Packets from LAN, DMZ or

# # Packets from LAN, DMZ or LOCALHOST #

# # From DMZ Interface to DMZ firewall IP #

$IPTABLES -A INPUT -p ALL -i $DMZ_IFACE
-d $DMZ_IP -j ACCEPT

# # From LAN Interface to LAN firewall IP #

$IPTABLES -A INPUT -p ALL -i $LAN_IFACE
-d $LAN_IP -j ACCEPT

# # From Localhost interface to Localhost IP's #

$IPTABLES -A INPUT -p ALL -i $LO_IFACE
-s $LO_IP -j ACCEPT $IPTABLES -A INPUT -p ALL -i $LO_IFACE
-s $LAN_IP -j ACCEPT $IPTABLES -A INPUT -p ALL -i $LO_IFACE
-s $INET_IP -j ACCEPT

# # Special rule for DHCP requests from LAN,
which are not caught properly # otherwise. #

$IPTABLES -A INPUT -p UDP -i $LAN_IFACE
--dport 67 --sport 68 -j ACCEPT

# # All established and related packets incoming
from the internet to the # firewall #

$IPTABLES -A INPUT -p ALL -d $INET_IP -m state
--state ESTABLISHED,RELATED \ -j ACCEPT

# # In Microsoft Networks you will be swamped
by broadcasts. These lines # will prevent them from showing up in the logs. #

#$IPTABLES -A INPUT -p UDP -i $INET_IFACE
-d $INET_BROADCAST \ #--destination-port 135:139 -j DROP

# # If we get DHCP requests from the Outside
of our network, our logs will # be swamped as well. This rule will block
them from getting logged. #

#$IPTABLES -A INPUT -p UDP -i $INET_IFACE
-d 255.255.255.255 \ #--destination-port 67:68 -j DROP

# # If you have a Microsoft Network on the
outside of your firewall, you may # also get flooded by Multicasts. We drop
them so we do not get flooded by # logs #

#$IPTABLES -A INPUT -i $INET_IFACE
-d 224.0.0.0/8 -j DROP

# # Log weird packets that don't match the above. #

$IPTABLES -A INPUT -m limit --limit 3/minute
--limit-burst 3 -j LOG \ --log-level DEBUG --log-prefix
"IPT INPUT packet died: "

# # 4.1.5 FORWARD chain #

# # Bad TCP packets we don't want #

$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets

# # DMZ section # # General rules #

$IPTABLES -A FORWARD -i $DMZ_IFACE
-o $INET_IFACE -j ACCEPT $IPTABLES -A FORWARD -i $INET_IFACE
-o $DMZ_IFACE -m state \ --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -i $LAN_IFACE
-o $DMZ_IFACE -j ACCEPT $IPTABLES -A FORWARD -i $DMZ_IFACE
-o $LAN_IFACE -m state \ --state ESTABLISHED,RELATED -j ACCEPT


Содержание  Назад  Вперед

---

Forekc.ru
Рефераты, дипломы, курсовые, выпускные и квалификационные работы, диссертации, учебники, учебные пособия, лекции, методические пособия и рекомендации, программы и курсы обучения, публикации из профильных изданий

---