【求助】一个iptables脚本，做ftp端口映射，请大家帮忙看看！

下流砥柱

这个脚本做ftp端口影射之后，内网那台提供ftp服务的机器，看到的IP都是网关上的内网IP，这样一旦做了IP线程设置之后，就麻烦了，每个外部连接，对这台ftp服务器而言都看成了同一个IP(内网网关的IP)，这个脚本怎么回事？先谢谢了。。。

1. 
   
2. SYSCTL="/sbin/sysctl -w"
   
3. 
   
4. IPT="/sbin/iptables"
   
5. IPTS="/sbin/iptables-save"
   
6. IPTR="/sbin/iptables-restore"
   
7. 
   
8. INET_IFACE="eth1"
   
9. INET_ADDRESS="61.xxx.xxx.xxx"
   
10. 
    
11. LOCAL_IFACE="eth0"
    
12. LOCAL_IP="172.16.1.2"
    
13. LOCAL_NET="172.16.1.0/24"
    
14. LOCAL_BCAST="172.16.1.255"
    
15. 
    
16. LO_IFACE="lo"
    
17. LO_IP="127.0.0.1"
    
18. 
    
19. if [ "$1" = "save" ]
    
20. then
    
21. echo -n "Saving firewall to /etc/sysconfig/iptables ... "
    
22. $IPTS > /etc/sysconfig/iptables
    
23. echo "done"
    
24. exit 0
    
25. elif [ "$1" = "restore" ]
    
26. then
    
27. echo -n "Restoring firewall from /etc/sysconfig/iptables ... "
    
28. $IPTR < /etc/sysconfig/iptables
    
29. echo "done"
    
30. exit 0
    
31. fi
    
32. 
    
33. echo "Loading kernel modules ..."
    
34. 
    
35. /sbin/modprobe ip_tables
    
36. 
    
37. /sbin/modprobe ip_conntrack fxp=1
    
38. 
    
39. /sbin/modprobe ipt_MASQUERADE
    
40. 
    
41. /sbin/modprobe ip_nat_ftp
    
42. 
    
43. /sbin/modprobe iptable_nat
    
44. 
    
45. #allow poptop vpn clien in modules ^_^
    
46. /sbin/modprobe ppp_mppe
    
47. 
    
48. /sbin/modprobe ip_conntrack_ftp
    
49. 
    
50. /sbin/modprobe ip_conntrack_irc
    
51. 
    
52. if [ "$SYSCTL" = "" ]
    
53. then
    
54. echo "1" > /proc/sys/net/ipv4/ip_forward
    
55. else
    
56. $SYSCTL net.ipv4.ip_forward="1"
    
57. fi
    
58. 
    
59. if [ "$SYSCTL" = "" ]
    
60. then
    
61. echo "1" > /proc/sys/net/ipv4/tcp_syncookies
    
62. else
    
63. $SYSCTL net.ipv4.tcp_syncookies="1"
    
64. fi
    
65. 
    
66. if [ "$SYSCTL" = "" ]
    
67. then
    
68. echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
    
69. else
    
70. $SYSCTL net.ipv4.conf.all.rp_filter="1"
    
71. fi
    
72. 
    
73. if [ "$SYSCTL" = "" ]
    
74. then
    
75. echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
    
76. else
    
77. $SYSCTL net.ipv4.icmp_echo_ignore_broadcasts="1"
    
78. fi
    
79. 
    
80. if [ "$SYSCTL" = "" ]
    
81. then
    
82. echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
    
83. else
    
84. $SYSCTL net.ipv4.conf.all.accept_source_route="0"
    
85. fi
    
86. 
    
87. if [ "$SYSCTL" = "" ]
    
88. then
    
89. echo "1" > /proc/sys/net/ipv4/conf/all/secure_redirects
    
90. else
    
91. $SYSCTL net.ipv4.conf.all.secure_redirects="1"
    
92. fi
    
93. 
    
94. if [ "$SYSCTL" = "" ]
    
95. then
    
96. echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
    
97. else
    
98. $SYSCTL net.ipv4.conf.all.log_martians="1"
    
99. fi
    
100. 
     
101. 
     
102. echo "Flushing Tables ..."
     
103. 
     
