Script NAT Proxy

Contoh script NAT / Proxy

Untuk menjalankan

# ./script.sh start

Untuk mematikan

# ./script.sh stop

Isi script.sh adalah

---

1. !/bin/bash

1. From: AHK <akuhon@kompas.com>
2. To: linux-admin@linux.or.id

1. Save this file and activate through # file_name start
2. and de-activate through # file_name stop

1. This firewall-script can be used for workstation, laptop, router
2. or server that are not running network service (such as web server, ftp
3. server etc)

1. change the parameter UPLINK with Interface device to the Internet.
2. In our case WLAN router with NIC wlan0 connected to the Internet
3. and LAN connection with eth0.
4. if you use dial-up modem, you might use ppp0 as your UPLINK

UPLINK="eth1"

1. if you run the gateway as router and forward IP packet between eth devices
2. please fill .yes., if not, please fill .no.

ROUTER="no"

1. Please change 202.150.10.45 to your static IP address of UPLINK device.
2. For those who use dial-up or dynamic IP, please enter .dynamic.

1. NAT="192.168.1.100"

NAT="dynamic"

1. please list all network interfaces including eth devices
2. as well as dial-up interface such as ppp0

INTERFACES="lo eth0 eth1 eth2"

if [ "$1" = "start" ]

 then
 echo "Activate Firewall ..... "
 /sbin/iptables -F
 /sbin/iptables -P INPUT DROP
 /sbin/iptables -A INPUT -p tcp -i eth0 --destination-port 25 -s ! 192.168.0.1  -j DROP
 /sbin/iptables -A INPUT -p tcp -i eth1 --destination-port 25 -s ! 192.168.0.1  -j DROP

 /sbin/iptables -A INPUT -i ! ${UPLINK} -j ACCEPT
 /sbin/iptables -A INPUT -i ${UPLINK} -p tcp -s 0/0 --dport 25 -j ACCEPT
 /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 /sbin/iptables -A INPUT -p tcp -i ${UPLINK} -j REJECT --reject-with tcp-reset
 /sbin/iptables -A INPUT -p udp -i ${UPLINK} -j REJECT --reject-with icmp-port-unreachable
 

/sbin/iptables -A FORWARD -p tcp --destination-port 25 -s ! 192.168.0.1 -j DROP

1. block bad sites

/sbin/iptables -I INPUT -s 68.178.211.34 -j DROP /sbin/iptables -I INPUT -d 68.178.211.34 -j DROP

/sbin/iptables -I INPUT -s 64.27.5.168 -j DROP /sbin/iptables -I INPUT -d 64.27.5.168 -j DROP

1. turn off packet spoofing in all interfaces

for x in ${INTERFACES}

 do
   echo 1 > /proc/sys/net/ipv4/conf/${x}/rp_filter
 done

if [ "$ROUTER" = "yes" ]

 then
 # Activate IP forwarding at router
   echo 1 > /proc/sys/net/ipv4/ip_forward

if [ "$NAT" = "dynamic" ]

 then
 # Dynamic IP address, activate Masquerading
   echo "Activate Masquerading (Dynamic IP) ...."
   /sbin/iptables -t nat -A POSTROUTING -o ${UPLINK} -j MASQUERADE

elif [ "$NAT" != "" ]

 then
 # Static IP address use source NAT
 echo "Activate SNAT (static IP) ...."
 /sbin/iptables -t nat -A POSTROUTING -o ${UPLINK} -j SNAT --to ${NAT}

fi

1. echo "Activate Port Forwarding .."
2. /sbin/iptables -t nat -A PREROUTING -i ${UPLINK} -m multiport -p tcp \
3. --dport 25 -d ${NAT} -j DNAT --to 192.168.0.1:25
4. /sbin/iptables -A FORWARD -i ${UPLINK} -m multiport -p tcp -d 192.168.0.1 \
5. --dport 25 -j ACCEPT

fi

 elif [ "$1" = "stop" ]
   then
     echo "Deactivate Firewall ..."
     /sbin/iptables -F INPUT
     /sbin/iptables -P INPUT ACCEPT
     /sbin/iptables -F FORWARD
     /sbin/iptables -P FORWARD ACCEPT
     /sbin/iptables -F OUTPUT
     /sbin/iptables -P OUTPUT ACCEPT
     # Turn off NAT or MASQUERADING
     /sbin/iptables -t nat -F POSTROUTING

fi