给予网吧使用的Nat+Iptables+Squid的脚本

viento

#!/bin/bash
# 飘飘的风于2003年7月26日修改,端口影射成功。

###--------------------------------------------------------------------###
#以下是定义变数
###--------------------------------------------------------------------###

PATH=/sbin:/usr/sbin:/bin:/usr/bin
RC_SQUID=/etc/rc.d/init.d/squid
EXT_IF=eth1
#外网接口,确定网卡,如果是拨号就用ppp0
INT_IF=eth0
LAN_IP_RANGE="192.168.0.0/24"
STATIC_IP="80.234.71.88"
TRUSTED_TCP_PORT="22 25 53 80 110 143 443 993 995 3389"
TRUSTED_UDP_PORT="53 3389"
ALLOWED_ICMP="0 3 3/4 4 11 12 14 16 18"


###--------------------------------------------------------------------###
#确定iptables安装情况
###--------------------------------------------------------------------###

which iptables &>/dev/null || {
echo
echo "$(basename $0): iptables程序没有找到"
echo "请先安装好这个程序."
echo
exit 1
}

###--------------------------------------------------------------------###
#废掉ipchains,这是针对redhat以前的版本,新版已经把iptables嵌到内核里了
###--------------------------------------------------------------------###

lsmod | grep ipchains &>/dev/null && {
echo "正在废掉ipchains服务........."
rmmod ipchains
}

###--------------------------------------------------------------------###
#装载模块modules
###--------------------------------------------------------------------###

echo "模块正在载人......"
modprobe ip_tables &>/dev/null || {
echo -n "$(basename $0): ip_tables模块载人失败"
echo "请检查"
exit 3
}
for file in /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/ip_conntrack_*.o
do
    module=$(basename $file)
    modprobe ${module%.*} &>/dev/null
done
for file in /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/ip_nat_*.o
do
    module=$(basename $file)
    modprobe ${module%.*} &>/dev/null
done

# ------------- 端口开启 ------------
echo "开启所要的端口...."
iptables -N services
for PORT in $TRUSTED_TCP_PORT; do
    iptables -A services -i $EXT_IF -p tcp --dport $PORT -j ACCEPT
done
for PORT in $TRUSTED_UDP_PORT; do
    iptables -A services -i $EXT_IF -p udp --dport $PORT -j ACCEPT
done



#----ipforwarding--------
echo "打开foward功能"
echo "1" > /proc/sys/net/ipv4/ip_forward

#动态ip使用
#
#echo "1" > /proc/sys/net/ipv4/ip_dynaddr
#这里是动态ip实现nat共享必改之处

###---------------------------------------------------###
#清除先前的设定
###---------------------------------------------------###
echo "正在清除先前的设定......."
#清除预定表filter中,所有规则链中的规则
iptables -F
#清除预定表filter中,使用者自定链中的规则
iptables -X

#清除预定表mangle中,所有规则链中的规则
iptables -F -t mangle
#清除预定表mangle中,使用者自定链中的规则
iptables -X -t mangle

#清除nat表中的规则
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat

###---------------------------------------------------###
#设定预设规则
###---------------------------------------------------###
#预设规则要么为全部丢弃，要么为全部接受
#本列为全部丢弃，然后逐步开放，这是安全系数很高的设法
#若目标为DROP,则policy设为ACCEPT;若目标为ACCEPT,则policy设为DROP

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

#TCP的设定
#
#我们丢弃坏的TCP包
#

iptables -A FORWARD -p TCP ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
iptables -A FORWARD -p TCP ! --syn -m state --state NEW -j DROP

#局域网共享的实现
#iptables -t nat -A POSTROUTING -o $EXT_IF -s $LAN_IP_RANGE -j SNAT --to-source $STATIC_IP
iptables -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE
echo "局域网共享的已实现,请试用局域网机器"

#这一步实现局域网内部机对外部网开放
#凡对$STATIC_IP:80连线者，则转址到192.168.0.100:80
iptables -t nat -A PREROUTING -d 80.234.71.88 -p tcp --dport 80 -j DNAT --to-destination 192.168.0.100:80
iptables -A FORWARD -p tcp -d 192.168.0.100 --dport 80 -j ACCEPT
iptables -t nat -I POSTROUTING -s 192.168.0.0/255.255.255.0 -p tcp -d 192.168.0.100 --dport 80 -j SNAT --to 192.168.0.1
#192.168.0.250装有win2003,提供远程桌面服务
iptables -t nat -A PREROUTING -d 80.234.71.88 -p tcp --dport 3389 -j DNAT --to-destination 192.168.0.250:3389
iptables -A FORWARD -p tcp -d 192.168.0.250 --dport 3389 -j ACCEPT
#允许内网机使用外网机的IP访问内网机，把内网机的IP转换成网关IP
iptables -t nat -I POSTROUTING -s 192.168.0.0/255.255.255.0 -p tcp -d 192.168.0.250 --dport 3389 -j SNAT --to 192.168.0.1


#允许要转向的包
iptables -A FORWARD -i $INT_IF -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT
#对于不管来自哪里的ip碎片都进行控制，允许每秒通过100个碎片
iptables -A FORWARD -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT
#icmp包通过的控制，防止icmp黑客攻击
iptables -A FORWARD -p udp -d $LAN_IP_RANGE -i $EXT_IF -j ACCEPT
#这一条是针对oicq等使用udp服务而接收所有的udp包

#开放主机的ssh port 22,使内部机以ssh连至外部
iptables -A OUTPUT -o $EXT_IF -p tcp -s $STATIC_IP --sport 1024:65535 -d any/0 --dport 22 -j ACCEPT
iptables -A INPUT -i $EXT_IF -p tcp ! --syn -s any/0 --sport 22 -d $STATIC_IP --dport 1024:65535 -j ACCEPT

