home       inleiding       sysadmin       services       links       bash       werk       nothing      

iptables input chain 2020 (3)

ik zet alleen het iptables-script hier online, de overige 95% is te vinden in http://linux800.be/services/iptables/iptables-input-chain
 
$ cat ./inch-nat-iptables.v004.sh
 

#! /bin/bash
#
#  iptables-script 
#  bvdb  ( 27/04/2020 ) (v004)
######################################################
#
#  here follows the script ....1
# v = verbose, X = flush tables, F = delete non standard chains
  
# general
iptables -vX
iptables -vF
  
# nat and masquerading -t refers to table
iptables -vt nat -F
iptables -vt nat -X
  
# mangling TCP header
iptables -vt mangle -F
iptables -vt mangle -X
  
# reset policies -P refers to policies
# iptables -vP INPUT ACCEPT ## we are going to close the INPUT CHAIN
iptables -vP OUTPUT ACCEPT
iptables -vP FORWARD ACCEPT
  
# turn off routing
# echo 0 > /proc/sys/net/ipv4/ip_forward
 
###################### iptables is nu cleared ####
 
# turn on routing
echo 1 > /proc/sys/net/ipv4/ip_forward
  
###### Dit is heel belangrijk in je script -- 
###### dan zie je wat je aan het doen bent:
#
##>> my network interfaces: enp0s3 = 192.168.0.102/24 >> buiten
##>> my network interfaces: enp0s8 = 10.0.0.102/24 >> DMZ (binnen)
  
### implement NAT routing
#
## NAT routing - enp0s3 is buiten en een unprotected network
#  het ip address aan de buitenkant van onze firewall is 192.168.0.102 (outside address)
#
iptables -vt nat -A POSTROUTING -o enp0s3 -j SNAT --to 192.168.0.102
 
### implement INPUT filtering
## INPUT chain lo + ports 10022
iptables -vP INPUT DROP
iptables -vA INPUT -i lo -j ACCEPT
iptables -vA INPUT -p TCP --dport 10022 -j ACCEPT
iptables -vA INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 
 
###################### iptables is nu ingesteld ####
 
### PRINT iptables configuration
###
#
echo ">>>>> iptables -n -L"
iptables -n -L
echo "--------------"
echo ">>>>> iptables -S"
iptables -S 
echo "--------------"
echo ">>>>> iptables -t nat -L"
iptables -t nat -L
echo "--------------"
echo ">>>>> iptables -t mangle -L"
iptables -t mangle -L
echo "--------------"
echo "routing set: " `cat /proc/sys/net/ipv4/ip_forward`