Mam takito problem mam internet od orangu fibernet a chcem si spravit linuxovi firewall .
Mam nainstalovani linux ubuntu...
chcel bi som to tak ze s modemu to pojde do Firewallu a z neho do routra a s routra do dalsich pc..mam router od D-Linku ....
Pre pridávanie komentárov sa musíte prihlásiť.
iptables -A INPUT -i eth0 -p udp --dport 20 -s 192.168.1.0/24 -j ACCEPT #ftp-data
iptables -A INPUT -i eth0 -p tcp --dport 20 -s 192.168.1.0/24 -j ACCEPT #ftp-data
iptables -A INPUT -i eth0 -p udp --dport 21 -s 192.168.1.0/24 -j ACCEPT #ftp
iptables -A INPUT -i eth0 -p tcp --dport 21 -s 192.168.1.0/24 -j ACCEPT #ftp
iptables -A INPUT -i eth0 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT #ssh
iptables -A INPUT -i eth0 -p udp --dport 22 -s 192.168.1.0/24 -j ACCEPT #ssh
iptables -A INPUT -i eth0 -p tcp --dport 53 -s 192.168.1.0/24 -j ACCEPT #dns
iptables -A INPUT -i eth0 -p udp --dport 53 -s 192.168.1.0/24 -j ACCEPT #dns
iptables -A INPUT -i eth0 -p tcp --dport 67 -j ACCEPT #bootps
iptables -A INPUT -i eth0 -p udp --dport 67 -j ACCEPT #bootps
iptables -A INPUT -i eth0 -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT #http tcp
iptables -A INPUT -i eth0 -p udp --dport 80 -s 192.168.1.0/24 -j ACCEPT #http udp
iptables -A INPUT -i eth0 -p udp --dport 137 -s 192.168.1.0/24 -j ACCEPT #win server
iptables -A INPUT -i eth0 -p tcp --dport 137 -s 192.168.1.0/24 -j ACCEPT #win server
iptables -A INPUT -i eth0 -p udp --dport 138 -s 192.168.1.0/24 -j ACCEPT #win server
iptables -A INPUT -i eth0 -p tcp --dport 138 -s 192.168.1.0/24 -j ACCEPT #win server
iptables -A INPUT -i eth0 -p udp --dport 139 -s 192.168.1.0/24 -j ACCEPT #win server
iptables -A INPUT -i eth0 -p tcp --dport 139 -s 192.168.1.0/24 -j ACCEPT #win server
iptables -A INPUT -i eth0 -p udp --dport 8767 -s 192.168.1.0/24 -j ACCEPT #teamspike clienti
iptables -A INPUT -i eth0 -p tcp --dport 14534 -s 192.168.1.0/24 -j ACCEPT #teamspike http server
iptables -A INPUT -i eth0 -p udp --dport 28960 -s 192.168.1.0/24 -j ACCEPT #CODUO
iptables -A INPUT -i eth0 -p tcp --dport 28960 -s 192.168.1.0/24 -j ACCEPT #CODUO
iptables -A INPUT -i eth0 -p tcp --dport smtp -s 192.168.1.0/24 -j ACCEPT #http udp
iptables -A INPUT -i eth0 -p icmp -s 192.168.1.0/24 -j ACCEPT #ping
iptables -A INPUT -i eth0 -j REJECT #vsetko co nieje v pravidlach zakazane, NEMAZAT
1. nastavenie pevnej ip pre eth0 v subore /etc/network/interfaces:
allow-hotplug eth1
iface eth1 inet static
address 192.168.100.1
netmask 255.255.255.0
network 192.168.100.0
broadcast 192.168.100.255
gateway 192.168.1.1 #ip modemu
dns-nameservers 192.168.1.1 #DNS zvycajne ip modemu...
