只需要一個公網地址設在外接口上，內部用私網地址組網即可，在內部服務器提供Internet服務。
#!/bin/sh
#--------------------------------------------
#
# 外接口eth0，開放 vpn ssh
# 內接口eth1，綁定 dhcp dns squid
# 向內部服務器轉發 FTP smtp www pop3
# 支持透明代理
#
# 胖頭魚：
[email protected]
#
#--------------------------------------------
EXT_IF="eth0"
INT_IF="eth1"
EXT_IP="" #公網IP
INT_IP="" #內接口IP
SERVER_IP="" #內部服務器IP
# pptpd_vpn_service ssh
TRUSTED_LOCAL_TCP_PORT="1723 22"
TRUSTED_LOCAL_UDP_PORT="22"
# ftp-data ftp smtp http pop3
FWD_TCP_PORT="20 21 25 80 110"
FWD_UDP_PORT="20 21 25 80 110"
# load any special modules
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp
modprobe ip_nat_irc
modprobe ip_conntrack_irc
# turn on ip forwarding
echo "1" > /proc/sys/net/ipv4/ip_forward
# setting up ip spoofing protection
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $f
done
# delete any existing chains
iptables -F -t filter
iptables -X -t filter
iptables -Z -t filter
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
# setting up default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
#---------------------- filter ---------------------
# allow ping from internet
iptables -A INPUT -i $EXT_IF -p icmp -j ACCEPT
# enable local traffic
#------------------------------------------------------------------------
# iptables -A INPUT ! -i $EXT_IF -m state --state NEW -j ACCEPT
# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# iptables -A FORWARD ! -i $EXT_IF -m state --state NEW -j ACCEPT
# iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#------------------------------------------------------------------------
iptables -N allowed
iptables -A allowed ! -i $EXT_IF -m state --state NEW -j ACCEPT
iptables -A allowed -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -j allowed
iptables -A FORWARD -j allowed
for PORT in $TRUSTED_LOCAL_TCP_PORT; do
iptables -A INPUT -i $EXT_IF -p tcp --dport $PORT -m state --state NEW -j
ACCEPT
done
for PORT in $TRUSTED_LOCAL_UDP_PORT; do
iptables -A INPUT -i $EXT_IF -p udp --dport $PORT -m state --state NEW -j
ACCEPT
done
#---------------------- nat ---------------------
# port forwarding
for PORT in $FWD_TCP_PORT; do
iptables -A FORWARD -i $EXT_IF -o $INT_IF -d $SERVER_IP
-p tcp --dport $PORT -m state --state NEW -j ACCEPT
iptables -t nat -A PREROUTING -d $EXT_IP
-p tcp --dport $PORT -j DNAT --to-destination $SERVER_IP
iptables -t nat -A POSTROUTING -d $SERVER_IP
-p tcp --dport $PORT -j SNAT --to-source $INT_IP
done
for PORT in $FWD_UDP_PORT; do
iptables -A FORWARD -i $EXT_IF -o $INT_IF -d $SERVER_IP
-p udp --dport $PORT -m state --state NEW -j ACCEPT
iptables -t nat -A PREROUTING -d $EXT_IP
-p udp --dport $PORT -j DNAT --to-destination $SERVER_IP
iptables -t nat -A POSTROUTING -d $SERVER_IP
-p udp --dport $PORT -j SNAT --to-source $INT_IP
done
# Transparent Proxy
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport 80 -j REDIRECT --to-
port 3128
# SNAT or MASQUERADE
#------------------------------------------------------------------------
# iptables -t nat -A POSTROUTING -o $EXT_IF -j SNAT --to-source $EXT_IP
#------------------------------------------------------------------------
iptables -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE
# THE END
done
# Transparent Proxy
iptables -t nat -A PREROUTING -i $INT_IF -p tcp --dport 80 -j REDIRECT --to-
port 3128
# SNAT or MASQUERADE
#------------------------------------------------------------------------
# iptables -t nat -A POSTROUTING -o $EXT_IF -j SNAT --to-source $EXT_IP
#------------------------------------------------------------------------
iptables -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE
# THE END
