Изпечатай

[tuxi]

Какъв трафик трябва да разреша за да могат потребителите да се свързват с ftp сървъра през eth1
(при тези настройки потребителите не могат да се свъжат през eth1)
това е съдържанието на /еtc/init.d/firewall

#!/bin/sh
IPTABLES=/sbin/iptables
EXTIF="eth1"
INTIF="eth0"
echo "   External Interface:  $EXTIF"
echo "   Internal Interface:  $INTIF"
echo "   Enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward
########################################
$IPTABLES -P INPUT DROP
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABLES -t nat -F
########################################
echo "  Loading firewall"
$IPTABLES -A INPUT -i eth0 -j ACCEPT
$IPTABLES -A INPUT -i eth1 -p tcp --dport 80 -j ACCEPT
$IPTABLES -A INPUT -i eth1 -m state --state ! NEW,INVALID -j ACCEPT
$IPTABLES -A INPUT -i eth1 -p tcp --dport 21 -j ACCEPT
$IPTABLES -A INPUT -i eth1 -p udp --dport 21 -j ACCEPT
########################################
echo "  Allow all connections OUT and only existing and related ones IN"
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG
echo "   Enabling SNAT (MASQUERADE) functionality on $EXTIF"
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

Добави след

Примерен код

echo "   External Interface:  $EXTIF" echo "   Internal Interface:  $INTIF" echo "   Enabling forwarding.." echo "1" > /proc/sys/net/ipv4/ip_forward

нещо като следното:

Примерен код

/sbin/modprobe arptable_filter /sbin/modprobe arp_tables /sbin/modprobe ip_conntrack_amanda /sbin/modprobe ip_conntrack_ftp /sbin/modprobe ip_conntrack_irc /sbin/modprobe ip_conntrack /sbin/modprobe ip_conntrack_tftp /sbin/modprobe ip_nat_amanda /sbin/modprobe ip_nat_ftp /sbin/modprobe ip_nat_irc /sbin/modprobe ip_queue /sbin/modprobe iptable_filter /sbin/modprobe iptable_mangle /sbin/modprobe iptable_nat /sbin/modprobe ip_tables /sbin/modprobe ipt_ah /sbin/modprobe ipt_conntrack /sbin/modprobe ipt_dscp /sbin/modprobe ipt_DSCP /sbin/modprobe ipt_ecn /sbin/modprobe ipt_ECN /sbin/modprobe ipt_esp /sbin/modprobe ipt_helper /sbin/modprobe ipt_length /sbin/modprobe ipt_limit /sbin/modprobe ipt_LOG /sbin/modprobe ipt_mac /sbin/modprobe ipt_mark /sbin/modprobe ipt_MARK /sbin/modprobe ipt_MASQUERADE /sbin/modprobe ipt_MIRROR /sbin/modprobe ipt_multiport /sbin/modprobe ipt_owner /sbin/modprobe ipt_pkttype /sbin/modprobe ipt_REDIRECT /sbin/modprobe ipt_REJECT /sbin/modprobe ipt_state /sbin/modprobe ipt_tcpmss /sbin/modprobe ipt_TCPMSS /sbin/modprobe ipt_tos /sbin/modprobe ipt_ttl /sbin/modprobe ipt_unclean

[tuxi]

всичко е наред няма съобщения за грешки при изпълнението на скрипта след добавянето на кода по горе, а проблема е бил при потребителя

Това ти трябва, ако го добавяш към работещa firewall/NAT конфигурация.:

iptables -A FORWARD -m tcp -p tcp --dport 20:21 -j ACCEPT

(modprobe) ip_conntrack_ftp