Forum Debian Users Gang

goofy7 · 2009-03-13 12:28:23

Witam mam nadzieję, że to już ostatni problem. Na poprzednim serwerze miałem normalnie plik masq.rc i w nim reguły teraz chciałem poprzez linux firewalla ustawić masquerade i niestety coś nie poszło:

Kod:

# Generated by iptables-save v1.4.2 on Fri Mar  6 10:28:10 2009
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
# Forward HTTP connections to Squid proxy
-A PREROUTING -p tcp -m tcp -i eth2 --dport 80 -j REDIRECT --to-ports 3128
-A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE
COMMIT
# Completed on Fri Mar  6 10:28:10 2009
# Generated by iptables-save v1.4.2 on Fri Mar  6 10:28:10 2009
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]


COMMIT
# Completed on Fri Mar  6 10:28:10 2009
# Generated by iptables-save v1.4.2 on Fri Mar  6 10:28:10 2009
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A FORWARD -s 192.168.1.0/24 -d 0/0 -j ACCEPT
-A FORWARD -s 0/0 -d 192.168.1.0/24 -j ACCEPT
COMMIT
# Completed on Fri Mar  6 10:28:10 2009

Jakoś nie mogę sie połapać w tym pliku konfiguracyjnym. Proszę o jakieś sugestie.

ilin · 2009-03-13 12:38:09

To zależy co chcesz osiągnąć.Ale to mądrzejsi sie muszą wypowiedzieć.

Najprostszy zaś przykład masquerady masz tu ładnie wyłożony.

http://dug.net.pl/texty/masq.php

goofy7 · 2009-03-13 13:28:47

Mam coś takiego i działa:

Kod:

echo "1" > /proc/sys/net/ipv4/ip_forward
iptables --flush
iptables -F -t nat
iptables -X -t nat
iptables -F -t filter
iptables -X -t filter
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT ACCEPT
iptables -t filter -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -s 192.168.1.0/24 -d 0/0 -j ACCEPT
iptables -t filter -A FORWARD -d 192.168.1.0/24 -s 0/0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 0/0 -j MASQUERADE

I coś takiego już działa, ale jednak nadal nie wiem jak wpisać to w linux firewalla w plik cytowany powyżej.
Najwyżej pozostanę przy standardowym pliku i pominę tamten moduł ....

mariaczi · 2009-03-13 13:46:59

[b]goofy7[/b] pliczek ktory pokazales to wynik polecenia iptables-save (widac to w jego zawartosci)
Zaladowanie ustawien z pliku uzyskasz

Kod:

iptables-restore < nazwa_pliku

W tablicy filter polityke masz ACCEPT wiec regoly niewiele filtruja ;)

czarny30 · 2009-03-18 20:28:36

Ja mam takie cus i dziala nawet lacze ograniczam do danej predkosci dla danego ip

Kod:

#!/bin/sh

# interfejsy
LO_IFACE="lo"
WAN_IFACE="eth1"
LAN_IFACE="eth0"
WAN_IP=`ifconfig $WAN_IFACE | grep inet | cut -d : -f 2 | cut -d ' ' -f 1`
LAN_IP=`ifconfig $LAN_IFACE | grep inet | cut -d : -f 2 | cut -d ' ' -f 1`

#adresy IP
LO_IP="127.0.0.1"


# Ĺ›cieĹźka do iptables
IPTABLES="/usr/sbin/iptables"

# Wlaczenie mechanizmu wykrywania oczywistych falszerstw
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

# Ochrona przed atakiem typu Smurf
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Nie aktceptujemy pakietow "source route"
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route

# Nie przyjmujemy pakietow ICMP rediect, ktore moga zmienic tablice routingu
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects

# Wlaczamy ochrone przed blednymi komunikatami ICMP error
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

# Wlacza logowanie dziwnych (spoofed, source routed, redirects) pakietow
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians

