >
> exit 0
> >
> fi
> >
>
> >
> $IPT -P OUTPUT DROP
> >
> $IPT -P FORWARD DROP
> >
>
> >
> echo "Create and populate custom rule chains ..."
> >
>
> >
> $IPT -N bad_packets
> >
>
> >
> $IPT -N bad_tcp_packets
> >
>
> >
> $IPT -N icmp_packets
> >
>
> >
> $IPT -N udp_inbound
> >
>
> >
> $IPT -N udp_outbound
> >
>
> >
> $IPT -N tcp_inbound
> >
>
> >
> $IPT -N tcp_outbound
> >
>
> >
>
> >
> $IPT -A bad_packets -p ALL -m state --state INVALID -j LOG \
> >
> --log-prefix "fp=bad_packets:1 a=DROP "
> >
>
> >
> $IPT -A bad_packets -p ALL -m state --state INVALID -j DROP
> >
>
> >
> $IPT -A bad_packets -p tcp -j bad_tcp_packets
> >
>
> >
> $IPT -A bad_packets -p ALL -j RETURN
> >
>
> >
> $IPT -A bad_tcp_packets -p tcp -i $LOCAL_IFACE -j RETURN
> >
>
> >
> $IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \
> >
> --log-prefix "fp=bad_tcp_packets:1 a=DROP "
> >
> $IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
> >
>
> >
> $IPT -A bad_tcp_packets -p tcp -j RETURN
> >
>
> >
> $IPT -A icmp_packets --fragment -p ICMP -j LOG \
> >
> --log-prefix "fp=icmp_packets:1 a=DROP "
> >
> $IPT -A icmp_packets --fragment -p ICMP -j DROP
> >
>
> >
> $IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
> >
>
> >
> $IPT -A icmp_packets -p ICMP -j RETURN
> >
>
> >
> $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 137 -j DROP
> >
> $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 138 -j DROP
> >
>
> >
> $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 113 -j REJECT
> >
>
> >
> $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 53 -j ACCEPT
> >
>
> >
> $IPT -A udp_inbound -p UDP -s 0/0 --source-port 67 --destination-port 68 \
> >
> -j ACCEPT
> >
>
> >
> $IPT -A udp_inbound -p UDP -j RETURN
> >
>
> >
> $IPT -A udp_outbound -p UDP -s 0/0 -j ACCEPT
> >
>
> >
> $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 113 -j REJECT
> >
>
> >
> $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 80 -j ACCEPT
> >
> $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 8080 -j ACCEPT
> >
>
> >
> $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 21 -j ACCEPT
> >
>
> >
> $IPT -A tcp_inbound -p TCP -s 0/0 --source-port 20 -j ACCEPT
> >
>
> >
> $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 62000:64000 -j ACCEPT
> >
>
> >
> $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 25 -j ACCEPT
> >
>
> >
> $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 110 -j ACCEPT
> >
>
> >
> $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 143 -j ACCEPT
> >
>
> >
> $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 22 -j ACCEPT
> >
>
> >
>
> >
> $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 5000:5100 -j ACCEPT
> >
>
> >
> $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 6891:6900 -j ACCEPT
> >
>
> >
> $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 1723 -j ACCEPT
> >
>
> >
> $IPT -A tcp_inbound -p TCP -j RETURN
> >
>
> >
> $IPT -A tcp_outbound -p TCP -s 0/0 -j ACCEPT
> >
>
> >
> echo "Process INPUT chain ..."
> >
>
> >
> $IPT -A INPUT -p ALL -i $LO_IFACE -j ACCEPT
> >
>
> >
> $IPT -A INPUT -p ALL -j bad_packets
> >
>
> >
> $IPT -A INPUT -p ALL -d 224.0.0.1 -j DROP
> >
>
> >
> $IPT -A INPUT -p ALL -i $LOCAL_IFACE -s $LOCAL_NET -j ACCEPT
> >
> $IPT -A INPUT -p ALL -i $LOCAL_IFACE -d $LOCAL_BCAST -j ACCEPT
> >
>
> >
> $IPT -A INPUT -p UDP -i $LOCAL_IFACE --source-port 68 --destination-port 67 \
> >
> -j ACCEPT
> >
>
> >
>
> >
> $IPT -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
> >
> -j ACCEPT
> >
>
> >
> $IPT -A INPUT -p TCP -i $INET_IFACE -j tcp_inbound
> >
> $IPT -A INPUT -p UDP -i $INET_IFACE -j udp_inbound
> >
> $IPT -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
> >
>
> >
> $IPT -A INPUT -p ALL -d 255.255.255.255 -j DROP
> >
>
> >
> $IPT -A INPUT -j LOG --log-prefix "fp=INPUT:99 a=DROP "
> >
>
> >
>
> >
> echo "Process FORWARD chain ..."
> >
>
> >
>
> >
> $IPT -A FORWARD -p ALL -j bad_packets
> >
>
> >
> $IPT -A FORWARD -p tcp -i $LOCAL_IFACE -j tcp_outbound
> >
>
> >
> $IPT -A FORWARD -p udp -i $LOCAL_IFACE -j udp_outbound
> >
>
> >
> $IPT -A FORWARD -p ALL -i $LOCAL_IFACE -j AC