Habe Suse Linux 9.0 mit den neuesten Updates.
hier noch das Script
#####
# QUICK Firewalling Script
# 02.09.2003 14:36, Stefan Seitz s.seitz@seibercon.de
#
# This script is customized for use on the LAN Gateway @ SeiBerCon
#
#
### BEGINN INIT INFO
# Provides: PW_QUICK_FIREWALL
# Required-Start:
# Dependencies:
# Dep-Only
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop:
# Description: This script configures some lan forwarding and firewalling on the external
# interface.
### END INIT INFO
LAN=eth1
WAN=ppp0
IPLAN=192.168.0.1/24
####
# Configure addintional Interface - not used for SeiBerCon
# ifconfig $LAN 192.168.1.128/24 up
# ifconfig $WLAN 192.168.1.128/24 up
# ifconfig $DMZ 192.168.1.128/24 up
######
# Clear existing iptables rules
# And set default policies
iptables -F
iptables -F -t nat
iptables -X
iptables -X -t nat
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
######
# Spoofing Protection
iptables -A INPUT -j LOG --log-prefix SPOOF-DROP- -i ! lo -s 127.0.0.0/8
iptables -A INPUT -j DROP -i ! lo -s 127.0.0.0/8
iptables -A OUTPUT -j LOG -o ! lo --log-prefix SPOOF-DROP- -d 127.0.0.0/8
iptables -A OUTPUT -j DROP -o ! lo -d 127.0.0.0/8
iptables -A INPUT -j LOG --log-prefix SPOOF-DROP- -i $WAN -s $IPLAN
iptables -A INPUT -j DROP -i $WAN -s $IPLAN
######
# Local Machine Settings
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
#####
# LAN Communication
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o $WAN -p tcp --dport 25 -j ACCEPT
#####
# LAN Routing functionality
#iptables -A FORWARD -i 'LAN -o $WLAN -j ACCEPT
iptables -A FORWARD -i $LAN -o $WAN -j ACCEPT
iptables -A FORWARD -i $WAN -o $LAN -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $LAN -o $LAN -j ACCEPT
#########
## GLOBAL Rules (not interface / subnet specific)
######
# ICMP Rule (reduce timeout times)
iptables -A INPUT -p icmp --icmp-type destination-unreachable -m state --state RELATED -j ACCEPT
iptables -A INPUT -p icmp --icmp-type time-exceeded -m state --state RELATED -j ACCEPT
#### UDP
# Accept DNS
iptables -A INPUT -p udp --source-port 53 -m state --state ESTABLISHED -j ACCEPT
####
# Enabeling FORWARDED Remote Services Ports (http,pop3,smtp,eMule) on WAN interface
iptables -A PREROUTING -t nat -p tcp -i $WAN --dport 4662 -j DNAT --to 192.168.0.7:4662
iptables -A PREROUTING -t nat -p tcp -i $WAN --dport 4672 -j DNAT --to 192.168.0.7:4672
iptables -A FORWARD -p tcp -i $WAN --dport 4662 -j ACCEPT
iptables -A FORWARD -p tcp -i $WAN --dport 4672 -j ACCEPT
######
# Accept all related/established input
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#####
# SSH to LOCALHOST
iptables -A INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
#####
# NRPC to LOCALHOST
iptables -A INPUT -m state --state NEW -p tcp --dport 1352 -j ACCEPT
#iptables -A INPUT -m state --state NEW -p tcp --dport 8585 -j ACCEPT
iptables -A INPUT -m state --state NEW -p tcp --dport 2050 -j ACCEPT
####
# SMTP on LOCALHOST
iptables -A INPUT -m state --state NEW -p tcp --dport 25 -j ACCEPT
####
# HTTP
#iptables -A INPUT -i eth1 -s 10.1.1.0/24 -p tcp --dport http -m state --state NEW -j ACCEPT
# Enable IT Forwarding and DYN-IP Patch and MASQ and SYNCookies (flood protect)
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/ip_dynaddr
#####
# END OF QUICK FIREWALLING SCRIPT
####
MfG Berlin22m
