krótki opis: postawiłem w domu serwerek (dla testów, zabawy), w nim dwie karty sieciowe:
eth0 - wyjście na świat (UPC)
eth1 - sieć wewnętrzna
Idąc za ciosem książki UbuServ postanowiłem skonfigurować firewalla UFW (dużo powiedziane - dopisałem 2 reguły i usługi z lini poleceń).
Plik wygląda tak:
Kod: Zaznacz cały
*nat
:POSTROUTING ACCEPT [0:0]
# Forward eth1 - eth0
-A POSTROUTING -s 192.83.21.0/24 -o eth0 -j MASQUERADE
# Forward port 80 dla squid proxy (do zrobienia/sprawdzenia potem)
#-A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.83.21.2:3128
#-A PREROUTING -i eth1 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.83.21.2:3128
COMMIT
*filter
:ufw-before-input - [0:0]
:ufw-before-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-not-local - [0:0]
# End required lines
# allow all on loopback
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-output -o lo -j ACCEPT
# quickly process packets for which we already have a connection
-A ufw-before-input -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -m state --state RELATED,ESTABLISHED -j ACCEPT
# drop INVALID packets (logs these in loglevel medium and higher)
-A ufw-before-input -m state --state INVALID -j ufw-logging-deny
-A ufw-before-input -m state --state INVALID -j DROP
# ok icmp codes
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
# allow dhcp client to work
-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT
#
# ufw-not-local
#
-A ufw-before-input -j ufw-not-local
# if LOCAL, RETURN
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
# if MULTICAST, RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
# if BROADCAST, RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
# all other non-local packets are dropped
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP
# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above
# is uncommented)
-A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT
# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above
# is uncommented)
-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT
# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT
![Smile :)](./images/smilies/icon_smile.gif)
Kod: Zaznacz cały
ufw status
Stan: aktywny
Do Czynność Z
-- -------- -
22 ALLOW Anywhere
Bind9 ALLOW 192.83.21.0/24
Samba ALLOW 192.83.21.0/24
Apache ALLOW Anywhere
Samba ALLOW Anywhere
22 ALLOW Anywhere (v6)
Apache (v6) ALLOW Anywhere (v6)
Samba (v6) ALLOW Anywhere (v6)
![Smile :)](./images/smilies/icon_smile.gif)
Dzięki.