iptables CentOS AP
Форум — Admin
Приветствую! Есть сервер, с 2 сетевухами - WAN (eth0) и LAN (eth1). Есть iptables:
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth0 -s 192.168.1.0/24 ! -d 192.168.1.0/24 -j SNAT --to-source 1.2.3.4
COMMIT
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:lan_ssh - [0:0]
:lan_rules - [0:0]
:icmp_allow - [0:0]
:wan_rules_out - [0:0]
:wan_rules_in - [0:0]
:fwd_rules_out - [0:0]
:fwd_rules_in - [0:0]
:rate_limit - [0:0]
:check-flags - [0:0]
#LAN
-A lan_rules -p tcp --dport 22 -j lan_ssh
-A lan_rules -m state --state NEW -j ACCEPT
-A lan_ssh -s 192.168.1.105 -j ACCEPT
-A lan_ssh -j DROP
#Scan
-A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -m limit --limit 5/minute -j LOG --log-level alert --log-prefix "NMAP-XMAS:"
-A check-flags -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
-A check-flags -p tcp --tcp-flags ALL ALL -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS:"
-A check-flags -p tcp --tcp-flags ALL ALL -j DROP
-A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "XMAS-PSH:"
-A check-flags -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
-A check-flags -p tcp --tcp-flags ALL NONE -m limit --limit 5/minute -j LOG --log-level 1 --log-prefix "NULL_SCAN:"
-A check-flags -p tcp --tcp-flags ALL NONE -j DROP
-A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/RST:"
-A check-flags -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/minute -j LOG --log-level 5 --log-prefix "SYN/FIN:"
-A check-flags -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
#ICMP traffic
-A icmp_allow -p icmp --icmp-type 4 -j ACCEPT
-A icmp_allow -p icmp --icmp-type 12 -j ACCEPT
-A icmp_allow -p icmp --icmp-type 3 -j ACCEPT
-A icmp_allow -p icmp --icmp-type 11 -j ACCEPT
-A icmp_allow -p icmp --icmp-type 8 -j ACCEPT
-A icmp_allow -p icmp --icmp-type 0 -j ACCEPT
-A icmp_allow -p icmp -j LOG --log-prefix "Bad ICMP traffic:"
-A icmp_allow -p icmp -j DROP
#fwd_rules_out
-A fwd_rules_out -p tcp -m tcp -m multiport --dports 21,53,80,443,465,993,995 -j ACCEPT
-A fwd_rules_out -p udp -m udp -m multiport --dports 53,123 -j ACCEPT
-A fwd_rules_out -j DROP
#fwd_rules_in
-A fwd_rules_in -j DROP
#FTP
-A rate_limit -p tcp --dport 2121 -m limit --limit 3/min --limit-burst 3 -j RETURN
-A rate_limit -j LOG --log-prefix "IN DROP: "
-A rate_limit -j DROP
#WAN
-A wan_rules_in -p tcp -m tcp --dport 2121 -m state --state NEW -j rate_limit
-A wan_rules_in -p tcp -m tcp --dport 2121 -m connlimit ! --connlimit-above 5 -j ACCEPT
-A wan_rules_in -j DROP
-A wan_rules_out -p tcp -m tcp -m multiport --dports 21,53,80,443 -j ACCEPT
-A wan_rules_out -p udp -m udp -m multiport --dports 53,123 -j ACCEPT
-A wan_rules_out -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j check-flags
-A INPUT -j icmp_allow
-A INPUT -i eth1 -j lan_rules
-A INPUT -i eth0 -j wan_rules_in
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j check-flags
-A FORWARD -j icmp_allow
-A FORWARD -i eth1 -o eth0 -j fwd_rules_out
-A FORWARD -i eth0 -o eth1 -j fwd_rules_in
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -j check-flags
-A OUTPUT -j icmp_allow
-A OUTPUT -o eth0 -j wan_rules_out
-A OUTPUT -o eth1 -j ACCEPT
COMMIT