|
||||||||
First of all, little description of my situation. I am in a Hight school room, where we acces to the lan via a proxy. I have also behind the school connection and adsl connection (ppp0) I am using a Server (connected to the school lan, to the adsl and to my computer) to determine the connection I use. I 've set up iptables rules who works fine for me. I am planning moving to monowall and i would like to know if he is capable of doing the same thing my iptable's script is capable of. Here is my script -- #!/bin/sh #----------------------------- -------------------- #eth0--> 00:0C:6E:2B:CF:94 Internal LAN (my Pc to server) IP fixe #eth1--> 00:02:44:29:C7:45 School LAN DHCPD #eth2--> 00:26:54:0C:04:18 ADSL #------------------------------------------------- # Configuration des routes route del default gw 10.133.15.254 <http://10.133.15.254/> route add -host 10.133.15.254 <http://10.133.15.254/> dev eth1 route add -net 10.0.0.0/8 <http://10.0.0.0/8> gw 10.133.15.254<http://10.133.15.254/> route add -net 192.168.2.0/24 <http://192.168.2.0/24> gw 10.133.15.254<http://10.133.15.254/> route add default gw 84.97.32.1 <http://84.97.32.1/> # On efface tout iptables -F iptables -t nat -F # Regles pour le NAT iptables -t nat -A POSTROUTING -s 192.168.1.0/24 <http://192.168.1.0/24> -d 10.0.0.0/8 <http://10.0.0.0/8> -o eth1 -j MASQUERADE iptables -t nat -A POSTROUTING -s 192.168.1.0/24 <http://192.168.1.0/24> -d 192.168.2.0/24 <http://192.168.2.0/24> -o eth1 -j MASQUERADE iptables -t nat -A POSTROUTING -s 192.168.1.0/24 <http://192.168.1.0/24> -o ppp0 -j MASQUERADE # Anti Ping OF Death iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT #--------------------------- # ETH1 #-------------------------- # Refuser les ports sur eth1 iptables -A INPUT -i eth1 -m state --state NEW,INVALID -j REJECT iptables -A FORWARD -i eth1 -m state --state NEW,INVALID -j REJECT #Ouverture de ports iptables -I INPUT -i eth1 -p tcp --dport 80 -j ACCEPT iptables -I INPUT -i eth1 -p udp --dport 80 -j ACCEPT iptables -I INPUT -i eth1 -p tcp --dport 20:21 -j ACCEPT iptables -I INPUT -i eth1 -p udp --dport 20:21 -j ACCEPT iptables -I INPUT -i eth1 -p tcp --dport 6666:6670 -j ACCEPT iptables -I INPUT -i eth1 -p tcp --dport 7000 -j ACCEPT #--------------------------- # PPP0 #-------------------------- # Refuser les ports sur ppp0 iptables -A INPUT -i ppp0 -m state --state NEW,INVALID -j DROP iptables -A FORWARD -i ppp0 -m state --state NEW,INVALID -j DROP #Ouverture de ports iptables -I INPUT -i ppp0 -p tcp --dport 80 -j ACCEPT iptables -I INPUT -i ppp0 -p udp --dport 80 -j ACCEPT iptables -I INPUT -i ppp0 -p tcp --dport 20:21 -j ACCEPT iptables -I INPUT -i ppp0 -p udp --dport 20:21 -j ACCEPT iptables -I INPUT -i eth1 -p tcp --dport 6666:6670 -j ACCEPT iptables -I INPUT -i eth1 -p tcp --dport 7000 -j ACCEPT iptables -I INPUT -i eth1 -p tcp --dport 4000 -j ACCEPT iptables -I INPUT -i eth1 -p tcp --dport 6112:6119 -j ACCEPT iptables -I INPUT -i eth1 -p udp --dport 4000 -j ACCEPT iptables -I INPUT -i eth1 -p udp --dport 6112:6119 -j ACCEPT #------------------------- # Routage Programmes #------------------------ # Partage Direct Connect iptables -I FORWARD -i eth1 -p tcp --dport 4120:4121 -j ACCEPT iptables -I FORWARD -i eth1 -p udp --dport 4120:4121 -j ACCEPT iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 4120 -j DNAT --to 192.168.1.111:4120 <http://192.168.1.111:4120/> iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 4121 -j DNAT --to 192.168.1.111:4121 <http://192.168.1.111:4121/> iptables -A PREROUTING -t nat -i eth1 -p udp --dport 4120 -j DNAT --to 192.168.1.111:4120 <http://192.168.1.111:4120/> iptables -A PREROUTING -t nat -i eth1 -p udp --dport 4121 -j DNAT --to 192.168.1.111:4121 <http://192.168.1.111:4121/> # Routage Emule iptables -I FORWARD -i ppp0 -p tcp --dport 4662 -j ACCEPT iptables -I FORWARD -i ppp0 -p udp --dport 4672 -j ACCEPT iptables -I FORWARD -i ppp0 -p udp --dport 4665 -j ACCEPT iptables -A PREROUTING -t nat -i ppp0 -p tcp --dport 4662 -j DNAT --to 192.168.1.111:4662 <http://192.168.1.111:4662/> iptables -A PREROUTING -t nat -i ppp0 -p udp --dport 4672 -j DNAT --to 192.168.1.111:4672 <http://192.168.1.111:4672/> iptables -A PREROUTING -t nat -i ppp0 -p udp --dport 4665 -j DNAT --to 192.168.1.111:4665 <http://192.168.1.111:4665/> # Routage BitTorrent iptables -I FORWARD -i ppp0 -p tcp --dport 6881:6889 -j ACCEPT iptables -I FORWARD -i ppp0 -p udp --dport 6881:6889 -j ACCEPT iptables -A PREROUTING -t nat -i ppp0 -p tcp --dport 6881 -j DNAT --to 192.168.1.111:6881 <http://192.168.1.111:6881/> iptables -A PREROUTING -t nat -i ppp0 -p tcp --dport 6882 -j DNAT --to 192.168.1.111:6882 <http://192.168.1.111:6882/> iptables -A PREROUTING -t nat -i ppp0 -p tcp --dport 6883 -j DNAT --to 192.168.1.111:6883 <http://192.168.1.111:6883/> iptables -A PREROUTING -t nat -i ppp0 -p tcp --dport 6884 -j DNAT --to 192.168.1.111:6884 <http://192.168.1.111:6884/> iptables -A PREROUTING -t nat -i ppp0 -p tcp --dport 6885 -j DNAT --to 192.168.1.111:6885 <http://192.168.1.111:6885/> iptables -A PREROUTING -t nat -i ppp0 -p tcp --dport 6886 -j DNAT --to 192.168.1.111:6886 <http://192.168.1.111:6886/> iptables -A PREROUTING -t nat -i ppp0 -p tcp --dport 6887 -j DNAT --to 192.168.1.111:6887 <http://192.168.1.111:6887/> iptables -A PREROUTING -t nat -i ppp0 -p tcp --dport 6888 -j DNAT --to 192.168.1.111:6888 <http://192.168.1.111:6888/> iptables -A PREROUTING -t nat -i ppp0 -p tcp --dport 6889 -j DNAT --to 192.168.1.111:6889 <http://192.168.1.111:6889/> #----------------------------------- #Partage nk IP: 10.133.8.1 <http://10.133.8.1/> #------------------------#----------------------------------- #Partage nk IP:10.133.8.1 <http://10.133.8.1/> #---------------------------------- #Regles Generales iptables -I INPUT -i eth1 -s 10.133.8.1 <http://10.133.8.1/> -j ACCEPT #iptables -t nat -A POSTROUTING -s 10.133.8.1/32 <http://10.133.8.1/32> -d 192.168.2.0/24 <http://192.168.2.0/24> -o eth1 -j MASQUERADE iptables -t nat -A POSTROUTING -s 10.133.8.1 <http://10.133.8.1/> -o ppp0 -j MASQUERADE #iptables -I FORWARD -i eth1 -s 10.133.8.1 <http://10.133.8.1/> -j ACCEPT #IRC iptables -I FORWARD -i eth1 -s 10.133.8.1 <http://10.133.8.1/> -p tcp --dport 6666:6670 -j ACCEPT iptables -I FORWARD -i eth1 -s 10.133.8.1 <http://10.133.8.1/> -p tcp --dport 7000 -j ACCEPT iptables -I FORWARD -i eth1 -s 10.133.8.1 <http://10.133.8.1/> -p udp --dport 6666:6670 -j ACCEPT iptables -I FORWARD -i eth1 -s 10.133.8.1 <http://10.133.8.1/> -p udp --dport 7000 -j ACCEPT #Battle.net iptables -I FORWARD -i eth1 -s 10.133.8.1 <http://10.133.8.1/> -p tcp --dport 4000 -j ACCEPT iptables -I FORWARD -i eth1 -s 10.133.8.1 <http://10.133.8.1/> -p udp --dport 4000 -j ACCEPT iptables -I FORWARD -i eth1 -s 10.133.8.1 <http://10.133.8.1/> -p tcp --dport 6112:6119 -j ACCEPT iptables -I FORWARD -i eth1 -s 10.133.8.1 <http://10.133.8.1/> -p udp --dport 6112:6119 -j ACCEPT iptables -I FORWARD -i eth1 -s 10.133.8.1 <http://10.133.8.1/> -p tcp --dport 20:21 -j ACCEPT iptables -I FORWARD -i eth1 -s 10.133.8.1 <http://10.133.8.1/> -p udp --dport 20:21 -j ACCEPT iptables -I FORWARD -i eth1 -s 10.133.8.1 <http://10.133.8.1/> -p tcp --dport 80 -j ACCEPT iptables -I FORWARD -i eth1 -s 10.133.8.1 <http://10.133.8.1/> -p udp --dport 80 -j ACCEPT Thank you very much -- Sebastien Rodriguez |