also hier meine regeln für http ftp smtp , directx games auf zone.com
nur leider kann keiner mein Http server (auch auf dem rechner wo firewall ist) nicht sehen
meine adresse ist http://abc-xyz.dyndns.org/
please help ... ich weiss nicht warum ...
#!/bin/bash
case "$1" in
start)
echo "START FIREWALLING"
#firewallscript
modprobe ip_tables
modprobe ip_conntrack
modprobe ip_conntrack_irc
modprobe ip_conntrack_ftp
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle -X
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
#reject chain
iptables -N MY_REJECT
iptables -A MY_REJECT -p tcp -m limit --limit 7200/h -j LOG --log-prefix "REJECT TCP "
iptables -A MY_REJECT -p tcp -j REJECT --reject-with tcp-reset
iptables -A MY_REJECT -p udp -m limit --limit 7200/h -j LOG --log-prefix "REJECT UDP "
iptables -A MY_REJECT -p udp -j REJECT --reject-with icmp-port-unreachable
iptables -A MY_REJECT -p icmp -m limit --limit 7200/h -j LOG --log-prefix "DROP ICMP "
iptables -A MY_REJECT -p icmp -j DROP
iptables -A MY_REJECT -j REJECT --reject-with icmp-port-unreachable
#drop chain
iptables -N MY_DROP
iptables -A MY_DROP -m limit --limit 7200/h -j LOG --log-prefix "PORTSCAN DROP "
iptables -A MY_DROP -j DROP
#protokoll verworfener
iptables -A INPUT -m state --state INVALID -m limit --limit 7200/h -j LOG --log-prefix "INPUT INVALID"
iptables -A OUTPUT -m state --state INVALID -m limit --limit 7200/h -j LOG --log-prefix "OUTPUT INVALID"
iptables -A FORWARD -m state --state INVALID -m limit --limit 7200/h -j LOG --log-prefix "FORWARD INVALID"
#korupte zurueckweisen
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state INVALID -j DROP
#stealth scann dropen
#keine flags gesetzt
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j MY_DROP
iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j MY_DROP
#syn und fin
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j MY_DROP
iptables -A FORWARD -p tcp --tcp-flags SYN,FIN SYN,FIN -j MY_DROP
#syn und rst
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j MY_DROP
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j MY_DROP
#fin und rst
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j MY_DROP
iptables -A FORWARD -p tcp --tcp-flags FIN,RST FIN,RST -j MY_DROP
#fin ohne ack
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j MY_DROP
iptables -A FORWARD -p tcp --tcp-flags ACK,FIN FIN -j MY_DROP
#psh ohne ack
iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j MY_DROP
iptables -A FORWARD -p tcp --tcp-flags ACK,PSH PSH -j MY_DROP
#urg ohne ack
iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j MY_DROP
iptables -A FORWARD -p tcp --tcp-flags ACK,URG URG -j MY_DROP
#loopback interface zulassen
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
#connection tracking acktivieren
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i ! ppp0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#smtp
iptables -A INPUT -i ppp0 -m state --state NEW -p tcp --dport 25 -j ACCEPT
#DNS
iptables -A INPUT -i ppp0 -m state --state NEW -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -i ppp0 -m state --state NEW -p udp --dport 53 -j ACCEPT
#http
iptables -A INPUT -i ppp0 -m state --state NEW -p tcp --dport 80 -j ACCEPT
#pop3
iptables -A INPUT -i ppp0 -m state --state NEW -p tcp --dport 110 -j ACCEPT
######################### N A T ######################
#IP LAN ermitteln
#LAN_IP=$(ifconfig eth1 | head -n 2 | tail -n 1 | cut -d -f2 | cut -d " " -f1)
LAN_IP=192.168.1.21
#NAT f|r ftp
modprobe ip_nat_ftp
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 21 -j DNAT --to 192.168.1.8
#iptables -t nat -A POSTROUTING -o eth1 -p tcp --dport 21 -j SNAT --to-source $LAN_IP
iptables -A FORWARD -i ppp0 -m state --state NEW -p tcp -d 192.168.1.8 --dport 21 -j ACCEPT
#NAT fuer DNS
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 53 -j DNAT --to 192.168.1.8
#iptables -t nat -A POSTROUTING -o eth1 -p tcp --dport 53 -j SNAT --to-source $LAN_IP