# Limitowanie sesji tcp
echo "30" > /proc/sys/net/ipv4/tcp_fin_timeout
echo "2400" > /proc/sys/net/ipv4/tcp_keepalive_time
echo "0" > /proc/sys/net/ipv4/tcp_window_scaling
echo "0" > /proc/sys/net/ipv4/tcp_sack
echo "20" > /proc/sys/net/ipv4/ipfrag_time
echo "1280" > /proc/sys/net/ipv4/tcp_max_syn_backlog

# TCP timestamps protection
echo "1" > /proc/sys/net/ipv4/tcp_timestamps

# Ignore redirected packets
echo "0" > /proc/sys/net/ipv4/conf/all/send_redirects

# uruchomienie przekazywania pakietow IP miedzy interfejsami
echo "1" > /proc/sys/net/ipv4/ip_forward

# uniemoĹźliwia udostepnianie netu dalej
echo "1" > /proc/sys/net/ipv4/ip_default_ttl
#$IPTABLES -t mangle -A PREROUTING -i ${LAN_IFACE} -j TTL --ttl-set 1
# czyszczenie regul
iptables -F
iptables -t nat -F
iptables -t mangle -F

iptables -X
iptables -t nat -X
iptables -t mangle -X

#iptables -F -t nat
#iptables -X -t nat
#iptables -F -t filter
#iptables -X -t filter

# ustawienie polityk na DROP
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

iptables -A INPUT -i ${LO_IFACE} -j ACCEPT
iptables -A FORWARD -o ${LO_IFACE} -j ACCEPT

# Polaczenia nawiazane
iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -A OUTPUT -j ACCEPT -m state --state ESTABLISHED,RELATED

#TTL Ukrycie naszej maskarady
iptables -t mangle -A POSTROUTING -j TTL --ttl-set 64
iptables -t mangle -A FORWARD -j TTL --ttl-set 64
iptables -t mangle -A PREROUTING -j TTL --ttl-set 64

# Squid przekierowanie
#iptables -t nat -I PREROUTING -s ${LAN_IP_RANGE} -p tcp --dport 80 -j REDIRECT --to-port 8080

# zezwolenie na pingowanie
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 6/minute -j ACCEPT

#Zabezpieczenie skanowania routera
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j LOG --log-level debug --log-prefix 'SCAN: '
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP


# otwarcie portow
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -s 0/0 -d $LAN_IP -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -s 0/0 -d $LAN_IP -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -s 0/0 -d $LAN_IP -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -s 0/0 -d $LAN_IP -p udp --dport 80 -j ACCEPT
#iptables -A INPUT -s 0/0 -d $LAN_IP -p tcp --dport 8080 -j ACCEPT
#iptables -A OUTPUT -s 0/0 -d $LAN_IP -p udp --dport 8080 -j ACCEPT
iptables -A INPUT -s 0/0 -d $LAN_IP -p tcp --dport 700 -j ACCEPT
iptables -A OUTPUT -s 0/0 -d $LAN_IP -p udp --dport 700 -j ACCEPT
iptables -A INPUT -s 0/0 -d $LAN_IP -p tcp --dport 773 -j ACCEPT
iptables -A INPUT -s 0/0 -d $LAN_IP -p udp --dport 773 -j ACCEPT
iptables -A INPUT -s 0/0 -d $LAN_IP -p tcp --dport 10000 -j ACCEPT
iptables -A INPUT -s 0/0 -d $LAN_IP -p udp --dport 10000 -j ACCEPT


#iptables -t filter -A FORWARD -s 192.168.0.1/255.255.255.0 -d 0/0 -j ACCEPT
#iptables -t filter -A FORWARD -s 0/0 -d 192.168.0.1/255.255.255.0 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -s 192.168.0.255 -j REDIRECT --to-port 700
iptables -t nat -A PREROUTING -p udp -s 192.168.0.255 -j REDIRECT --to-port 700


