Squid加IpTables实现网关防火墙的方法

# FORWARD chain

$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets

$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT

$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "

# OUTPUT chain

$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets

$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT

$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT

$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT

$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "

# SNAT table

$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP

# DNAT table

$IPTABLES -t nat -A PREROUTING -p ! icmp -d $INET_IP -dport 53 -j DNAT --to-destination 192.168.0.254:53

# REDIRECT

$IPTABLES -t nat -A PREROUTING -i $LAN_IFACE -p tcp -s $LAN_IP_RANGE --dport 80 -j REDIRECT --to-ports 60080

touch /var/lock/subsys/firewall

}

stop(){

echo -n $"Stoping firewall:"

echo "0">;/proc/sys/net/ipv4/ip_forward

$IPTABLES -P INPUT ACCEPT

$IPTABLES -P FORWARD ACCEPT

$IPTABLES -P OUTPUT ACCEPT

$IPTABLES -t nat -P PREROUTING ACCEPT

$IPTABLES -t nat -P POSTROUTING ACCEPT

$IPTABLES -t nat -P OUTPUT ACCEPT

$IPTABLES -t mangle -P PREROUTING ACCEPT

$IPTABLES -t mangle -P OUTPUT ACCEPT

$IPTABLES -F

$IPTABLES -t nat -F

$IPTABLES -t mangle -F

$IPTABLES -X

$IPTABLES -t nat -X

$IPTABLES -t mangle -X

rm -f /var/lock/subsys/firewall

}

status(){

clear

echo "-------------------------------------------------------------------"

$IPTABLES -L

echo "-------------------------------------------------------------------"

$IPTABLES -t nat -L POSTROUTING

echo "-------------------------------------------------------------------"

$IPTABLES -t nat -L PREROUTING

}

case "$1" in

start)

start

;;

stop)

stop

;;

restart)

stop

start

;;

*)

echo "$0 [start|stop|restart|status]"

;;

esac

cp firewall /etc/init.d/

chmod 700 /etc/init.d/firewall

chkconfig --add firewall