도와 주세요 브릿지 ,iptables.. 고수님 이것좀 봐주세요..-.-''

등록 2001-12-24 134239 조회 13
이름 ych3372

안녕하세요. 고수님들 브릿지를 이용할때..방화벽을 iptables를 이용했는
데..
커널 2.4.16에서는 only iptables를 사용한다고 하더군요.
그래서 커널ㅇ르 2.4.16으로 올리고 iptables를 여기 저기 에서 보고 뺏겨
서.
우선은 이렇게 만들었는데요.. 패킷이 나가질 않던데.. 머가 잘못되었는지
좀 봐주세요..
여기 저기 고수님들이 만들어 놓은거 뺏겼거든요..
#!/bin/sh
#
# TOS(Type of Service)
# minimum delay 0x10
# maximum throughput 0x08
# maximum reliability 0x04
# minimum cost 0x02
# nomarl service 0x00
#!! Minimize-Delay 16 (0x10)
#!! Maximize-Throughput 8 (0x08)
#!! Maximize-Reliability 4 (0x04)
#!! Minimize-Cost 2 (0x02)
#!! Normal-Service 0 (0x00)

################################################################
echo ""
echo "Setting BRIDGE - FireWall ... start "

IPTABLES="/sbin/iptables"

# 체인 추가
# input, output, forward는 ipchain의 기본 체인임.
# shbridge은 브릿지를 관통하는(forward되는) 체인임.
# waninput은 wan에서 redzone 서버로 들어오는 체인임.
# laninput은 lan에서 reazone 서버로 들어오는 체인임.
# br_out은 redzone 서버에서 외부로 나가는 체인임.

echo " RESET NETWORK FOR PACKET FILTERING SERVICE"
echo

CHKCHAIN=0

# 서비스를 시작하기전 초기화
echo " * Reset Basic Table"
${IPTABLES} -Z
CHKCHAIN=$?
echo -n " Reset Chain Counter "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -P INPUT ACCEPT
CHKCHAIN=$?
echo -n " Accept All INPUT Chain "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -F INPUT
CHKCHAIN=$?
echo -n " Remove rule of INPUT Chain "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -P OUTPUT ACCEPT
CHKCHAIN=$?
echo -n " Accept All FORWARD Chain "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -F FORWARD
CHKCHAIN=$?
echo -n " Remove rule of FORWARD Chain "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -P FORWARD ACCEPT
CHKCHAIN=$?
echo -n " Accept All OUTPUT Chain "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -F OUTPUT
CHKCHAIN=$?
echo -n " Remove rule of OUTPUT Chain "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -P SHBRIDGE ACCEPT
CHKCHAIN=$?
echo -n " Accept All SHBRIDGE Chain "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -F SHBRIDGE
CHKCHAIN=$?
echo -n " Remove rule of SHBRIDGE Chain "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

echo
echo " * Reset NAT Table"
${IPTABLES} -t nat -Z
CHKCHAIN=$?
echo -n " Reset NAT Tabel Counter "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -t nat -P PREROUTING ACCEPT
CHKCHAIN=$?
echo -n " Accept All PREROUTING Chain "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -t nat -F PREROUTING
CHKCHAIN=$?
echo -n " Remove rule of PREROUTING "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -t nat -P POSTROUTING ACCEPT
CHKCHAIN=$?
echo -n " Accept All POSTROUTING Chain "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -t nat -F POSTROUTING
CHKCHAIN=$?
echo -n " Remove rule of POSTROUTING "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

echo
echo " * Reset Mangle Table"

${IPTABLES} -t mangle -Z
CHKCHAIN=$?
echo -n " Reset MANGLE Tabel Counter "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -t mangle -P PREROUTING ACCEPT
CHKCHAIN=$?
echo -n " Accept All PREROUTING Chain "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -t mangle -F PREROUTING
CHKCHAIN=$?
echo -n " Remove rule of PREROUTING "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -t mangle -P OUTPUT ACCEPT
CHKCHAIN=$?
echo -n " Accept All OUTPUT Chain "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -t mangle -F OUTPUT
CHKCHAIN=$?
echo -n " Remove rule of OUTPUT "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -t mangle -P SHBRIDGE ACCEPT
CHKCHAIN=$?
echo -n " Accept All SHBRIDGE Chain "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

${IPTABLES} -t mangle -F SHBRIDGE
CHKCHAIN=$?
echo -n " Remove rule of SHBRIDGE "
[ "${CHKCHAIN}" -eq 0 ] && echo "OK"
[ "${CHKCHAIN}" -ne 0 ] && echo "Failed"

KPCHK=0

# ip 주소를 스푸핑한다고 예상되는 경우 로그에 기록하기

echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
KPCHK=$?
echo -n " * Logged Spoofing check "
[ "${KPCHK}" -eq 0 ] && echo "OK"
[ "${KPCHK}" -ne 0 ] && echo "Failed"

