Squid加IpTables实现网关防火墙的方法

需求说明：此服务器用作网关、MAIL(开启web、smtp、pop3)、FTP、DHCP服务器，内部一台机器(192.168.0.254)对外提供dns服务,为了不让无意者轻易看出此服务器开启了ssh服务器，故把ssh端口改为2018.另把proxy的端口改为60080

eth0:218.28.20.253,外网口

eth1:192.168.0.1/24,内网口

[jackylau@proxyserver init.d]$cat /etc/squid/squid.conf(部份如下)

http_port 192.168.0.1:60080

httpd_accel_port 80

httpd_accel_host virtual

httpd_accel_with_proxy on

httpd_accel_uses_host_header on

acl allow_lan src 192.168.0.0/24

http_access allow allow_lan

visible_hostname proxyserver

[jackylau@proxyserver init.d]$ cat firewall

#!/bin/sh

# Author: jackylau ;

# chkconfig: 2345 08 92

# description: firewall

# Time on 2005.08.02

# killproc

# Set ENV

INET_IP="218.28.20.253"

INET_IFACE="eth0"

LAN_IP="192.168.0.1"

LAN_IP_RANGE="192.168.0.0/24"

LAN_BROADCAST_ADDRESS="192.168.0.255"

LAN_IFACE="eth1"

LO_IFACE="lo"

LO_IP="127.0.0.1"

IPTABLES="/sbin/iptables"

start(){

echo -n $"Starting firewall:"

/sbin/depmod -a

/sbin/modprobe ip_tables

/sbin/modprobe ip_conntrack

/sbin/modprobe iptable_filter

/sbin/modprobe iptable_mangle

/sbin/modprobe iptable_nat

/sbin/modprobe ipt_LOG

/sbin/modprobe ipt_limit

/sbin/modprobe ipt_state

echo "1" >; /proc/sys/net/ipv4/ip_forward

# Set policies

$IPTABLES -P INPUT DROP

$IPTABLES -P OUTPUT DROP

$IPTABLES -P FORWARD DROP

# Add bad_tcp_packets, allowed and icmp_packets

$IPTABLES -N bad_tcp_packets

$IPTABLES -N tcp_packets

$IPTABLES -N udp_packets

$IPTABLES -N allowed

$IPTABLES -N icmp_packets

# bad_tcp_packets

$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-level INFO --log-prefix "New not syn:"

$IPTABLES -A bad_tcp_packets -p TCP ! --syn -m state --state NEW -j DROP

# allowed

$IPTABLES -A allowed -p TCP --syn -j ACCEPT

$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A allowed -p TCP -j DROP

$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_BROADCAST_ADDRESS -j ACCEPT

# TCP rules

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 20 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 25 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 110 -j allowed

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 2018 -j allowed

# UDP rules

$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 67 -j ACCEPT

# ICMP rules

$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT

$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT

# INPUT chain

$IPTABLES -A INPUT -p tcp -j bad_tcp_packets