Erik: Copy from old

Erik — Thu, 04 Jun 2009 05:25:20 GMT

Copy from old

New page

<pre>
#!/bin/sh

# This is a very basic LAN NAT script, allowing only SSH to the firewall from
# the external interface, allowing all outbound LAN traffic, and allowing only
# established/related traffic back into the LAN.

ipt=/usr/sbin/iptables
extip=192.168.1.41 # replace with your EXTERNAL IP - eth0
lan=10.5.3.0/25 # your LAN CIDR range - eth1

# start firewall
start_firewall() {

echo "Enabling IP forwarding."
echo 1 > /proc/sys/net/ipv4/ip_forward

echo "Enabling iptables firewall."
# default policies
$ipt -P INPUT DROP
$ipt -P FORWARD DROP

# NAT
$ipt -t nat -A POSTROUTING -o eth0 -j SNAT --to-source $extip

# INPUT chain
$ipt -A INPUT -i lo -j ACCEPT
$ipt -A INPUT -i eth1 -s $lan -j ACCEPT
$ipt -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
$ipt -A INPUT -p tcp --destination-port 22 -j ACCEPT

# FORWARD chain
$ipt -A FORWARD -i eth1 -s $lan -j ACCEPT
$ipt -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

}

# stop firewall
stop_firewall() {

$ipt -P INPUT DROP
$ipt -P OUTPUT DROP
$ipt -P FORWARD DROP
# allow internal traffic
$ipt -A INPUT -i eth1 -j ACCEPT
$ipt -A OUTPUT -o eth1 -j ACCEPT

}

# flushing, removing and zeroing tables
reset_firewall() {

chains=`cat /proc/net/ip_tables_names`
for i in $chains; do
$debug $ipt -t $i -F
$debug $ipt -t $i -X
$debug $ipt -t $i -Z
done

}

case "$1" in

start|restart|reload)
reset_firewall
start_firewall
;;
stop)
reset_firewall
stop_firewall
;;
*)
echo "Usage: $0 {start|stop|restart|reload}"
exit 1
;;

esac
</pre>

[[Category:Security]]

NAT Script - Revision history

Erik: Copy from old