104. $IPT -P INPUT ACCEPT
     
105. $IPT -P FORWARD ACCEPT
     
106. $IPT -P OUTPUT ACCEPT
     
107. $IPT -t nat -P PREROUTING ACCEPT
     
108. $IPT -t nat -P POSTROUTING ACCEPT
     
109. $IPT -t nat -P OUTPUT ACCEPT
     
110. $IPT -t mangle -P PREROUTING ACCEPT
     
111. $IPT -t mangle -P OUTPUT ACCEPT
     
112. 
     
113. $IPT -F
     
114. $IPT -t nat -F
     
115. $IPT -t mangle -F
     
116. 
     
117. $IPT -X
     
118. $IPT -t nat -X
     
119. $IPT -t mangle -X
     
120. 
     
121. if [ "$1" = "stop" ]
     
122. then
     
123. echo "Firewall completely flushed! Now running with no firewall."
     
124. exit 0
     
125. fi
     
126. 
     
127. $IPT -P OUTPUT DROP
     
128. $IPT -P FORWARD DROP
     
129. 
     
130. echo "Create and populate custom rule chains ..."
     
131. 
     
132. $IPT -N bad_packets
     
133. 
     
134. $IPT -N bad_tcp_packets
     
135. 
     
136. $IPT -N icmp_packets
     
137. 
     
138. $IPT -N udp_inbound
     
139. 
     
140. $IPT -N udp_outbound
     
141. 
     
142. $IPT -N tcp_inbound
     
143. 
     
144. $IPT -N tcp_outbound
     
145. 
     
146. 
     
147. $IPT -A bad_packets -p ALL -m state --state INVALID -j LOG \
     
148. --log-prefix "fp=bad_packets:1 a=DROP "
     
149. 
     
150. $IPT -A bad_packets -p ALL -m state --state INVALID -j DROP
     
151. 
     
152. $IPT -A bad_packets -p tcp -j bad_tcp_packets
     
153. 
     
154. $IPT -A bad_packets -p ALL -j RETURN
     
155. 
     
156. $IPT -A bad_tcp_packets -p tcp -i $LOCAL_IFACE -j RETURN
     
157. 
     
158. $IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \
     
159. --log-prefix "fp=bad_tcp_packets:1 a=DROP "
     
160. $IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
     
161. 
     
162. $IPT -A bad_tcp_packets -p tcp -j RETURN
     
163. 
     
164. $IPT -A icmp_packets --fragment -p ICMP -j LOG \
     
165. --log-prefix "fp=icmp_packets:1 a=DROP "
     
166. $IPT -A icmp_packets --fragment -p ICMP -j DROP
     
167. 
     
168. $IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
     
169. 
     
170. $IPT -A icmp_packets -p ICMP -j RETURN
     
171. 
     
172. $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 137 -j DROP
     
173. $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 138 -j DROP
     
174. 
     
175. $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 113 -j REJECT
     
176. 
     
177. $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 53 -j ACCEPT
     
178. 
     
179. $IPT -A udp_inbound -p UDP -s 0/0 --source-port 67 --destination-port 68 \
     
180. -j ACCEPT
     
181. 
     
182. $IPT -A udp_inbound -p UDP -j RETURN
     
183. 
     
184. $IPT -A udp_outbound -p UDP -s 0/0 -j ACCEPT
     
185. 
     
186. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 113 -j REJECT
     
187. 
     
188. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 80 -j ACCEPT
     
189. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 8080 -j ACCEPT
     
190. 
     
191. [color=red]$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 21 -j ACCEPT[/color]
     
192. 
     
193. $IPT -A tcp_inbound -p TCP -s 0/0 --source-port 20 -j ACCEPT
     
194. 
     
195. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 62000:64000 -j ACCEPT
     
196. 
     
197. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 25 -j ACCEPT
     
198. 
     
199. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 110 -j ACCEPT
     
200. 
     
201. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 143 -j ACCEPT
     
202. 
     
203. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 22 -j ACCEPT
     
204. 
     
205. 
     
206. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 5000:5100 -j ACCEPT
     
207. 
     
208. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 6891:6900 -j ACCEPT
     
209. 
     
210. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 1723 -j ACCEPT
     
211. 
     
