이야기 마을 :: 내 첫번째 iptables 로 구성한 방화벽...너무한다..ㅜㅜ

##################################################
# iptables script #
# written by zekill #
# DO NOT USE THE -t (table) OPTION IN THIS FILE! #
##################################################

*filter
# default
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# loopback accept
-A INPUT -s 127.0.0.1 -j ACCEPT

# local ip accept
-A INPUT -s 192.168.0.0/24 -j ACCEPT
-A FORWARD -s 192.168.0.0/24 -j ACCEPT
-A FORWARD -d 192.168.0.0/24 -j ACCEPT

# syn packet drop
-A INPUT -i eth0 -m tcp -p TCP ! --syn -j ACCEPT

# dns c/s accept
#-A INPUT -i eth0 -m udp -p TCP --dport 53 -j ACCEPT
#-A INPUT -i eth0 -m udp -p UDP --dport 53 -j ACCEPT

# ftp
-A INPUT -i eth0 -m tcp -p TCP --dport 209 -j ACCEPT
-A INPUT -i eth0 -m tcp -p TCP --dport 210 -j ACCEPT

# http & ssl
-A INPUT -i eth0 -m tcp -p TCP --dport 8000 -j ACCEPT
#-A INPUT -i eth0 -m tcp -p TCP --dport 443 -j ACCEPT

# pong accept
-A INPUT -i eth0 -m icmp -p ICMP --icmp-type echo-reply -j ACCEPT

# established & related Accept (ex: ftp-data connect)
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# my IB com
-A INPUT -s xxx.xxx.xxx.0/24 -j ACCEPT

COMMIT

*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

# start address change
#-A POSTROUTING -s 192.168.0.0/24 -o eth0 -j SNAT --to xxx.xxx.xxx.20

# Masquerade
-A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE

# ftp posting
#-A PREROUTING -i eth0 -m tcp -p TCP --dport 209 -j DNAT --to 192.168.0.2:209
#-A PREROUTING -i eth0 -m tcp -p TCP --dport 210 -j DNAT --to 192.168.0.2:210

# http & ssl posting
#-A PREROUTING -i eth0 -m tcp -p TCP --dport 8000 -j DNAT --to 192.168.0.2:80
#-A PREROUTING -i eth0 -m tcp -p TCP --dport 443 -j DNAT --to 192.168.0.2:443

# Terminal Service posting
-A PREROUTING -i eth0 -m tcp -p TCP --dport 3389 -j DNAT --to 192.168.0.2:3389

COMMIT

*mangle
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A PREROUTING -p tcp --sport 22 -j TOS --set-tos Minimize-Delay
-A PREROUTING -p tcp --sport 210 -j TOS --set-tos Minimize-Delay
-A PREROUTING -p tcp --sport 209 -j TOS --set-tos Maximize-Throughput

-A OUTPUT -p tcp --dport 22 -j TOS --set-tos Minimize-Delay
-A OUTPUT -p tcp --dport 210 -j TOS --set-tos Minimize-Delay
-A OUTPUT -p tcp --dport 209 -j TOS --set-tos Maximize-Throughput

COMMIT