TechBlog

SYSLOG per Windows? http://troy.jdmz.net/syslogwin/ VAI VIA! http://www.skullkrusher.net/linux/iptables.html http://www.eprometeus.com/testi/41d0659c0e01b/Linux/Linux/Proteggere_la_vostra_SSH.html #!/bin/bash # Queste sono le regole per il firewall -> NGI # Update 2005-06-25 02:28:38 # PARAMETRI MYIP="81.174.26.226" FIREWALL="192.168.10.200" WEBSERVER="192.168.10.99" # RESETTO LE REGOLE ESISTENTI iptables -F iptables -F --table nat # REGOLE DI DEFAULF # Nego ingresso iptables -P INPUT DROP # Nego dialogo tra schede iptables -P FORWARD DROP # Accetto il traffico in uscita iptables -P OUTPUT ACCEPT # LOOPBACK! iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # MASQUERADING iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE echo 1 > /proc/sys/net/ipv4/ip_forward # FORWARD -> traffico LAN verso Internet e ritorno iptables -A FORWARD -s 192.168.10.0/24 -j ACCEPT iptables -A FORWARD -d 192.168.10.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT # FORWARD tra ppp0 e eth1 (????) iptables -A FORWARD -i ppp0 -j ACCEPT # INPUT -> traffico di ritorno verso IP # permetto a quello che e` uscito di rientrare iptables -A INPUT -d $MYIP -m state --state ESTABLISHED,RELATED -j ACCEPT # permetto il traffico alle macchine interne #iptables -A INPUT -d 192.168.10.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT # TRAFFICO VERSO L'INTERNO # www (provare senza input, da dentro e fuori) #iptables -A INPUT -p tcp --dport 80 -j ACCEPT #iptables -t nat -A PREROUTING -p tcp --dport 80 -d $MYIP -j DNAT --to $WEBSERVER:80 #iptables -t nat -A PREROUTING -p tcp --dport 80 -d $FIREWALL -j DNAT --to $WEBSERVER:80 # ssh iptables -A INPUT -p tcp --dport 22 -j ACCEPT #iptables -t nat -A PREROUTING -p tcp --dport 22 -d $MYIP -j DNAT --to $WEBSERVER:22 # ping iptables -A INPUT -p icmp -j ACCEPT # TRAFFICO VERSO L'ESTERNO # smtp (solo ip interni) NO smtp.ngi.it #iptables -A INPUT -p tcp -d $FIREWALL --dport 25 -j ACCEPT #iptables -t nat -A PREROUTING -p tcp -d $FIREWALL --dport 25 -j DNAT --to 213.92.5.57:25 # MOSTRO LE REGOLE DI NAT iptables -L iptables -L --table nat