check dieses Script mal aus:
allerdings finde ich die ip_masq_* Kernelmodule nur bei meinem 2.2er Kernel aber nicht bei meinem 2.4er Kernel. Wurden diese Kernelmodule bei 2.4.x umbenannt, in ein anderes Modul migriert oder was muss man beim Kernelbacken beachten ? Auch beim Kernelerstellen finde ich keine Option mehr die mir die ip_masq_* Module erstellt ???
<blockquote><pre><font size="1" face="">code:</font><hr><font face="Courier New" size="2">
#! /bin/sh
#
# for SuSE 6.3
#
# /etc/rc.d/init.d/firewall
#
# and has symbolic links to it from
#
# /etc/rc.d/rc2.d/S51firewall
# /etc/rc.d/rc2.d/K51firewall
# /etc/rc.d/rc3.d/S51firewall
# /etc/rc.d/rc3.d/K51firewall
#
. /etc/rc.config
# test is START_FW is set to yes in SuSE's /etc/rc.config
test "$START_FW" = yes || exit 0
# Variables
DEV_LNET=eth0 # LAN Interface
IP_LNET=192.168.0.99 # my IP
DEV_INET=ppp0 # Internet Interface
LNET=192.168.0.0/24 # local net
GLOBAL=0.0.0.0/0
IPCHAINS=/sbin/ipchains
# The echo return value for success (defined in /etc/rc.config).
return=$rc_done
case "$1" in
start)
echo "Stand by while starting up the firewall..."
echo "Starting IP forwarding"
echo "1" > /proc/sys/net/ipv4/ip_forward
# IP Forward muss vorher aktiviert werden.
# Unter SuSE sollte der Befehl in der rc.config aktiviert werden.
# Bei Masquerading muss zusaetzlich noch IP_DYNIP in der
# /etc/rc.config aktiviert sein.
echo "Start RP filter for anti spoofing shield"
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "Deleting all existing chains..."
$IPCHAINS -F
echo "Setting up default policy..."
$IPCHAINS -P input DENY
$IPCHAINS -P forward DENY
$IPCHAINS -P output DENY
#-------------------------------------------------------------------
# scheinbar macht FTP ansonsten Probleme wenn man wo was uploaden moechte
$IPCHAINS -A input --sport 20 -i $DEV_INET -p tcp -y -j ACCEPT
$IPCHAINS -A input i $DEV_INET -p tcp -y -j DENY --log
# Ping aus dem Internet ignorieren
# $IPCHAINS -A inet_in -p icmp --icmp-type echo-request -j DENY --log
$IPCHAINS -A input -i $DEV_INET -p icmp --icmp-type echo-request -j DENY --log
#-------------------------------------------------------------------
echo "Setting up loopback interface..."
$IPCHAINS -A input -i lo -j ACCEPT
$IPCHAINS -A output -i lo -j ACCEPT
echo "Setting up DHCP access..."
$IPCHAINS -A input -p udp -s $GLOBAL 67 -i $DEV_LNET -j ACCEPT
$IPCHAINS -A input -p udp -s $GLOBAL 68 -i $DEV_LNET -j ACCEPT
$IPCHAINS -A output -p udp -d $GLOBAL 67 -i $DEV_LNET -j ACCEPT
$IPCHAINS -A output -p udp -d $GLOBAL 68 -i $DEV_LNET -j ACCEPT
echo "Setting up intranet connections..."
$IPCHAINS -A input -i $DEV_LNET -s $LNET -j ACCEPT
$IPCHAINS -A output -i $DEV_LNET -d $LNET -j ACCEPT
echo "Setting up Win32 NETBIOS connections..."
#--tcp
$IPCHAINS -A input -s $LNET 137 -p tcp -i $DEV_LNET -j ACCEPT
$IPCHAINS -A input -s $LNET 138 -p tcp -i $DEV_LNET -j ACCEPT
$IPCHAINS -A input -s $LNET 139 -p tcp -i $DEV_LNET -j ACCEPT
$IPCHAINS -A output -d $LNET 135 -p tcp -i $DEV_LNET -j ACCEPT
$IPCHAINS -A output -d $LNET 137 -p tcp -i $DEV_LNET -j ACCEPT
$IPCHAINS -A output -d $LNET 138 -p tcp -i $DEV_LNET -j ACCEPT
$IPCHAINS -A output -d $LNET 139 -p tcp -i $DEV_LNET -j ACCEPT
#--udp
$IPCHAINS -A input -s $LNET 137 -p udp -i $DEV_LNET -j ACCEPT
$IPCHAINS -A input -s $LNET 138 -p udp -i $DEV_LNET -j ACCEPT
$IPCHAINS -A output -d $LNET 135 -p udp -i $DEV_LNET -j ACCEPT
$IPCHAINS -A output -d $LNET 137 -p udp -i $DEV_LNET -j ACCEPT
$IPCHAINS -A output -d $LNET 138 -p udp -i $DEV_LNET -j ACCEPT
# die Ports 135, 137..139 fuer das lokale Netz aufmachen, damit
# Windows Freigaben angezeigt werden...
# Name ID Protokol Bemerkung
# netbios-ns 137 tcp/udp NETBIOS Name Service
# netbios-dgm 138 tcp/udp NETBIOS Datagram Service
# netbios-ssn 139 tcp NETBIOS-Session
echo "Setting up internet SYN connections..."