#nobek
iptables -t nat -A POSTROUTING -s 192.168.0.11  -j MASQUERADE
iptables -A FORWARD -m mac --mac-source 00:4b:77:cf:88:aa -j ACCEPT
#robek
iptables -t nat -A POSTROUTING -s 192.168.0.12  -j MASQUERADE
iptables -A FORWARD -m mac --mac-source 00:21:5e:29:8g:5f -j ACCEPT
#nobek nokia
iptables -t nat -A POSTROUTING -s 192.168.0.13  -j MASQUERADE
iptables -A FORWARD -m mac --mac-source 00:1c:d9:34:29:s7 -j ACCEPT
#gosc anka
iptables -t nat -A POSTROUTING -s 192.168.0.14  -j MASQUERADE
iptables -A FORWARD -m mac --mac-source 00:1i:3c:16:82:e6 -j ACCEPT

#mac zablokowany
iptables -A FORWARD -m mac --mac-source 00:13:5f:07:6a:05 -j DROP
iptables -A FORWARD -m mac --mac-source ff:ff:ff:ff:ff:ff -j DROP

tc qdisc del root dev eth0 2>/dev/null
tc qdisc del root dev eth1 2>/dev/null
iptables -t mangle -D POSTROUTING -o eth1 -j MYSHAPER-OUT 2>/dev/null
iptables -t mangle -F MYSHAPER-OUT 2>/dev/null
iptables -t mangle -X MYSHAPER-OUT 2>/dev/null
          #DOWNLOAD
tc qdisc add dev eth0 root handle 1:0 htb
tc class add dev eth0 parent 1:0 classid 1:1 htb rate 9000kbit ceil 9000kbit
tc class add dev eth0 parent 1:1 classid 1:2 htb rate 480kbit ceil 480kbit
tc class add dev eth0 parent 1:1 classid 1:3 htb rate 8500kbit ceil 8500kbit
tc class add dev eth0 parent 1:2 classid 1:4 htb rate 360kbit ceil 480kbit
tc class add dev eth0 parent 1:2 classid 1:5 htb rate 96kbit ceil 128kbit
tc filter add dev eth0 protocol ip preference 1 parent 1:5 u32 match ip \
src 192.168.0.11 flowid 1:2
tc filter add dev eth0 protocol ip preference 1 parent 1:0 u32 match ip \
dst 192.168.0.12 flowid 1:5
tc filter add dev eth0 protocol ip preference 1 parent 1:0 u32 match ip \
dst 192.168.0.13 flowid 1:5
tc filter add dev eth0 protocol ip preference 1 parent 1:0 u32 match ip \
dst 192.168.0.14 flowid 1:5
tc qdisc add dev eth0 parent 1:3 handle 3:0 sfq perturb 10
tc qdisc add dev eth0 parent 1:4 handle 4:0 sfq perturb 10
tc qdisc add dev eth0 parent 1:5 handle 5:0 sfq perturb 10
    #UPLOAD
tc qdisc add dev eth1 root handle 1:0 htb
tc class add dev eth1 parent 1:0 classid 1:1 htb rate 120kbit ceil 120kbit quantum 16
tc class add dev eth1 parent 1:1 classid 1:2 htb rate 40kbit ceil 96kbit quantum 4
tc class add dev eth1 parent 1:1 classid 1:3 htb rate 40kbit ceil 96kbit quantum 4
tc class add dev eth1 parent 1:1 classid 1:4 htb rate 40kbit ceil 96kbit quantum 4
tc qdisc add dev eth1 parent 1:2 handle 2:0 sfq perturb 10
tc qdisc add dev eth1 parent 1:3 handle 3:0 sfq perturb 10
tc qdisc add dev eth1 parent 1:4 handle 4:0 sfq perturb 10
tc filter add dev eth1 protocol ip preference 1 parent 1:0 handle 20 fw flowid 1:2
tc filter add dev eth1 protocol ip preference 1 parent 1:0 handle 21 fw flowid 1:3
tc filter add dev eth1 protocol ip preference 1 parent 1:0 handle 22 fw flowid 1:4
iptables -t mangle -N MYSHAPER-OUT
iptables -t mangle -I POSTROUTING -o eth1 -j MYSHAPER-OUT
iptables -t mangle -A MYSHAPER-OUT -p tcp -s 192.168.0.11 -j MARK --set-mark 22
iptables -t mangle -A MYSHAPER-OUT -p tcp -s 192.168.0.12 -j MARK --set-mark 20
iptables -t mangle -A MYSHAPER-OUT -p tcp -s 192.168.0.13 -j MARK --set-mark 22
iptables -t mangle -A MYSHAPER-OUT -m mark --mark 0 -j MARK --set-mark 20
iptables -I FORWARD -d 195.122.131.13/24 -j DROP
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc

Kompy klienta maja ip 192.168.0.11
brama 192.168.0.1
maska 255.255.255.0
i dnsy koniecznie te dane musisz wpisac w kompy klientow

Ostatnio edytowany przez czarny30 (2009-03-18 20:30:50)

Time (s)	Query
0.00015	SET CHARSET latin2
0.00005	SET NAMES latin2
0.00168	SELECT u., g., o.logged FROM punbb_users AS u INNER JOIN punbb_groups AS g ON u.group_id=g.g_id LEFT JOIN punbb_online AS o ON o.ident='18.191.165.192' WHERE u.id=1
0.00151	REPLACE INTO punbb_online (user_id, ident, logged) VALUES(1, '18.191.165.192', 1732549931)
0.00046	SELECT * FROM punbb_online WHERE logged<1732549631
0.00101	SELECT topic_id FROM punbb_posts WHERE id=113782
0.00005	SELECT id FROM punbb_posts WHERE topic_id=13699 ORDER BY posted
0.00145	SELECT t.subject, t.closed, t.num_replies, t.sticky, f.id AS forum_id, f.forum_name, f.moderators, fp.post_replies, 0 FROM punbb_topics AS t INNER JOIN punbb_forums AS f ON f.id=t.forum_id LEFT JOIN punbb_forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id=3) WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND t.id=13699 AND t.moved_to IS NULL
0.00008	SELECT search_for, replace_with FROM punbb_censoring
0.00242	SELECT u.email, u.title, u.url, u.location, u.use_avatar, u.signature, u.email_setting, u.num_posts, u.registered, u.admin_note, p.id, p.poster AS username, p.poster_id, p.poster_ip, p.poster_email, p.message, p.hide_smilies, p.posted, p.edited, p.edited_by, g.g_id, g.g_user_title, o.user_id AS is_online FROM punbb_posts AS p INNER JOIN punbb_users AS u ON u.id=p.poster_id INNER JOIN punbb_groups AS g ON g.g_id=u.group_id LEFT JOIN punbb_online AS o ON (o.user_id=u.id AND o.user_id!=1 AND o.idle=0) WHERE p.topic_id=13699 ORDER BY p.id LIMIT 0,25
0.00115	UPDATE punbb_topics SET num_views=num_views+1 WHERE id=13699
Total query time: 0.01001 s

Forum Debian Users Gang

Ogłoszenie

#1 2009-03-13 12:28:23

goofy7 - Użytkownik

Linux firewall - masquerade

Kod:

#2 2009-03-13 12:38:09

ilin - Palacz

Re: Linux firewall - masquerade

#3 2009-03-13 13:28:47

goofy7 - Użytkownik

Re: Linux firewall - masquerade

Kod:

#4 2009-03-13 13:46:59

mariaczi - Użytkownik

Re: Linux firewall - masquerade

Kod:

#5 2009-03-18 20:28:36

czarny30 - Użytkownik

Re: Linux firewall - masquerade

Kod:

Stopka forum

Informacje debugowania