2. nainstalovanie dhcpd prikazom:
> aptitude install dhcpd
3.nakonfigurovanie dhcpd v subore /etc/dhcpd.conf:
#TOTO JE PRE PRVU SIETOVKU KTORA MA VYPNUTE DHCPD
subnet 192.168.1.0 netmask 255.255.255.0 {
not authoritative;
}
#TOTO JE PRE DRUHU SIETOVKU
subnet 192.168.100.0 netmask 255.255.255.0 {
range 192.168.100.180 192.168.100.190;
default-lease-time 600 ;max-lease-time 7200;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.100.255;
option routers 192.168.100.1;
option domain-name-servers 192.168.1.1;
option domain-name "blabladomena";
host popispc {
hardware ethernet ma:ca:dr:es:aa:aa;
fixed-address 192.168.100.11;
}
host druhepc{
hardware ethernet ma:ca:dr:es:aa:aa;
fixed-address 192.168.100.12;
}
}
3. terba spravit skript ktory bude spustat firewall po spusteni pocitaca
>echo "#!/bin/bash" > firewall
>echo "sh /opt/scripts/iptables.script " >>firewall
>cp firewall /etc/init.d/
>chmod 755 /etc/init.d/firewall
>update-rc.d firewall start 20 2 3 4 5 . stop 99 0 1 6 .
4.a teraz si uz len pripravime samotny firewall
>mkdir /opt/scripts
>echo "#!/bin/bash " > /opt/scripts/iptables.script
>chmod 755 /opt/scripts/iptables.script
5.a teraz uz len dopiseme pravidla pre firewall + preklad adries tak, ze ich dopiseme do suboru /opt/scripts/iptables.script
tie pravidla o chvilocku
#vymazanie a cistenie tabuliek#################################################
iptables -F #vymazanie iptables
iptables -F user_default
iptables -X user_default
####################################################################################
#hlavne nastavenia#############################################################
iptables -P INPUT ACCEPT #default povolene
iptables -P OUTPUT ACCEPT #efault povolene
iptables -P FORWARD ACCEPT #efault povolene
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE #zapneme prekladanie adries
####################################################################################
#nastavenie pre INPUT###########################################################
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT #existing accept
iptables -A INPUT -m state --state RELATED -j ACCEPT #create from existing
#pre eth1
iptables -A INPUT -i eth1 -p udp --dport 20 -s 192.168.100.0/24 -j ACCEPT #ftp-data
iptables -A INPUT -i eth1 -p tcp --dport 20 -s 192.168.100.0/24 -j ACCEPT #ftp-data
iptables -A INPUT -i eth1 -p udp --dport 21 -s 192.168.100.0/24 -j ACCEPT #ftp
iptables -A INPUT -i eth1 -p tcp --dport 21 -s 192.168.100.0/24 -j ACCEPT #ftp
iptables -A INPUT -i eth1 -p tcp --dport 22 -s 192.168.100.0/24 -j ACCEPT #ssh
iptables -A INPUT -i eth1 -p udp --dport 22 -s 192.168.100.0/24 -j ACCEPT #ssh
iptables -A INPUT -i eth1 -p tcp --dport 53 -s 192.168.100.0/24 -j ACCEPT #dns
iptables -A INPUT -i eth1 -p udp --dport 53 -s 192.168.100.0/24 -j ACCEPT #dns
iptables -A INPUT -i eth1 -p tcp --dport 67 -j ACCEPT #bootps
iptables -A INPUT -i eth1 -p udp --dport 67 -j ACCEPT #bootps
iptables -A INPUT -i eth1 -p tcp --dport 80 -s 192.168.100.0/24 -j ACCEPT #http tcp
iptables -A INPUT -i eth1 -p udp --dport 80 -s 192.168.100.0/24 -j ACCEPT #http udp
iptables -A INPUT -i eth1 -p udp --dport 137 -s 192.168.100.0/24 -j ACCEPT #win server
iptables -A INPUT -i eth1 -p tcp --dport 137 -s 192.168.100.0/24 -j ACCEPT #win server