iptables -A FORWARD -i ppp0 -m state --state NEW -p tcp -d 192.168.1.8 --dport 53 -j ACCEPT
iptables -t nat -A PREROUTING -i ppp0 -p udp --dport 53 -j DNAT --to 192.168.1.8
#iptables -t nat -A POSTROUTING -o eth1 -p udp --dport 53 -j SNAT --to-source $LAN_IP
iptables -A FORWARD -i ppp0 -m state --state NEW -p udp -d 192.168.1.8 --dport 53 -j ACCEPT
#NAT f|r ftp
modprobe ip_nat_ftp
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 21 -j DNAT --to 192.168.1.12
#iptables -t nat -A POSTROUTING -o eth1 -p tcp --dport 21 -j SNAT --to-source $LAN_IP
iptables -A FORWARD -i ppp0 -m state --state NEW -p tcp -d 192.168.1.12 --dport 21 -j ACCEPT
#NAT fuer DNS
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 53 -j DNAT --to 192.168.1.12
#iptables -t nat -A POSTROUTING -o eth1 -p tcp --dport 53 -j SNAT --to-source $LAN_IP
iptables -A FORWARD -i ppp0 -m state --state NEW -p tcp -d 192.168.1.12 --dport 53 -j ACCEPT
iptables -t nat -A PREROUTING -i ppp0 -p udp --dport 53 -j DNAT --to 192.168.1.12
#iptables -t nat -A POSTROUTING -o eth1 -p udp --dport 53 -j SNAT --to-source $LAN_IP
iptables -A FORWARD -i ppp0 -m state --state NEW -p udp -d 192.168.1.12 --dport 53 -j ACCEPT
#NAT fuer HTTP
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 80 -j DNAT --to 192.168.1.12
#iptables -t nat -A POSTROUTING -o eth1 -p tcp --dport 80 -j SNAT --to-source $LAN_IP
iptables -A FORWARD -i ppp0 -m state --state NEW -p tcp -d 192.168.1.12 --dport 80 -j ACCEPT
#directX games fuer 192.168.1.8
iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 2300:2400 -j DNAT --to 192.168.1.8:2300-2400
iptables -A FORWARD -p tcp -d 192.168.1.8 --dport 2300:2400 -j ACCEPT
iptables -t nat -A PREROUTING -p udp -i ppp0 --dport 2300:2400 -j DNAT --to 192.168.1.8:2300-2400
iptables -A FORWARD -p udp -d 192.168.1.8 --dport 2300:2400 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 47624 -j DNAT --to 192.168.1.8:47624
iptables -A FORWARD -p tcp -d 192.168.1.8 --dport 47624 -j ACCEPT
iptables -t nat -A PREROUTING -p udp -i ppp0 --dport 6073 -j DNAT --to 192.168.1.8:6073
iptables -A FORWARD -p udp -d 192.168.1.8 --dport 6073 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 6667 -j DNAT --to 192.168.1.8:6667
iptables -A FORWARD -p tcp -d 192.168.1.8 --dport 6667 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 28000:29000 -j DNAT --to 192.168.1.8:28000-29000
iptables -A FORWARD -p tcp -d 192.168.1.8 --dport 28000:29000 -j ACCEPT
iptables -t nat -A PREROUTING -p udp -i ppp0 --dport 28000:29000 -j DNAT --to 192.168.1.8:28000-29000
iptables -A FORWARD -p udp -d 192.168.1.8 --dport 28000:29000 -j ACCEPT
#LAN-zugriff auf eth1
iptables -A INPUT -m state --state NEW -i eth1 -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -o eth1 -j ACCEPT
#default police mit My_REJECT
iptables -A INPUT -j MY_REJECT
iptables -A OUTPUT -j MY_REJECT
iptables -A FORWARD -j MY_REJECT
#routing
echo 1 > /proc/sys/net/ipv4/ip_forward 2> /dev/null
#Masquerading
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
#SYN-Cookies
echo 1 > /proc/sys/net/ipv4/tcp_syncookies 2> /dev/null
#stop source-routing
for i in /proc/sys/net/ipv4/conf/*; do echo 0 > $i/accept_source_route 2> /dev/null; done
#stop redirekt
for i in /proc/sys/net/ipv4/conf/*; do echo 0 > $i/accept_redirects 2> /dev/null; done
#reverse pathfilter
for i in /proc/sys/net/ipv4/conf/*; do echo 2 > $i/rp_filter 2> /dev/null; done
#Log Martians
for i in /proc/sys/net/ipv4/conf/*; do echo 1 > $i/log_martians 2> /dev/null; done
#BOOTP-Relaying auschalten
for i in /proc/sys/net/ipv4/conf/*; do echo 0 > $i/bootp_relay 2> /dev/null; done
#PROXY ARP auschalten
for i in /proc/sys/net/ipv4/conf/*; do echo 0 > $i/proxy_arp 2> /dev/null; done
#ungueltige icmp pakete wegwerfen
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses 2> /dev/null
;;
stop)
#
;;
esac
*wenns immer wieder passiert ist es kein BUG sondern ein FEATURE *
Lesezeichen