Zdraveite, ako niakoi mozhe da mi pomogne s donapisvaneto na
tozi skript, shte mu buda kraino blagodaren.
Eto kakvo triabva da mu bude donapraveno:
1. Da se pusne neogranichena skorost na vutreshnata mrezha do
vunshnata (192.168.0.0 <->
83.148.109.0/83.148.103.0/85.187.13.0).
t.e. da mogat da tegliat ot lokalniia neogranicheno.
2. Da se ogranichi i mezhdunarodnata skorost! Razpolagam s ip
list na bgpeering.
3. Da se dobavi i MAC zashtita.
Molia pomognete. Niamam vremeto da procheta i naizustia lartc
Eto go i skripcheto mi:
#!/bin/sh
IPTABLES=/usr/sbin/iptables
LAN=192.168.0.1/29
LAN_ETH=eth1
INET_IP=83.148.109.208
INET_ETH=eth0
echo "1" > /proc/sys/net/ipv4/ip_forward
$IPTABLES -P OUTPUT DROP
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -F
$IPTABLES -F -t nat
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT
$IPTABLES -A FORWARD -i $LAN_ETH -s $LAN -p tcp --sport
137:139 -d ! $LAN -j DROP
$IPTABLES -A FORWARD -i $LAN_ETH -s $LAN -p udp --sport
135:139 -d ! $LAN -j DROP
$IPTABLES -A FORWARD -i $LAN_ETH -s $LAN -p tcp --sport 445
-d ! $LAN -j DROP
$IPTABLES -A FORWARD -i $LAN_ETH -s $LAN -p udp --sport 445
-d ! $LAN -j DROP
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -s $LAN
-j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -s
83.148.109.0/24 -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -s
83.148.103.0/24 -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -s
85.187.13.0/24 -j ACCEPT
$IPTABLES -A INPUT -i $LAN_ETH -s $LAN -j ACCEPT
$IPTABLES -A OUTPUT -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j
ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j
ACCEPT
$IPTABLES -t nat -A POSTROUTING -o $INET_ETH -s 192.168.0.2
-d ! 192.168.0.2 -j SNAT --to 83.148.103.208
$IPTABLES -t nat -A POSTROUTING -o $INET_ETH -s 192.168.0.3
-d ! 192.168.0.3 -j SNAT --to 83.148.103.208
$IPTABLES -t nat -A POSTROUTING -o $INET_ETH -s 192.168.0.4
-d ! 192.168.0.4 -j SNAT --to 83.148.103.208
$IPTABLES -t nat -A POSTROUTING -o $INET_ETH -s 192.168.0.5
-d ! 192.168.0.5 -j SNAT --to 83.148.103.208
$IPTABLES -t nat -A POSTROUTING -o $INET_ETH -s 192.168.0.6
-d ! 192.168.0.6 -j SNAT --to 83.148.103.208
$IPTABLES -A FORWARD -i $LAN_ETH -s $LAN -d ! $LAN -o
$INET_ETH -j ACCEPT
$IPTABLES -A INPUT -i $INET_ETH -p tcp --dport 139 -j
ACCEPT
$IPTABLES -A INPUT -i $INET_ETH -p tcp --dport 21 -j ACCEPT
$IPTABLES -A INPUT -i $INET_ETH -p tcp --dport 80 -j ACCEPT
$IPTABLES -A INPUT -i $INET_ETH -p tcp --dport 25 -j ACCEPT
$IPTABLES -A INPUT -i $INET_ETH -p tcp --dport 110 -j
ACCEPT
$IPTABLES -A INPUT -i $INET_ETH -p tcp --dport 143 -j
ACCEPT
$IPTABLES -A INPUT -i $INET_ETH -p tcp --dport 631 -j
ACCEPT
$IPTABLES -A INPUT -i $INET_ETH -p tcp --dport 53 -j ACCEPT
$IPTABLES -A INPUT -i $INET_ETH -p udp --dport 53 -j ACCEPT
$IPTABLES -A INPUT -i $INET_ETH -p tcp --dport 6890 -j
ACCEPT
$IPTABLES -A FORWARD -o $INET_ETH -s 192.168.0.4 -p tcp
--sport 6890 -j ACCEPT
$IPTABLES -A FORWARD -i $INET_ETH -p tcp -d 192.168.0.4
--dport 6890 -j ACCEPT
$IPTABLES -A PREROUTING -t nat -i $INET_ETH -p tcp -d
83.148.103.208 --dport 6890 -j DNAT --to 192.168.0.4
$IPTABLES -A INPUT -i $INET_ETH -p udp --dport 6890 -j
ACCEPT
$IPTABLES -A FORWARD -o $INET_ETH -s 192.168.0.4 -p udp
--sport 6890 -j ACCEPT
$IPTABLES -A FORWARD -i $INET_ETH -p udp -d 192.168.0.4
--dport 6890 -j ACCEPT
$IPTABLES -A PREROUTING -t nat -i $INET_ETH -p udp -d
83.148.103.208 --dport 6890 -j DNAT --to 192.168.0.4
#shaper
tc qdisc add dev eth1 root handle 1: cbq avpkt 10000
bandwidth 100mbit
tc class add dev eth1 parent 1: classid 1:1 cbq rate 100mbps
allot 1500 prio 5 isolated
tc class add dev eth1 parent 1:1 classid 1:10 cbq rate
200kbps allot 1500 prio 5 bounded
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32
match ip dst 192.168.0.2 flowid 1:10
tc class add dev eth1 parent 1:1 classid 1:10 cbq rate
200kbps allot 1500 prio 5 bounded
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32
match ip dst 192.168.0.3 flowid 1:10
tc class add dev eth1 parent 1:1 classid 1:10 cbq rate
200kbps allot 1500 prio 5 bounded
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32
match ip dst 192.168.0.4 flowid 1:10
tc class add dev eth1 parent 1:1 classid 1:10 cbq rate
200kbps allot 1500 prio 5 bounded
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32
match ip dst 192.168.0.5 flowid 1:10
tc class add dev eth1 parent 1:1 classid 1:10 cbq rate
200kbps allot 1500 prio 5 bounded
tc filter add dev eth1 protocol ip parent 1:0 prio 1 u32
match ip dst 192.168.0.6 flowid 1:10
|
