From: "Valery V. Rusnak" <xacan1@ukr.net>
To: ALT Linux sysadmin discuss <sysadmins@lists.altlinux.org>
Subject: Re: [Sysadmins] iptables
Date: Wed, 03 Oct 2007 17:05:01 +0300
Message-ID: <4703A18D.3050001@ukr.net> (raw)
In-Reply-To: <200710031801.02160.peet@altlinux.ru>
[-- Attachment #1: Type: text/plain, Size: 649 bytes --]
Peter V. Saveliev пишет:
> On Wednesday 03 October 2007, Valery V. Rusnak wrote:
>
>> Добрый день.
>> Подскажи пожалуйста как закрыть кому то доступ? В данном случае
>> 192.168.1.51, хочу запретить чтобы он невидел вообще сервер.
>>
>> iptables -t filter - A INPUT -d 192.168.1.51 -j DROP
>> iptables -t filter - A OUTPUT -s 192.168.1.51 -j DROP
>>
>> Что не так?
>>
>
> -d -- это destination. Т.е. если хотите, чтобы 192.168.1.51 не видел машину,
> тогда надо использовать
>
> iptables -t filter - A INPUT -s 192.168.1.51 -j DROP
>
Не помогло :( Я приатачил все строки.
ЗЫ. Не судите строго, только сегодня узнал что такое iptables
[-- Attachment #2: rc.firewall --]
[-- Type: text/plain, Size: 4209 bytes --]
#!/bin/bash
#ÐаÑина в оÑиÑе
# office=192.168.1.111
#ÐаÑина админиÑÑÑаÑоÑа
admin=192.168.1.51
#ÐдÑеÑа ÑоÑÑеÑа
server0=192.168.2.5
# server1=10.15.1.2
# ÐдÑÐµÑ Ñайлового аÑÑ
ива Ñ mp3 и video
#video_serv=172.18.1.2
# ÐнÑеÑÑÐµÐ¹Ñ ÑмоÑÑÑÑий на клиенÑов
# iface_cli=eth1
# ÐнÑеÑÑÐµÐ¹Ñ ÑмоÑÑÑÑий во внеÑний миÑ
iface_world=eth0
# ÐнÑеÑÑÐµÐ¹Ñ ÑмоÑÑÑÑий на аÑÑ
ив
#iface_int=etheth2
#ÐоÑÑÑ, на коÑоÑÑÑ
ÑабоÑÐ°ÐµÑ ÐºÐ¾Ð½ÑигÑÑаÑÐ¾Ñ Ð¸ авÑоÑизаÑоÑ
# conf_port=5555
# user_port1=5555
# user_port2=5555
# РазÑеÑаем ÑоÑваÑдинг пакеÑов Ð¼ÐµÐ¶Ð´Ñ Ð¸Ð½ÑеÑÑейÑами
# ÐÑа ÑÑÑка необÑзаÑелÑна, пÑоÑÑо в некоÑоÑÑÑ
диÑÑÑибÑÑиваÑ
# по ÑмолÑÐ°Ð½Ð¸Ñ ÑоÑваÑдинг ÑазÑеÑен, а в некоÑоÑÑÑ
- запÑеÑен
# ÐÑли Ð¼Ñ Ð¿Ð¾Ð´ÑÑÑаÑ
ÑемÑÑ, Ñ
Ñже не бкдеÑ
echo "1" > /proc/sys/net/ipv4/ip_forward
# ÐÑиÑаем пÑавила ÑайÑвола
iptables -t filter -F
iptables -t filter -X
iptables -t nat -F
iptables -t nat -X
# ÐолиÑика по ÑмолÑÐ°Ð½Ð¸Ñ DROP: вÑем вÑÑ Ð·Ð°Ð¿ÑеÑено
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP
# РазÑеÑаем пингам Ñ
одиÑÑ Ð²ÑÑÐ´Ñ Ð¸ вÑегда
#iptables -t filter -A INPUT -p icmp -j ACCEPT
#iptables -t filter -A FORWARD -p icmp -j ACCEPT
#iptables -t filter -A OUTPUT -p icmp -j ACCEPT
# РазÑеÑаем вÑÑ Ð½Ð° локалÑном инÑеÑÑейÑе
iptables -t filter -A INPUT -d 127.0.0.1 -j ACCEPT
iptables -t filter -A OUTPUT -s 127.0.0.1 -j ACCEPT
# РазÑеÑиÑÑ ÑеÑвеÑÑ Ð¾Ð±ÑаÑÑÑÑ Ñо внеÑним миÑом
iptables -t filter -A INPUT -i $iface_world -j ACCEPT
iptables -t filter -A OUTPUT -o $iface_world -j ACCEPT
iptables -t filter -A INPUT -s 192.168.1.51 -j DROP
#iptables -t filter -A INPUT -s $admin -d $server0 -j REJECT
#iptables -t filter -A OUTPUT -d $admin -s $server0 -j REJECT
# РазÑеÑиÑÑ Ð²Ð¸Ð´ÐµÐ¾-ÑеÑвеÑÑ Ð¾Ð±ÑаÑаÑÑÑÑ Ð²Ð¾ внеÑним миÑом и ÑоÑÑеÑом
# iptables -t filter -A INPUT -s $video_serv -j ACCEPT
# iptables -t filter -A FORWARD -s $video_serv -j ACCEPT
# iptables -t filter -A FORWARD -d $video_serv -j ACCEPT
# iptables -t filter -A OUTPUT -d $video_serv -j ACCEPT
# DNS. ÐамеÑÑ, ÐÐС ÑабоÑÐ°ÐµÑ Ð¸ по TCP и по UDP
iptables -t filter -A INPUT -p tcp --sport 53 -j ACCEPT
iptables -t filter -A FORWARD -p tcp --sport 53 -j ACCEPT
iptables -t filter -A FORWARD -p tcp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p udp --sport 53 -j ACCEPT
iptables -t filter -A FORWARD -p udp --sport 53 -j ACCEPT
