防火牆 iptables 設定

1. 防火牆腳本規劃：不輸入參數預設為全開，所有用戶皆可連上網際網路，選項 --set 設定四種狀況，一為 close 完全關閉網路、二為 csie 只能連上校內網路、三為 dywnag 只能連上 De-Yu Wang 自行規劃設定的網站、四為只能連上某一指定的 ip。選項 --myip 可以指定某一 ip 不受管制，可以連上網際網路。要查看這些選項說明，可以使用 -h 選項。

   [root@dywH bin]# vim setdhcpiptables.sh
   #!/bin/bash
   
   if ip=$(echo $@ | grep -o "\-h") ; then
   	echo "ex. $0 [eth_dhcp eth_int] [--set=[close|csie|dywang]] [--myip=112]"
   	echo "Without any arguments, allows all users connected to the Internet."
   	echo "eth_dhcp eth_int : internal nic external nic"
   	echo "--set=close : can NOT connect to the Internet."
   	echo "--set=csie : can ONLY connect to the domain CYUT."
   	echo "--set=dywang : can ONLY connect to the ip specified by De-Yu Wang."
   	echo "--set=163.17.10.1 : can ONLY connect to the ip 163.17.10.1."
   	echo "--myip=111 : my ip 192.168.1.111 CAN connect to the Internet."
   	exit 1
   fi
   

2. 腳本保留變換對內對外網卡的設定，沒有網卡參數，預設為對內 eth0，對外 eth1。

   [root@dywH bin]# vim setdhcpiptables.sh
   
   if eth=$(echo $@ | grep -o "eth[01] eth[01]") ; then
   	ethdhcp=${eth% *}
   	ethint=${eth#* }
   else
   	ethdhcp=eth0
   	ethint=eth1
   fi
   echo "$ethdhcp,$ethint"
   

3. 針對用戶指定的參數，修改 iptables。

   [root@dywH bin]# vim setdhcpiptables.sh
   
   iptable='/etc/sysconfig/iptables'
   cat > $iptable <<END
   # Firewall configuration written by system-config-firewall
   # Manual customization of this file is not recommended.
   # 21(vsftpd) 22(sshd) 53(named) 69(tftp) dhcpd(67) 80(httpd) 111,2049,875,9001:9005(nfs) 123(ntpd) 389(ldap) 3260(tgtd) 5000:5005(vsftpd pasv) 
   *filter
   :INPUT ACCEPT [0:0]
   :FORWARD ACCEPT [0:0]
   :OUTPUT ACCEPT [0:0]
   -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
   -A INPUT -p icmp -j ACCEPT
   -A INPUT -i lo -j ACCEPT
   -A INPUT -m state --state NEW -s 192.168.1.0/24 -j ACCEPT
   -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
   -A INPUT -j REJECT --reject-with icmp-host-prohibited
   END
   if myip=$(echo $@ | grep -o "\-\-myip=[0-9]\{1,3\}") ; then
   	myip=${myip#*=}
   	echo "-A FORWARD -i $ethdhcp -s 192.168.1.${myip} -j ACCEPT" >> $iptable
   	echo "192.168.1.${myip}"
   fi
   if ip=$(echo $@ | grep -o "\-\-set=[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}") ; then
   	echo "-A FORWARD -i $ethdhcp -d ${ip##*=} -j ACCEPT" >> $iptable
   	echo "-A FORWARD -i $ethdhcp -d 213.108.252.185 -j ACCEPT" >> $iptable
   	echo "-A FORWARD -i $ethdhcp -j DROP" >> $iptable
   elif ip=$(echo $@ | grep -o "\-\-set=close") ; then
   	echo "-A FORWARD -i $ethdhcp -j DROP" >> $iptable
   elif ip=$(echo $@ | grep -o "\-\-set=csie") ; then
   	echo "-A FORWARD -i $ethdhcp -d 163.17.0.0/16 -j ACCEPT" >> $iptable
   	echo "-A FORWARD -i $ethdhcp -d 120.110.0.0/16 -j ACCEPT" >> $iptable
   	echo "-A FORWARD -i $ethdhcp -d 213.108.252.185 -j ACCEPT" >> $iptable
   	echo "-A FORWARD -i $ethdhcp -j DROP" >> $iptable
   elif ip=$(echo $@ | grep -o "\-\-set=dywang") ; then
   	echo "-A FORWARD -i $ethdhcp -d 163.17.27.245 -j ACCEPT" >> $iptable
   	echo "-A FORWARD -i $ethdhcp -d 213.108.252.185 -j ACCEPT" >> $iptable
   	echo "-A FORWARD -i $ethdhcp -d 163.17.10.68 -j ACCEPT" >> $iptable
   	echo "-A FORWARD -i $ethdhcp -d 163.17.10.1 -j ACCEPT" >> $iptable
   	echo "-A FORWARD -i $ethdhcp -d 163.17.10.64 -j ACCEPT" >> $iptable
   	echo "-A FORWARD -i $ethdhcp -d 163.17.10.53 -j ACCEPT" >> $iptable
   	echo "-A FORWARD -i $ethdhcp -d 163.17.10.58 -j ACCEPT" >> $iptable
   	echo "-A FORWARD -i $ethdhcp -d 163.17.10.5 -j ACCEPT" >> $iptable
   	echo "-A FORWARD -i $ethdhcp -d 163.17.1.70 -j ACCEPT" >> $iptable
   	echo "-A FORWARD -i $ethdhcp -d 195.210.29.1 -j ACCEPT" >> $iptable	#zetcode
   	echo "-A FORWARD -i $ethdhcp -d 209.132.180.176 -j ACCEPT" >> $iptable #pygtk
   	echo "-A FORWARD -i $ethdhcp -d 66.155.39.106 -j ACCEPT" >> $iptable #pygtk
   	echo "-A FORWARD -i $ethdhcp -d 184.168.65.89 -j ACCEPT" >> $iptable #tutorialspoint
   	echo "-A FORWARD -i $ethdhcp -j DROP" >> $iptable
   else 
   	echo -e "-A FORWARD -i $ethdhcp -j ACCEPT" >> $iptable
   fi
   cat >> $iptable <<END
   -A FORWARD -o $ethdhcp -d 192.168.1.0/24 -j ACCEPT
   -A FORWARD -o $ethdhcp -j DROP
   -A FORWARD -j REJECT --reject-with icmp-host-prohibited
   COMMIT
   *nat
   #-A POSTROUTING -s 192.168.1.0/24 -o $ethint -j SNAT --to 120.110.10.84
   -A POSTROUTING -o $ethint -j MASQUERADE
   
   COMMIT
   END
   

4. 重新啟動 iptables，並退出腳本。

   [root@dywH bin]# vim setdhcpiptables.sh
   
   /etc/init.d/iptables restart
   exit 0
   

5. setdhcpiptables.sh 腳本下載。