$IPCHAINS -A input -s $LNET 1024: -p tcp -i $DEV_LNET -j ACCEPT
$IPCHAINS -A forward -s $LNET 1024: -p tcp -i $DEV_INET -j MASQ
$IPCHAINS -A output -s $GLOBAL 1024: -p tcp -i $DEV_INET -j ACCEPT
$IPCHAINS -A input -s $LNET 1024: -p udp -i $DEV_LNET -j ACCEPT
$IPCHAINS -A forward -s $LNET 1024: -p udp -i $DEV_INET -j MASQ
$IPCHAINS -A output -s $GLOBAL 1024: -p udp -i $DEV_INET -j ACCEPT
echo "Setting up internet ACK connections..."
$IPCHAINS -A input --sport 20 -d $GLOBAL 1024: -p tcp -i $DEV_INET -j ACCEPT
$IPCHAINS -A output --sport 20 -d $LNET 1024: -p tcp -i $DEV_LNET -j ACCEPT
$IPCHAINS -A input -d $GLOBAL 1024: -p tcp -i $DEV_INET -j ACCEPT ! -y
$IPCHAINS -A output -d $LNET 1024: -p tcp -i $DEV_LNET -j ACCEPT ! -y
$IPCHAINS -A input -d $GLOBAL 1024: -p udp -i $DEV_INET -j ACCEPT
$IPCHAINS -A output -d $LNET 1024: -p udp -i $DEV_LNET -j ACCEPT
echo "Setting up ICMP defined restrictions..."
$IPCHAINS -N icmp-acc
$IPCHAINS -A icmp-acc -p icmp --icmp-type echo-reply -j ACCEPT
$IPCHAINS -A icmp-acc -p icmp --icmp-type echo-request -j ACCEPT
$IPCHAINS -A icmp-acc -p icmp --icmp-type destination-unreachable -j ACCEPT
$IPCHAINS -A icmp-acc -p icmp --icmp-type source-quench -j ACCEPT
$IPCHAINS -A icmp-acc -p icmp --icmp-type time-exceeded -j ACCEPT
$IPCHAINS -A icmp-acc -p icmp --icmp-type parameter-problem -j ACCEPT
echo "Setting up ICMP major restrictions..."
$IPCHAINS -A input -p icmp -j icmp-acc
$IPCHAINS -A forward -p icmp -j MASQ
$IPCHAINS -A output -p icmp -j icmp-acc
echo "Loading modules for masquerading..."
insmod ip_masq_ftp
insmod ip_masq_irc
insmod ip_masq_quake
insmod ip_masq_raudio
insmod ip_masq_vdolive
insmod ip_masq_cuseeme
# die Kernelmodule ip_masq_ftp und Co. scheinen im Kernel 2.4.x nicht mehr
# vorhanden zu sein ?
echo -n "Firewall active"
echo -e "$return"
;;
stop)
echo "Shutting down the Firewall (and disabling routing): "
echo 0 > /proc/sys/net/ipv4/ip_forward 2> /dev/null
$IPCHAINS -P input ACCEPT
$IPCHAINS -P output ACCEPT
$IPCHAINS -P forward ACCEPT
$IPCHAINS -F icmp-acc
$IPCHAINS -F input
$IPCHAINS -F output
$IPCHAINS -F forward || return=$rc_failed
echo "Removing firewall modules..."
rmmod ip_masq_cuseeme ip_masq_vdolive
rmmod ip_masq_raudio ip_masq_quake
rmmod ip_masq_irc ip_masq_ftp
echo -n "Fireall disabled..."
echo -e "$return"
;;
restart)
$0 start || return=$rc_failed
;;
reload)
$0 start || return=$rc_failed
;;
status)
echo "Checking the status of the Firewall: "
$IPCHAINS -L || return=$rc_failed
;;
*)
echo "Usage: $0 {start|stop|status|restart|reload}"
exit 1
;;
esac
# Inform the caller not only verbosely and set an exit status.
test "$return" = "$rc_done" || exit 1
exit 0
</font><hr></pre></blockquote>
