Public paste
Undefined
By: yuc | Date: Nov 2 2009 08:04 | Format: None | Expires: never | Size: 1.68 KB | Hits: 967

  1. #!/bin/sh
  2.  
  3. PATH=/usr/sbin:/sbin:/bin:/usr/bin
  4.  
  5. #
  6. # delete all existing rules.
  7. #
  8. iptables -F
  9. iptables -t nat -F
  10. iptables -t mangle -F
  11. iptables -X
  12.  
  13. # Always accept loopback traffic
  14. iptables -A INPUT -i lo -j ACCEPT
  15.  
  16. # Allow established connections, and those not coming from the outside
  17. iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  18. iptables -A INPUT -m state --state NEW -i ! eth1 -j ACCEPT
  19. iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
  20.  
  21. # Allow outgoing connections from the LAN side.
  22.  
  23. iptables -A FORWARD -m iprange --src-range 10.0.0.40-10.0.0.254 -j DROP  
  24. iptables -A FPRWARD -m iprange --src-range 10.0.0.1-10.0.0.40 -j ACCEPT
  25.  
  26. iptables -A FORWARD -p tcp --dport 80 -m state --state NEW -m iprange --src-range 10.0.0.40-10.0.0.254 -j ACCEPT  
  27. iptables -A FORWARD -p tcp --dport 443 -m state --state NEW -m iprange --src-range 10.0.0.40-10.0.0.254 -j ACCEPT  
  28. iptables -A FORWARD -p udp --dport 53 -m iprange --src-range 10.0.0.40-10.0.0.254 -j ACCEPT
  29. iptables -A FORWARD -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
  30.  
  31.  
  32.  
  33. # Masquerade.
  34. iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
  35.  
  36. # Don't forward from the outside to the inside.
  37. iptables -A FORWARD -i eth1 -o eth1 -j REJECT
  38.  
  39. iptables -t nat -A PREROUTING -p tcp --dport 28960 -i eth1 -j DNAT --to 10.0.0.50:28960
  40. iptables -t nat -A PREROUTING -p udp --dport 28960 -i eth1 -j DNAT --to 10.0.0.50:28960
  41. iptables -t nat -A PREROUTING -p tcp --dport 52401 -i eth1 -j DNAT --to 10.0.0.50:52401
  42.  
  43. #proxy
  44. #iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
  45.  
  46.  
  47. # Enable routing.
  48. echo 1 > /proc/sys/net/ipv4/ip_forward