#防止外网用内网ip欺骗
iptables -t nat -A PREROUTING -i $EXT_IF -s 192.168.0.0/16 -j DROP
iptables -t nat -A PREROUTING -i $EXT_IF -s 10.0.0.0/8 -j DROP
iptables -t nat -A PREROUTING -i $EXT_IF -s 172.16.0.0/12 -j DROP

#-----------透明代理------------
$RC_SQUID status | grep pid &>/dev/null && {
echo "透明代理实现"
INT_IP=$(ifconfig | grep $INT_IF -A 1 | awk '/inet/ {print $2}' | sed -e s/addr\://)
if [ -z "$INT_IP" ]; then
echo
echo "$(basename $0): $INT_IF没有IP存在"
echo "请检查$INT_IF是否正确配置了"
echo
exit 3
fi
}
exit 0
## EOS

小牛

顶！这样的东西越多越好！

stanlogin

very good!

wuchy1

我是菜鸟.对不起,我想请问一下#!/bin/bash这是什么意思?还有!/bin/bash下面的10行,写在什么地方?其他的倒是能能看懂.我今天刚学到squid这个服务这里,问题虽然有点笨,也有点愚蠢,但是我有诚意想学的.拜托,那位高手看见我的帖子,告诉我一下好吗~~~~求求你们了

lanmaster

非常不错的脚本,收藏

lanmaster

拜读过该文章之后,对以下几个地方有点不解,望楼主给予解释:

ALLOWED_ICMP="0 3 3/4 4 11 12 14 16 18"  这句为何意?

viento

http://www.longen.org/e-k/detaile~k/ICMP.htm

wuchy1

楼主，对不起啊，我想请问你一下这个脚本怎么用啊，或者是写在那里啊。我刚刚接触代理服务器这一块

viento

存档，chmod 755, 执行。

空心菜

#!/bin/bash
#
# Script name: ipt_masq
# A simple script for masquerading, used in Linux (kernel 2.4.x).
#
# Copyleft 2002 by netman (netman@study-area.org).
#
# Redistribution of this file is permitted under the terms of
# the GNU General Public License (GPL).
#
# Date: 2002/02/04
# Version: 1.2

PATH=/sbin:/usr/sbin:/bin:/usr/bin
RC_SQUID=/etc/rc.d/init.d/squid
EXT_IF=ppp0
INT_IF=eth1
ALLOWED_ICMP="0 3 3/4 4 11 12 14 16 18"
DENIED_ICMP="8"

#
# ------------- ensure iptables ----------
which iptables &>/dev/null || {
echo
echo "$(basename $0): iptables program is not found."
echo " Please install the program first."
echo
exit 1
}
# ------------- disable ipchains ----------
lsmod | grep ipchains &>/dev/null && {
echo "Disabling ipchains..."
rmmod ipchains &>/dev/null
}

# ------------- modules -----------
echo "Loading modules..."
modprobe ip_tables &>/dev/null || {
echo -n "$(basename $0): loading ip_tables module failure."
echo " Please Fix it!"
exit 3
}
for file in /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/ip_conntrack_*.o
do
module=$(basename $file)
modprobe ${module%.*} &>/dev/null
done
for file in /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/ip_nat_*.o
do
module=$(basename $file)
modprobe ${module%.*} &>/dev/null
done

# ------------- ipforwarding -----------
echo "Turning on IP forwarding..."
echo "1" > /proc/sys/net/ipv4/ip_forward

# ------------- anti spoofing -----------
echo "Turning on anti-spoofing..."
for file in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo "1" > $file
done

# ------------- flushing ----------
echo "Cleaning up..."
iptables -F -t filter
iptables -X -t filter
iptables -Z -t filter
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat

# ------------- policies -------------
echo "Setting up policies to ACCEPT..."
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT

# ------------- ICMP -------------
echo "Creating icmpfilter chain..."
iptables -N icmpfilter
for TYPE in $DENIED_ICMP; do
iptables -A icmpfilter -i $EXT_IF -p icmp \
--icmp-type $TYPE -j DROP
done
for TYPE in $ALLOWED_ICMP; do
iptables -A icmpfilter -i $EXT_IF -p icmp \
--icmp-type $TYPE -j ACCEPT
done

# ------------- block -------------
echo "Creating block chain..."
iptables -N block
iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A block -m state --state NEW,INVALID -i $EXT_IF -j DROP
iptables -A block -m state --state NEW -i ! $EXT_IF -j ACCEPT
iptables -A block -j DROP

# ------------- filter -------------
echo "Filtering packets..."
iptables -A INPUT -j icmpfilter
iptables -A INPUT -j block
iptables -A FORWARD -j icmpfilter
iptables -A FORWARD -j block

# ------------- masq -------------
echo "Masquerading internel network..."
iptables -t nat -A POSTROUTING -o $EXT_IF -j MASQUERADE

# ------------- tproxy -------------
$RC_SQUID status | grep pid &>/dev/null && {
echo "Enabling transparent proxy..."
INT_IP=$(ifconfig | grep "$INT_IF " -A 1 \
| awk '/inet/ {print $2}' | sed -e s/addr\://)
if [ -z "$INT_IP" ]; then
echo
echo "$(basename $0): there is no IP found on $INT_IF."
echo " Please make sure $INT_IF is setup properly."
echo
exit 3
fi
iptables -t nat -A PREROUTING -d $INT_IP -i $INT_IF \
-p tcp -m tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i $INT_IF -p tcp -m tcp \
--dport 80 -j REDIRECT --to-ports 3128
}
echo "Success!"
exit 0
## EOS

这是原文，用了他之后，如果不开squid的话，内网机子可以访问外网，可是如果开了的话，内网机子就不能，说是没有root权限