Firewall - CVP-bare: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
No edit summary |
||
| (One intermediate revision by one other user not shown) | |||
| Line 1: | Line 1: | ||
<pre> | <pre> | ||
#!/bin/sh | #!/bin/sh | ||
| Line 6: | Line 4: | ||
IPT=/sbin/iptables | IPT=/sbin/iptables | ||
IP0= | IP0=xxx | ||
IP1= | IP1=xxx | ||
IP2=xxx | IP2=xxx | ||
IP3=xxx | IP3=xxx | ||
| Line 18: | Line 16: | ||
# Webmin + ssh | # Webmin + ssh | ||
$IPT -A INPUT -m state --state NEW -s | $IPT -A INPUT -m state --state NEW -s xxx-p tcp --dport 22 -j ACCEPT | ||
$IPT -A INPUT -m state --state NEW -s | $IPT -A INPUT -m state --state NEW -s xxx -p tcp --dport 10000 -j ACCEPT | ||
## Forward af mailserver via IP2 | ## Forward af mailserver via IP2 På mailserveren oprettes en virtuel interface, der lytter på/til det net, hvor | ||
$IPT -t nat -A PREROUTING -p tcp -d $IP2 --dport 25 -j DNAT --to-destination xxx:25 | $IPT -t nat -A PREROUTING -p tcp -d $IP2 --dport 25 -j DNAT --to-destination xxx:25 | ||
Latest revision as of 19:46, 12 March 2011
#!/bin/sh # eth0 er ydersiden (default GW), eth1 er extra yderside fra 3 (.91), eth2 er TDC gammel yderside, eth3 er indersiden IPT=/sbin/iptables IP0=xxx IP1=xxx IP2=xxx IP3=xxx # Tillad ping af firewall $IPT -A FORWARD -p icmp --icmp-type echo-request -j ACCEPT # Tillad ping gennem firewall $IPT -A INPUT -p icmp --icmp-type echo-request -j ACCEPT # Webmin + ssh $IPT -A INPUT -m state --state NEW -s xxx-p tcp --dport 22 -j ACCEPT $IPT -A INPUT -m state --state NEW -s xxx -p tcp --dport 10000 -j ACCEPT ## Forward af mailserver via IP2 På mailserveren oprettes en virtuel interface, der lytter på/til det net, hvor $IPT -t nat -A PREROUTING -p tcp -d $IP2 --dport 25 -j DNAT --to-destination xxx:25 ## Forward af port 10001 til filserver 10000 $IPT -t nat -A PREROUTING -p tcp --dport 10001 -j DNAT --to-destination xxx:10000 ## Nat den nye net kun via IP1 $IPT -t nat -A POSTROUTING -s xxx/32 -j MASQUERADE ## Tillad new, established, related $IPT -A FORWARD -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT