t3ll0

iptables

Nov 27th, 2012
161
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #!/bin/sh -e
  2. #
  3. # rc.local
  4. #
  5. # This script is executed at the end of each multiuser runlevel.
  6. # Make sure that the script will "exit 0" on success or any other
  7. # value on error.
  8. #
  9. # In order to enable or disable this script just change the execution
  10. # bits.
  11. #
  12. # By default this script does nothing.
  13.  
  14. #flashing
  15. iptables -F
  16. iptables -t nat -F
  17. iptables -P INPUT DROP
  18. iptables -P FORWARD DROP
  19. iptables -P OUTPUT DROP
  20.  
  21. # paket ( ini adalah filtering paket yang masuk )
  22. iptables -A INPUT -m state --state NEW -i eth1 -j ACCEPT
  23. iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  24. iptables -A INPUT -m state --state NEW,INVALID -i eth1 -j DROP
  25.  
  26. iptables -A FORWARD -m state --state NEW -j ACCEPT
  27. iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
  28. iptables -A FORWARD -m state --state NEW,INVALID -j DROP
  29.  
  30. iptables -A OUTPUT -m state --state NEW -j ACCEPT
  31. iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  32. iptables -A OUTPUT -m state --state NEW,INVALID -j DROP
  33.  
  34.  
  35. # netbios ( DROP untuk netbios )
  36. iptables -A FORWARD -p udp --sport 137:139 -j DROP
  37.  
  38. # ping ( action ACCEPT berarti dapat ping, kalau action DROP berati tidak dapat di ping)
  39. iptables -A INPUT -p icmp -j ACCEPT
  40. iptables -A FORWARD -p icmp -j ACCEPT
  41. iptables -A OUTPUT -p icmp -j ACCEPT
  42.  
  43. # browser ( action ACCEPT berarti dapat mengakses web, kalau action DROP berati tidak dapat access web )
  44. iptables -A INPUT -p tcp -m multiport --ports 80 -j ACCEPT
  45. iptables -A FORWARD -p tcp -m multiport --ports 80 -j ACCEPT
  46. iptables -A OUTPUT -p tcp -m multiport --ports 80 -j ACCEPT
  47.  
  48. # dns ( action ACCEPT berarti dns bisa di nslookup, kalau actions DROP maka dns tdk bisa di nslookup )
  49. iptables -A INPUT -m state --state NEW -p tcp -m multiport --ports 53 -j ACCEPT
  50. iptables -A FORWARD -p udp -m multiport --ports 53 -j ACCEPT
  51. iptables -A OUTPUT -p tcp -m multiport --ports 53 -j ACCEPT
  52. iptables -A INPUT -p udp -m multiport --ports 53 -j ACCEPT
  53. iptables -A FORWARD -p tcp -m multiport --ports 53 -j ACCEPT
  54. iptables -A OUTPUT -p udp -m multiport --ports 53 -j ACCEPT
  55.  
  56. # smtp ( actions ACCEPT berarti dapat mengirim email, kalau action DROP maka tidak dapat )
  57. iptables -A INPUT -p tcp -m multiport --ports 25 -j ACCEPT
  58. iptables -A FORWARD -p tcp -m multiport --ports 25 -j ACCEPT
  59. iptables -A OUTPUT -p tcp -m multiport --ports 25 -j ACCEPT
  60.  
  61. # pop3 ( action ACCEPT berarti dapat melihat masuk pesan email, kalau action DROP maka tidak )
  62. iptables -A INPUT -p tcp -m multiport --ports 110 -j ACCEPT
  63. iptables -A FORWARD -p tcp -m multiport --ports 110 -j ACCEPT
  64. iptables -A OUTPUT -p tcp -m multiport --ports 110 -j ACCEPT
  65.  
  66. #imap ( action ACCEPT berarti port smtp dapat diakses, dan action DROP sebaliknya )
  67. iptables -A INPUT -p tcp -m multiport --ports 143 -j ACCEPT
  68. iptables -A FORWARD -p tcp -m multiport --ports 143 -j ACCEPT
  69. iptables -A OUTPUT -p tcp -m multiport --ports 143 -j ACCEPT
  70.  
  71.  
  72. #ntp server ( action ACCEPT berarti port network time protokol dapat dilalui #untuk update time, dan action DROP sebailnya)
  73. iptables -A INPUT -p udp -m multiport --ports 123 -j ACCEPT
  74. iptables -A FORWARD -p udp -m multiport --ports 123 -j ACCEPT
  75. iptables -A OUTPUT -p udp -m multiport --ports 123 -j ACCEPT
  76.  
  77. # routing table
  78. iptables -t nat -A POSTROUTING -o eth0 -s 172.16.1.0/29 -j MASQUERADE
  79.  
  80. # redirect ke server proxy
  81. iptables -t nat -A PREROUTING -p tcp -m multiport --dport 80 -i eth1 -s 172.16.4.0/24 -j DNAT --to-destination 192.168.4.1:8080
  82.  
  83. # catatan : semua file rc.local kita taruh saja di router, karena router berfungsi untuk merouting semua paket.
  84. # bagi temen2 semua, tolong di koreksi, kalau kurang monggo di tambah, kalau lebih tetep di tambah aja.
  85. # jangan lupa di restart dengan perintah /etc/init.d/rc.local start
  86. # dan didupkan net.ipv4.ip_forward = 1
  87. # oke.
RAW Paste Data