212. $IPT -A tcp_inbound -p TCP -j RETURN
     
213. 
     
214. $IPT -A tcp_outbound -p TCP -s 0/0 -j ACCEPT
     
215. 
     
216. echo "Process INPUT chain ..."
     
217. 
     
218. $IPT -A INPUT -p ALL -i $LO_IFACE -j ACCEPT
     
219. 
     
220. $IPT -A INPUT -p ALL -j bad_packets
     
221. 
     
222. $IPT -A INPUT -p ALL -d 224.0.0.1 -j DROP
     
223. 
     
224. $IPT -A INPUT -p ALL -i $LOCAL_IFACE -s $LOCAL_NET -j ACCEPT
     
225. $IPT -A INPUT -p ALL -i $LOCAL_IFACE -d $LOCAL_BCAST -j ACCEPT
     
226. 
     
227. $IPT -A INPUT -p UDP -i $LOCAL_IFACE --source-port 68 --destination-port 67 \
     
228. -j ACCEPT
     
229. 
     
230. 
     
231. $IPT -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
     
232. -j ACCEPT
     
233. 
     
234. $IPT -A INPUT -p TCP -i $INET_IFACE -j tcp_inbound
     
235. $IPT -A INPUT -p UDP -i $INET_IFACE -j udp_inbound
     
236. $IPT -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
     
237. 
     
238. $IPT -A INPUT -p ALL -d 255.255.255.255 -j DROP
     
239. 
     
240. $IPT -A INPUT -j LOG --log-prefix "fp=INPUT:99 a=DROP "
     
241. 
     
242. 
     
243. echo "Process FORWARD chain ..."
     
244. 
     
245. 
     
246. $IPT -A FORWARD -p ALL -j bad_packets
     
247. 
     
248. $IPT -A FORWARD -p tcp -i $LOCAL_IFACE -j tcp_outbound
     
249. 
     
250. $IPT -A FORWARD -p udp -i $LOCAL_IFACE -j udp_outbound
     
251. 
     
252. $IPT -A FORWARD -p ALL -i $LOCAL_IFACE -j ACCEPT
     
253. 
     
254. $IPT -A FORWARD -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
     
255. -j ACCEPT
     
256. 
     
257. [color=red]$IPT -A FORWARD -p tcp -i $INET_IFACE --destination-port 21 \
     
258. --destination 172.16.1.52 -j ACCEPT[/color]
     
259. 
     
260. $IPT -A FORWARD -j LOG --log-prefix "fp=FORWARD:99 a=DROP "
     
261. 
     
262. 
     
263. echo "Process OUTPUT chain ..."
     
264. 
     
265. 
     
266. $IPT -A OUTPUT -m state -p icmp --state INVALID -j DROP
     
267. 
     
268. $IPT -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
     
269. $IPT -A OUTPUT -p ALL -o $LO_IFACE -j ACCEPT
     
270. 
     
271. $IPT -A OUTPUT -p ALL -s $LOCAL_IP -j ACCEPT
     
272. $IPT -A OUTPUT -p ALL -o $LOCAL_IFACE -j ACCEPT
     
273. 
     
274. $IPT -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT
     
275. 
     
276. $IPT -A OUTPUT -j LOG --log-prefix "fp=OUTPUT:99 a=DROP "
     
277. 
     
278. 
     
279. 
     
280. echo "Load rules for nat table ..."
     
281. 
     
282. 
     
283. [color=red]$IPT -t nat -A PREROUTING -p tcp -i $INET_IFACE --destination-port 21 \
     
284. -j DNAT --to-destination 172.16.1.52:21[/color]
     
285. 
     
286. $IPT -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE
     
287. $IPT -t nat -A POSTROUTING -o $LOCAL_IFACE -j MASQUERADE
     
288. 
     
289. #allow poptop vpn
     
290. iptables -A INPUT -i ppp+ -j ACCEPT
     
291. iptables -A FORWARD -i ppp+ -j ACCEPT
     
292. 
     
293. echo "Load rules for mangle table ..."
     

复制代码

xjdong

用 shorewall 吧，可以很好的解决你的问题。
http://www.linuxsir.cn/forum.php?mod=viewthread&tid=78668