iptables -A INPUT -i eth1 -p udp --dport 138 -s 192.168.100.0/24 -j ACCEPT #win server
iptables -A INPUT -i eth1 -p tcp --dport 138 -s 192.168.100.0/24 -j ACCEPT #win server
iptables -A INPUT -i eth1 -p udp --dport 139 -s 192.168.100.0/24 -j ACCEPT #win server
iptables -A INPUT -i eth1 -p tcp --dport 139 -s 192.168.100.0/24 -j ACCEPT #win server
iptables -A INPUT -i eth1 -p udp --dport 8767 -s 192.168.100.0/24 -j ACCEPT #teamspike clienti
iptables -A INPUT -i eth1 -p tcp --dport 14534 -s 192.168.100.0/24 -j ACCEPT #teamspike http server
iptables -A INPUT -i eth1 -p udp --dport 28960 -s 192.168.100.0/24 -j ACCEPT #call of duty
iptables -A INPUT -i eth1 -p tcp --dport 28960 -s 192.168.100.0/24 -j ACCEPT #call of duty
iptables -A INPUT -i eth1 -p tcp --dport smtp -s 192.168.100.0/24 -j ACCEPT #http udp
iptables -A INPUT -i eth1 -p icmp -s 192.168.100.0/24 -j ACCEPT #ping
iptables -A INPUT -i eth1 -j REJECT #vsetko co nieje v pravidlach zakazane, NEMAZAT
#####################################################################################
#nastavenie FORWARD#########################################################
iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT #existing accept
iptables -N user_default #vytvorenie inych podtables pre default userov
#prvy pc ipadresa a macadresa sa zhoduju s dhcpd.conf co si si nastavil
iptables -A FORWARD -i eth1 -o eth0 -s 192.168.100.11/32 -m mac --mac-source ma:ca:dr:es:aa:aa -j user_default
#druhy pc --||--
iptables -A FORWARD -i eth1 -o eth0 -s 192.168.100.12/32 -m mac --mac-source ma:ca:dr:es:aa:aa -j user_default
#treti pc a prdavas uzivatelov kolko chces
iptables -A FORWARD -i eth1 -o eth0 -s 192.168.100.12/32 -m mac --mac-source ma:ca:dr:es:aa:aa -j user_default
iptables -A FORWARD -i eth1 -o eth0 -j REJECT #vsetko co nieje v pravidlach zakazane, nemazat
######################################################################################
#pravidla pre user_default########################################################
iptables -A user_default -p tcp ! --syn -m state --state NEW -j DROP #spojenia typu viliam brana
iptables -A user_default -o eth1 -p tcp --dport 139 -j ACCEPT #browser von napr cez hamahi
iptables -A user_default -o eth0 -p tcp --dport 139 -j ACCEPT #browser von napr cez hamahi
iptables -A user_default -o eth0 -p tcp --dport 300 -j ACCEPT #toto je NET ved 300
iptables -A user_default -o eth0 -p tcp --dport 1010 -j ACCEPT #toto je https soom
iptables -A user_default -o eth0 -p tcp --dport 80 -j ACCEPT #toto je NET ved 80 von
iptables -A user_default -o eth0 -p tcp --dport 6667 -j ACCEPT #icechat 7.0
iptables -A user_default -o eth0 -p udp -m multiport --destination-ports 8767,1337,1808,4348,1878,1493,2022 -j ACCEPT #hamachi... 8767 TS
iptables -A user_default -o eth0 -p udp -m multiport --destination-ports 28960,28961,28962,28963,28966,28970,28980,28933,28965,20510,9000 -j ACCEPT #COD
iptables -A user_default -o eth0 -p udp -m multiport --destination-ports 27015,27016,27017,27019,2720,2721 -j ACCEPT #CS
iptables -A user_default -o eth0 -p udp -m multiport --destination-ports 1051,1147,2233,6622,7777,7778 -j ACCEPT #GTASA
iptables -A user_default -o eth0 -p tcp -m multiport --destination-ports 12080,2011,2010,1755,554 -j ACCEPT #explorer
iptables -A user_default -o eth0 -p tcp -m multiport --destination-ports 2927,2928,2929,2930,554,445 -j ACCEPT #take