iptables -t filter -A FORWARD -p udp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
# SSH
#iptables -t filter -A INPUT -p tcp -s $office -d $server0 --dport 22 -j ACCEPT
#iptables -t filter -A OUTPUT -p tcp -d $office -s $server0 --sport 22 -j ACCEPT
#iptables -t filter -A INPUT -p tcp -s $admin -d $server0 --dport 22 -j ACCEPT
#iptables -t filter -A OUTPUT -p tcp -d $admin -s $server0 --sport 22 -j ACCEPT
# Stargazer configurator
#iptables -t filter -A INPUT -p tcp -s 192.168.0.0/24 -d $server0 --dport $conf_port -j ACCEPT
#iptables -t filter -A OUTPUT -p tcp -d 192.168.0.0/24 -s $server0 --sport $conf_port -j ACCEPT
# UDP stargazer InetAccess
#iptables -t filter -A INPUT -p udp -s 192.168.0.0/24 --sport $user_port2 -d $server0 --dport $user_port1 -j ACCEPT
#iptables -t filter -A OUTPUT -p udp -d 192.168.0.0/24 --dport $user_port1 -s $server0 -j ACCEPT
#All local
# iptables -t filter -A INPUT -p tcp -s 192.168.0.0/24 -d $server0 -j ACCEPT
# iptables -t filter -A OUTPUT -p tcp -d 192.168.0.0/24 -s $server0 -j ACCEPT
#ÐаÑкаÑад
#iptables -t nat -A POSTROUTING -d 0.0.0.0/0 -j MASQUERADE
#iptables -t nat -A POSTROUTING -s 0.0.0.0/0 -o eth0 -j MASQUERADE
next prev parent reply other threads:[~2007-10-03 14:05 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-10-03 13:55 Valery V. Rusnak
2007-10-03 13:58 ` Serge
2007-10-03 14:01 ` Peter V. Saveliev
2007-10-03 14:05 ` Valery V. Rusnak [this message]
2007-10-03 14:12 ` Timur Batyrshin
2007-10-03 14:17 ` Valery V. Rusnak
2007-10-03 14:19 ` Motsyo Gennadi aka Drool
2007-10-03 14:21 ` Andrii Dobrovol`s`kii
2007-10-03 14:34 ` Peter V. Saveliev
2007-10-03 14:36 ` Peter V. Saveliev
2007-10-03 15:30 ` Valery V. Rusnak
2007-10-03 15:43 ` Vyatcheslav Perevalov
2007-10-04 3:55 ` [Sysadmins] [JT] iptables Alex Karpov
2007-10-04 9:25 ` [Sysadmins] iptables Alexey Shabalin
2007-10-04 12:37 ` Valery V. Rusnak
2007-10-04 12:43 ` Serge Polkovnikov
2007-10-04 12:53 ` Andrii Dobrovol`s`kii
2007-10-04 13:32 ` Valery V. Rusnak
2007-10-04 14:21 ` Valery V. Rusnak
2007-10-04 15:07 ` Andrii Dobrovol`s`kii
2007-10-04 16:35 ` Valery V. Rusnak
2007-10-04 16:44 ` LIO
2007-10-04 16:37 ` LIO
2007-10-04 17:18 ` Valery V. Rusnak
2007-10-05 12:08 ` Andrii Dobrovol`s`kii
2007-10-06 12:00 ` Valery V. Rusnak
2007-10-06 14:47 ` Timur Batyrshin
2007-10-06 14:50 ` Vyatcheslav Perevalov
2007-10-06 15:59 ` Valery V. Rusnak
2007-10-06 16:06 ` Vyatcheslav Perevalov
2007-10-06 19:13 ` Valery V. Rusnak
2007-10-08 11:54 ` Vyatcheslav Perevalov
2007-10-09 10:33 ` Valery V. Rusnak
2007-10-09 11:55 ` Алексей Шенцев
2007-10-04 17:46 ` Mikhail A. Pokidko
2007-10-04 19:12 ` [Sysadmins] iptables - тестилки файрволов LIO
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4703A18D.3050001@ukr.net \
--to=xacan1@ukr.net \
--cc=sysadmins@lists.altlinux.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
ALT Linux sysadmins discussion
This inbox may be cloned and mirrored by anyone:
git clone --mirror http://lore.altlinux.org/sysadmins/0 sysadmins/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 sysadmins sysadmins/ http://lore.altlinux.org/sysadmins \
sysadmins@lists.altlinux.org sysadmins@lists.altlinux.ru sysadmins@lists.altlinux.com
public-inbox-index sysadmins
Example config snippet for mirrors.
Newsgroup available over NNTP:
nntp://lore.altlinux.org/org.altlinux.lists.sysadmins
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git