portforwarding iptables

Post Reply
Message
Author
ghoja

portforwarding iptables

#1 Post by ghoja »

Hallo zusammen

ich möchte 3 ports forwarden. das folgende script habe ich in einer wilden copy & past aktion zusammengsetellt. leider funktioniert es nicht. kann jemand schnell dreinschauen? würde dieses script auch anderen traffic als der der über die forgewardeten ports läuft weiterleiten? vielen dank...


Script

#!/bin/sh

# network interfaces
# eth1: lan
# eth0: inet

# flush current settings

iptables -F
iptables -X


# drop if not accepted

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP


# enable device

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A INPUT -i eth1 -j ACCEPT
iptables -A OUTPUT -o eth1 -j ACCEPT

iptables -A OUTPUT -o eth0 -j ACCEPT

# accept connections considered related or established by the
# connection tracking

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT


# some important icmp error messages

iptables -N icmp-acc
# destination-unreachable
iptables -A icmp-acc -p icmp -m icmp --icmp-type 3 -j ACCEPT
# source-quench
iptables -A icmp-acc -p icmp -m icmp --icmp-type 4 -j ACCEPT
# time-exceeded
iptables -A icmp-acc -p icmp -m icmp --icmp-type 11 -j ACCEPT
# parameter-problem
iptables -A icmp-acc -p icmp -m icmp --icmp-type 12 -j ACCEPT

# new connections from the internet to the lan

iptables -N inet-lan
iptables -A FORWARD -i eth0 -o eth1 -m state --state NEW -j inet-lan

#iptables -A inet-lan -p tcp -m tcp --dport 22 -j ACCEPT

iptables -A inet-lan -p tcp -m tcp -d 192.168.0.6 --dport 80 -j ACCEPT
iptables -A inet-lan -p tcp -m tcp -d 192.168.0.6 --dport 110 -j ACCEPT
iptables -A inet-lan -p tcp -m tcp -d 192.168.0.6 --dport 443 -j ACCEPT
iptables -A inet-lan -j icmp-acc

# new connections from the inet to this machine

iptables -N inet-localhost
iptables -A INPUT -i eth0 -m state --state NEW -j inet-localhost

iptables -A inet-localhost -j icmp-acc
iptables -A inet-localhost -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A inet-localhost -p tcp -m tcp --dport 25 -j ACCEPT
iptables -A inet-localhost -p icmp -m icmp --icmp-type 8 -j ACCEPT


# Activate IP-Forwarding

iptables -t nat -A PREROUTING -i eth0 -p tcp -d externe.ip.von.portforwader --dport 80 -j DNAT --to-destination 192.168.0.6:80
iptables -t nat -A PREROUTING -i eth0 -p tcp -d externe.ip.von.portforwader --dport 110 -j DNAT --to-destination 192.168.0.6:110
iptables -t nat -A PREROUTING -i eth0 -p tcp -d externe.ip.von.portforwader --dport 443 -j DNAT --to-destination 192.168.0.6:443
echo "1" > /proc/sys/net/ipv4/ip_forward

Post Reply