iptables -A user_default -o eth0 -p udp -m multiport --destination-ports 23756,23757 -j ACCEPT #fot
#iptables -A FORWARD -o eth0 -p tcp -m multiport --destination-ports 10557,6280,4508 -j ACCEPT #explore
#treba pridat dalsie hry
#iptables -A FORWARD -o eth0 -p tcp -m multiport --destination-ports 6346,6348 -j ACCEPT #bearshare
iptables -A user_default -o eth0 -p udp --dport 53 -j ACCEPT #DNS
iptables -A user_default -o eth0 -p tcp --dport 8245 -j ACCEPT #NOIP
iptables -A user_default -o eth0 -p tcp -m multiport --destination-ports 7996,8000 -j ACCEPT #internet radio
iptables -A user_default -o eth0 -p tcp --dport 443 -j ACCEPT #HTTPS
iptables -A user_default -o eth0 -p tcp --dport 25 -j ACCEPT #smtp email etc
iptables -A user_default -o eth0 -p tcp --dport 110 -j ACCEPT #
iptables -A user_default -o eth0 -p tcp --dport 53 -j ACCEPT #
iptables -A user_default -o eth0 -p udp --dport 53 -j ACCEPT #
iptables -A user_default -o eth0 -p tcp --dport 20 -j ACCEPT #ftp-data
iptables -A user_default -o eth0 -p udp --dport 20 -j ACCEPT #ftp-data
iptables -A user_default -o eth0 -p tcp --dport 21 -j ACCEPT #ftp
iptables -A user_default -o eth0 -p udp --dport 21 -j ACCEPT #ftp
iptables -A user_default -o eth0 -p tcp --dport 22 -j ACCEPT #ssh
iptables -A user_default -o eth0 -p tcp --dport 23 -j ACCEPT #telnet
iptables -A user_default -o eth0 -p tcp --dport 5190 -j ACCEPT #ICQ
iptables -A user_default -o eth0 -p icmp -j ACCEPT #ICMP PING
iptables -A user_default -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT #kvoli napr active FTP
iptables -A user_default -o eth0 -j REJECT #vsetko co nieje v pravidlach zakazane
#nejake dalsie nastavenia#######################################################
Reading package lists... Done
Building dependency tree
Reading state information... Done
Initializing package states... Done
E: Could not open lock file /var/lib/dpkg/lock - open (13 Permission denied)
E: Unable to lock the administration directory (/var/lib/dpkg/), are you root?
lukas@lukas-desktop:~$
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE #zapneme prekladanie adries
A uz ti to ide ?
#pre eth1
to su default nastavenia pristupnosti na server cez eth1. Toto su pravidla len pre poziadavky, ktore idu na tvoj server a nie dalej
#pre eth2
to su default nastavenia pristupnosti na server cez eth2. --||--
#prvy pc ipadresa a macadresa sa zhoduju s dhcpd.conf co si si nastavil
iptables -A FORWARD -i eth1 -o eth0 -s 192.168.100.11/32 -m mac --mac-source ma:ca:dr:es:aa:aa -j user_default
takto povolis clienta s ip"192.168.100.11" a mac"ma:ca:dr:es:aa:aa" s pravidlami pre firewall user_default, ale ak si v dhcpd.conf nespravil to ze prideluje clientom ip pevne,
tak clietov budes pridavat takto:
iptables -A FORWARD -i eth1 -o eth0 -s 192.168.100.0/32 -m mac --mac-source ma:ca:dr:es:aa:aa -j user_default
ak ale chces dat vsetkym pripojenym pravidla rovnake tak staci iba jeden riadok pre vsetkych clientov:
iptables -A FORWARD -i eth1 -o eth0 -s 192.168.100.0/32 -j user_default
#pravidla pre user_default#######
toto su pravidla pre firewall pre skupinu uzivatelov user_default. Tie si uprav podla tvojich potrieb
dopln vymaz a tak, mas tam dost prikladov pre udp, tcp, icmp a pre porty po samom, alebo multiport ak chces povolit viac portov naraz.