Supprimer un message

blietaer

Code:

#!/bin/sh
2
3 # where iptables binary lies
4 IPTABLES=/sbin/iptables
5
6 # Devices
7 dev_intra="eth0" # device for Intranet
8 dev_inter="eth1" # device for ADSL
9 intranet="10.0.0.0/24"
10 any="0.0.0.0/0"
11
12 case "$1" in
13 start)
14 echo -n "Starting Gateway !!"
15
16 # Setting up Forwarding
17 echo 1 > /proc/sys/net/ipv4/ip_forward
18
19 # Setting up IP spoofing protection
20 if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]
21 then
22 for f in /proc/sys/net/ipv4/conf/*/rp_filter
23 do
24 # echo 1 > $f
25 done
26 fi
27
28
29 # Flush all
30 $IPTABLES -F
31 $IPTABLES -X
32
33 # Deny all by default
34 $IPTABLES -P INPUT DROP
35 $IPTABLES -P OUTPUT DROP
36 $IPTABLES -P FORWARD DROP
37
38 KEEPSTATE=" -m state --state ESTABLISHED,RELATED"
39
40
41 # accept anything on localhost device
42 $IPTABLES -A INPUT -j ACCEPT -p ALL -i lo
43 $IPTABLES -A OUTPUT -j ACCEPT -p ALL -o lo
44
45 # accept anything IntraNet if from IntraNet device
46 $IPTABLES -A INPUT -j ACCEPT -p ALL -i $dev_intra
47 $IPTABLES -A OUTPUT -j ACCEPT -p ALL -o $dev_intra
48
49 # Redirectly transparently to Squid WWW requests (you have to setup a
50 #proxy (Squid for example) listeting on this IP & port)
51 #$IPTABLES -t nat -A PREROUTING -i $dev_intra -p TCP -j DNAT \
52 # --dport 80 --to-destination $firewall_intranet:8080
53
54 # Activate Forwarding
55 $IPTABLES -A FORWARD -j ACCEPT -i $dev_intra -o $dev_inter -s $intranet
56 $IPTABLES -A FORWARD -j ACCEPT -o $dev_intra -i $dev_inter -s $any
57
58 # and masquerade IntraNet to Internet with Firewall Internet IP.
59 $IPTABLES -t nat -A POSTROUTING -o $dev_inter -j MASQUERADE
60
61 # activate established mode on all protocols (statefull inspection*/