# 브로드캐스트, 멀티캐스트 주소에 ICMP 메시지 보내는것 막기
# "smurf" 공격 방지용
# 아래에서 해당 조항 참고
# 커널 2.2 이상에 해당

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
KPCHK=$?
echo -n " * Deny Ping at BroadCast "
[ "${KPCHK}" -eq 0 ] && echo "OK"
[ "${KPCHK}" -ne 0 ] && echo "Failed"

## LOG 형식
LOGFORMAT="-m limit --limit 1/h --limit-burst 3 -j LOG"

###### WAN TO LAN (eth1)######
echo " WAN TO LAN "
${IPTABLES} -A SHBRIDGE -s xxx.xxx.xxx.xxx -d xxx.xxx.xxx.xxx -o
eth1 -j
ACCEPT
${IPTABLES} -A SHBRIDGE -s xxx.xxx.xxx.xxx/25 -d xxx.xxx.xxx.xxx/25 -
o
eth1 -j DROP
${IPTABLES} -A SHBRIDGE -p icmp -s 0/0 -d xxx.xxx.xxx.xxx/25 -o
eth1 -j
DROP
${IPTABLES} -A SHBRIDGE -p tcp -s ! xxx.xxx.xxx.xxx/25 -d
xxx.xxx.xxx.xxx --dport 80 -o eth1 -j ACCEPT ${LOGFORMAT} --log-
prefix
${IPTABLES} -A SHBRIDGE -p tcp -s ! xxx.xxx.xxx.xxx/25 -d
xxx.xxx.xxx.xxx --dport 80 -o eth1 -j ACCEPT
${IPTABLES} -A SHBRIDGE -p tcp -s ! xxx.xxx.xxx.xxx/25 -d
xxx.xxx.xxx.xxx --dport 23 -o eth1 -j ACCEPT
${IPTABLES} -A SHBRIDGE -p tcp -s ! xxx.xxx.xxx.xxx/25 -d
xxx.xxx.xxx.xxx/25 --dport 137139 -o eth1 -j DROP ${LOGFORMAT} --
log-
prefix
${IPTABLES} -A SHBRIDGE -p udp -s ! xxx.xxx.xxx.xxx/25 -d
xxx.xxx.xxx.xxx/25 --dport 137139 -o eth1 -j DROP ${LOGFORMAT} --
log-
prefix
${IPTABLES} -A SHBRIDGE -p udp -s ! xxx.xxx.xxx.xxx/25 -d
xxx.xxx.xxx.xxx/25 -o eth1 -j DROP
${IPTABLES} -A SHBRIDGE -p all -s ! xxx.xxx.xxx.xxx/25 -d
xxx.xxx.xxx.xxx/25 -o eth1 -j ACCEPT
#${IPTABLES} -A SHBRIDGE -m state --state INVALID -j DROP

##### LAN TO WAN (eth0)#####
echo " LAN TL WAN "
${IPTABLES} -A SHBRIDGE -s xxx.xxx.xxx.xxx/25 -d !
xxx.xxx.xxx.xxx/25 -
o eth0 -j ACCEPT
${IPTABLES} -A SHBRIDGE -s xxx.xxx.xxx.xxx/25 -d !
xxx.xxx.xxx.xxx/25 -
o eth0 -j ACCEPT

##### LAN TO LAN (eth0)#####
echo " LAN TO LAN "
${IPTABLES} -A SHBRIDGE -s xxx.xxx.xxx.xxx/25 -d
xxx.xxx.xxx.xxx/25 -o
eth0 -j ACCEPT

# TOS 설정
#
echo
echo "TOS Configuration"
echo

${IPTABLES} -t mangle -A SHBRIDGE -p tcp -s 0/0 --sport 80 -j
TOS --
set-tos 0x10
${IPTABLES} -t mangle -A SHBRIDGE -p tcp -d 0/0 --dport 21 -j
TOS --
set-tos 0x10
${IPTABLES} -t mangle -A SHBRIDGE -p tcp -d 0/0 --dport 22 -j
TOS --
set-tos 0x10
${IPTABLES} -t mangle -A SHBRIDGE -p tcp -d 0/0 --dport 23 -j
TOS --
set-tos 0x10
${IPTABLES} -t mangle -A SHBRIDGE -p tcp -d 0/0 --dport 23 -j
TOS --
set-tos 0x10
${IPTABLES} -t mangle -A SHBRIDGE -p tcp -s 0/0 --sport 20 -j
TOS --
set-tos 0x08
여기서 mangle은 머하는 건지여?...

대충 이렇게 설정을 했는데요.. 커널 2.2.20 에서 IPCHAINS로는 지금도 잘
쓰
고 있는데요. IPTABLES를 보니까.. 좋은 옵션들이 많아서 이번기회에 바
꿔 볼
려구 하는데.. 잘안됩니다..
커널 부분에 NET FITER부분을 모두 M으로 설정을 했구요..
그럼 고수님들의 큰 가르침 부탁드립니다.
아님 mangle은 어떨때..쓰는것인지 만이라도.. -.-'