iptables

efbrasil

Alguem aqui usa o iptables do kernel 2.4 pra compartilhar conexao??

Ele funciona com todos os programas instalados nas maquinas clientes??
ICQ, ftp, browsers, games, etc??

Se tem alguem usando, por favor responda, e me diz o que esta dando pra usar e o que nao esta.


valeu,
eduardo

INTERNAL="eth0"
EXTERNAL="eth1"

EXT_IP=`/sbin/ifconfig $EXTERNAL | egrep 'inet' | cut -d ':' -f 2 | cut -d 'P' -f 1 | cut -d 'B' -f 1`
INT_IP=`/sbin/ifconfig $INTERNAL | egrep 'inet' | cut -d ':' -f 2 | cut -d 'P' -f 1 | cut -d 'B' -f 1`

echo "Current External IP is $EXT_IP"

iptables -F
iptables -X

iptables -t nat -X

iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING

iptables -t nat -A PREROUTING -i $INTERNAL -d $EXT_IP -j DNAT --to $INT_IP
iptables -t nat -A POSTROUTING -s $EXT_IP -o $INTERNAL -j SNAT --to $INT_IP

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 0.0.0.0/0 -j MASQUERADE

iptables -A FORWARD

## - Disable source routing of packets
if [ -f /proc/sys/net/ipv4/conf/all/accept_source_route ]; then
for i in /proc/sys/net/ipv4/conf/*/accept_source_route; do
echo 0 > $i;
done
fi

## - Enable rp_filter
if [ -f /proc/sys/net/ipv4/conf/all/rp_filter ]; then
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $i;
done
fi

## - Ignore any broadcast icmp echo requests
if [ -f /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ]; then
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
fi

## - Ignore all icmp echo requests on all interfaces
if [ -f /proc/sys/net/ipv4/icmp_echo_ignore_all ]; then
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
fi

## - Local port range for TCP/UDP connections
if [ -f /proc/sys/net/ipv4/ip_local_port_range ]; then
echo -e "32768\t61000" > /proc/sys/net/ipv4/ip_local_port_range
fi

## - Log packets with impossible addresses to kernel log.
if [ -f /proc/sys/net/ipv4/conf/all/log_martians ]; then
echo 0 > /proc/sys/net/ipv4/conf/all/log_martians
fi

## - Don't send ICMP redirects - needed for transparent proxy
if [ -f /proc/sys/net/ipv4/conf/all/send_redirects ]; then
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
fi

## - Don't accept ICMP redirects
if [ -f /proc/sys/net/ipv4/conf/all/accept_redirects ]; then
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
fi

## - Don't accept ICMP redirects
## (You may only want to disable on the external interface)
if [ -f /proc/sys/net/ipv4/conf/$EXTERNAL/accept_redirects ]; then
echo 0 > /proc/sys/net/ipv4/conf/$EXTERNAL/accept_redirects
fi

## Drop the ECN flag in tcp-packets
if [ -f /proc/sys/net/ipv4/tcp_ecn ];then
echo 0 > /proc/sys/net/ipv4/tcp_ecn
fi

## Additional options for dialup connections with a dynamic ip address
## See: linux/Documentation/networking/ip_dynaddr.txt
if [ -f /proc/sys/net/ipv4/ip_dynaddr -a "$MASQ_TYPE" = "STAT" ]; then
echo 0 > /proc/sys/net/ipv4/ip_dynaddr
elif [ -f /proc/sys/net/ipv4/ip_dynaddr ]; then
echo 1 > /proc/sys/net/ipv4/ip_dynaddr
fi
## - Enable IP Forwarding
if [ -f /proc/sys/net/ipv4/ip_forward ]; then
echo 1 > /proc/sys/net/ipv4/ip_forward
else
echo "Uh oh: /proc/sys/net/ipv4/ip_forward doesn't exist"
fi

## - Increase maximum limit of ip_conntrack
if [ -f /proc/sys/net/ipv4/ip_conntrack_max ]; then
echo 16376 > /proc/sys/net/ipv4/ip_conntrack_max
fi

if [ -f /proc/sys/net/ipv4/tcp_timestamps ]; then
echo 0 > /proc/sys/net/ipv4/tcp_timestamps
fi