Firewall에 사용할 패킷필터링...

#!/bin/bash
#
# FTP passive 모드 때문에 1024-65546 포트를
# 다 열어놨기 때문에 문제의 소지가 다분히 있음
# 방법을 강구해 보기로 함. 딴사람들은 어떻게 하지?
#

########## 변수설정
IPT="/sbin/iptables"
SERVER="xxx.xxx.xxx.xxx"
NETWORK="xxx.xxx.xxx.xxx/26"

########## iptables 정책 초기화
$IPT -X
$IPT -F
$IPT -Z

########## CHAIN 정책 설정
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT

########## 브릿지 접근설정
# gilsion 자리에서만 bridge 로 ssh 접속 가능
$IPT -A INPUT -p tcp -s xxx.xxx.xxx.xxx --dport 22 -j ACCEPT
#$IPT -A INPUT -p tcp -s $NETWORK --dport 22 -j ACCEPT

########## 비정상 패킷통행 모두 거부
$IPT -A FORWARD -m state --state INVALID -j DROP
$IPT -A FORWARD -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPT -A FORWARD -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPT -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPT -A FORWARD -p tcp --tcp-flags RST RST,ACK -j DROP

########## DNS QUERY
$IPT -A FORWARD -p udp --sport 53 -j ACCEPT
$IPT -A FORWARD -p udp --dport 53 -j ACCEPT

########## SERVER 설정
# 나가는 패킷은 모두 허용
$IPT -A FORWARD -s $SERVER -j ACCEPT
# HTTP
$IPT -A FORWARD -d $SERVER -p tcp --dport 80 -j ACCEPT
# SMTP
$IPT -A FORWARD -d $SERVER -p tcp --dport 25 -j ACCEPT
$IPT -A FORWARD -d $SERVER -p tcp --dport 587 -j ACCEPT
$IPT -A FORWARD -d $SERVER -p udp --dport 587 -j ACCEPT
# FTP
$IPT -A FORWARD -d $SERVER -p tcp --dport 21 -j ACCEPT
# FTP PASSIVE
$IPT -A FORWARD -d $SERVER -p tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT
$IPT -A FORWARD -d $SERVER -j DROP

######## 네트웍 전체 설정
# 나가는 패킷은 모두 허용
$IPT -A FORWARD -s $NETWORK -j ACCEPT
#HTTP, HTTPS
$IPT -A FORWARD -p tcp --sport 80 -j ACCEPT
$IPT -A FORWARD -p tcp --sport 443 -j ACCEPT
#SSH
$IPT -A FORWARD -p tcp --sport 22 -j ACCEPT
#POP3
$IPT -A FORWARD -p tcp --sport 110 -j ACCEPT
#FTP (passive mode 포함)
$IPT -A FORWARD -p tcp --sport 21 -j ACCEPT
$IPT -A FORWARD -p tcp --sport 20 -j ACCEPT
$IPT -A FORWARD -p tcp --sport 1024:65535 --dport 1024:65535 -j ACCEPT
$IPT -A FORWARD -p tcp --dport 113 -j ACCEPT
# MSN
$IPT -A FORWARD -p tcp --dport 1863:1864 -j ACCEPT
$IPT -A FORWARD -p tcp --dport 6901 -j ACCEPT
$IPT -A FORWARD -p tcp --dport 7801:7825 -j ACCEPT
$IPT -A FORWARD -p tcp --dport 6891:6900 -j ACCEPT

########## 허용하지 않은 모든 패킷 거부
$IPT -A FORWARD -j DROP