Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Scaricare il pdf (Pagina 27)

#!/bin/sh

# iptables.sh

# An example of a simple iptables configuration.

# This script allows ALL outbound traffic, and denies

# ALL inbound connection attempts from the Internet interface only.

###################################################################

# Begin variable declarations and user configuration options ######

IPTABLES=/sbin/iptables

# Local Interfaces

# This is the WAN interface that is our link to the outside world.

# For pppd and pppoe users.

# WAN_IFACE="ppp0"

WAN_IFACE="eth0"

## end user configuration options #################################

###################################################################

# Any and all addresses from anywhere.

ANYWHERE="0/0"

# This module may need to be loaded:

modprobe ip_conntrack_ftp

# Start building chains and rules #################################

# Let's start clean and flush all chains to an empty state.

$IPTABLES −F

# Set the default policies of the built−in chains. If no match for any

# of the rules below, these will be the defaults that IPTABLES uses.

$IPTABLES −P FORWARD DROP

$IPTABLES −P OUTPUT ACCEPT

$IPTABLES −P INPUT DROP

# Accept localhost/loopback traffic.

$IPTABLES −A INPUT −i lo −j ACCEPT

## ICMP (ping)

# ICMP rules, allow the bare essential types of ICMP only. Ping

# request is blocked, ie we won't respond to someone else's pings,

# but can still ping out.

$IPTABLES −A INPUT −p icmp −−icmp−type echo−reply \

−s $ANYWHERE −i $WAN_IFACE −j ACCEPT

$IPTABLES −A INPUT −p icmp −−icmp−type destination−unreachable \

−s $ANYWHERE −i $WAN_IFACE −j ACCEPT

$IPTABLES −A INPUT −p icmp −−icmp−type time−exceeded \

−s $ANYWHERE −i $WAN_IFACE −j ACCEPT

###################################################################

# Set the catchall, default rule to DENY, and log it all. All other

# traffic not allowed by the rules above, winds up here, where it is

# blocked and logged. This is the default policy for this chain

# anyway, so we are just adding the logging ability here with '−j

# LOG'. Outgoing traffic is allowed as the default policy for the

# 'output' chain. There are no restrictions on that.

Security Quick−Start HOWTO for Red Hat Linux

5.2.2. iptables 24

1 2 ... 22 23 24 25 26 27 28 29 30 31 32 ... 81 82

Commenti su questo manuale

Nessun commento

Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Pagina 27

Commenti su questo manuale