[PIU' CHE RISOLTO :) ] iptables - creazione rc.firewall

[danix]

Grazie a tutti per l'aiuto...
Questo è stato un thread molto molto istruttivo... non ho postato prima per dire che avevo risolto perchè stavo sparando sul mio server giocando ad Urban Terror

Appena online ha fatto già il pienone


Che altro dire?? Grazie mille a tutti...

[sardylan]

Postaci il finale!!!

[danix]

Codice: Seleziona tutto

$ cat /etc/rc.d/rc.firewall
#!/bin/bash

SW_VERB="-v"

sh /etc/rc.d/rc.ip_forward stop
/usr/sbin/iptables -F $SW_VERB
/usr/sbin/iptables -t nat -F $SW_VERB
/usr/sbin/iptables -t mangle -F $SW_VERB
/usr/sbin/iptables -X $SW_VERB
/usr/sbin/iptables -t nat -X $SW_VERB
/usr/sbin/iptables -t mangle -X $SW_VERB

/usr/sbin/iptables -P INPUT DROP $SW_VERB
/usr/sbin/iptables -P OUTPUT ACCEPT $SW_VERB
/usr/sbin/iptables -P FORWARD DROP $SW_VERB

/usr/sbin/iptables -A INPUT -i lo -j ACCEPT $SW_VERB
/usr/sbin/iptables -A INPUT -i eth1 -j ACCEPT $SW_VERB
/usr/sbin/iptables -A INPUT -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT $SW_VERB
# Blocco i ping dall'esterno
#/usr/sbin/iptables -A INPUT -i ppp0 -p icmp --icmp-type echo-request -j DROP $SW_VERB

/usr/sbin/iptables -A FORWARD -i ppp0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT $SW_VERB
/usr/sbin/iptables -A FORWARD -i eth1 -o ppp0 -j ACCEPT $SW_VERB
# Abilito il masquerading
/usr/sbin/iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE $SW_VERB

#/usr/sbin/iptables -A INPUT -i eth1 -p tcp --dport 8022 -j ACCEPT $SW_VERB     # SSH sulla lan interna
/usr/sbin/iptables -A INPUT -i ppp0 -p tcp --dport 80 -j ACCEPT $SW_VERB        # HTTPD
/usr/sbin/iptables -A INPUT -i ppp0 -p udp --dport 27960 -j ACCEPT $SW_VERB     # URBAN TERROR

/usr/sbin/iptables -Z $SW_VERB
/usr/sbin/iptables -t nat -Z $SW_VERB
/usr/sbin/iptables -t mangle -Z $SW_VERB
sh /etc/rc.d/rc.ip_forward start

# no IP spoofing
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ] ; then
        for i in /proc/sys/net/ipv4/conf/*/rp_filter; do
        echo 1 > $i
        done
fi

# Disable Source Routed Packets
for i in /proc/sys/net/ipv4/conf/*/accept_source_route; do
        echo 0 > $i
done

eccolo

adesso vedo quali porte aprire per openarena e poi dovrei essere a posto