Re: [gentoo-user-ru] Настройка NAT

[Mad Deer]

Maxim Ivanov ÐÉÛÅÔ:

> óÏÂÒÁÌ ÄÏÍÁ ×ÔÏÒÏÊ ËÏÍÐ É ×ÏÔ ÔÅÐÅÒØ ÂÁÌÕÀÓØ Ó ÎÁÓÔÒÏÊËÁÍÉ ÓÅÔÉ × Linux. ôÁË É
> ÎÅ ÓÍÏÇ ÎÁÓÔÒÏÉÔØ NAT. é ÔÁË ÞÔÏ ÍÙ ÉÍÅÅÍ:
>
> ëÏÍÐØÀÔÅÒ Ó Gentoo É ×ÙÈÏÄÏÍ × ÉÎÅÔ:
> eth0 = 192.168.0.2/24
> eth1 = adsl
> ppp0 =  10.1.12.5
>
> ÷ÔÏÒÏÊ ËÏÍÐ:
> IP = 192.168.0.1/24
> GATEWAY = 192.168.0.2
> DNS = IP ÁÄÒÅÓÁ DNS ÐÒÏ×ÁÊÄÅÒÁ
>
> ÓËÒÉÐÔ ÆÁÅÒ×ÏÌÁ:
> # Interface to Internet
> EXTIF=ppp+
>
> ANY=0.0.0.0/0
>
> iptables -P INPUT ACCEPT
> iptables -P OUTPUT ACCEPT
> iptables -P FORWARD DROP
>
> iptables -F FORWARD
> iptables -F INPUT
> iptables -F OUTPUT
> iptables -t nat -F POSTROUTING
>
> # Deny TCP and UDP packets to privileged ports
> iptables -A INPUT -i $EXTIF -d $ANY -p udp --dport 0:1023 -j LOG
> iptables -A INPUT -i $EXTIF -d $ANY -p udp --dport 0:1023 -j DROP
> iptables -A INPUT -i $EXTIF -d $ANY -p tcp --dport 0:1023 -j LOG
> iptables -A INPUT -i $EXTIF -d $ANY -p tcp --dport 0:1023 -j DROP
>
> # Deny TCP connection attempts
> iptables -A INPUT -i $EXTIF -p tcp --dccp-types SYNC -j LOG
> iptables -A INPUT -i $EXTIF -p tcp --dccp-types SYNC -j DROP
>
> # Deny ICMP echo-requests
>
> # Do masquerading
> iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o $EXTIF -j MASQUERADE
> echo 1 > /proc/sys/net/ipv4/ip_forward
>
> ÷ ÉÔÏÇÅ ÓÏ ×ÔÏÒÏÇÏ ËÏÍÐÁ ÐÉÎÇÕÅÔ ppp0, ÎÏ ×ÓÅ ÞÔÏ ÄÁÌØÛÅ (ÎÁÐÒÉÍÅÒ DNS
> ÐÒÏ×ÁÊÄÅÒÁ)  - ÎÅÔ.
Õ ÔÅÂÑ ×ÅÄØ ÐÏ ÕÍÏÌÞÁÎÉÀ iptables -P FORWARD DROP

Á ACCEPT ÄÌÑ ÎÅÇÏ ÎÅÔ. ÎÁÄÏ ÅÝ£



$IPTABLES -A FORWARD -i eth0 -j ACCEPT

$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT



Á ×ÏÔ ÜÔÏ

 > iptables -P INPUT ACCEPT

ÌÕÞÛÅ ÎÁ DROP ÓÄÅÌÁÊ. ÔÙ ÖÅ ÅÇÏ ÚÁËÒÙ×ÁÔØ ÆÁÊÅÒ×ÏÌÏÍ ÄÏÌÖÅÎ, Á ÔÙ ÎÁÏÂÏÒÏÔ ÏÔËÒÙ×ÁÅÛØ.

-- 

äÁ ÚÄÒÁ×ÓÔ×ÕÅÔ ÔÏ, ÂÌÁÇÏÄÁÒÑ ÞÅÍÕ ÍÙ, ÎÅÓÍÏÔÒÑ ÎÉ ÎÁ ÞÔÏ.(c) úÁÄÏÒÎÏ×

Registered Linux User #317544

Linux 2.6.14.2 i686 AMD Athlon(tm) XP 2200+

-- 

gentoo-user-ru@g.o mailing list