exemple de script

J'avais fait une fois ce script pour montrer comment on se servait d'iptable, si ça peut te servir.
Tu peux le diffuser, améliorer, bref ce que tu veux.


#! /bin/sh

## Firewall
## DESCRIPTION:
## Firewall for home use, with detailed explanations


########################
## some variables ##
########################
IPTABLES=`which iptables`
MODPROBE=`which modprobe`
verbose=1

LOOP='lo'
LAN='eth0'
NET='eth1'

IP_FORWARD='1'
RP_FILTER='1'

SSH_PORT='22'
TORRENT_PORT='26680'
#EKIGA_PORT='1720'
EMULE_TCP_PORT='14662'
EMULE_UDP_PORT='14672'
#SIP_UDP_PORT='5060'
#RTP_PORT='8000'

# Bacula ports
BACULA_DIR='9101'
BACULA_FD='9102'
BACULA_SD='9103'

# define your range of IPs in your LAN
LOCAL_NETWORK='192.168.0.0'
LOCAL_NETMASK='24'

# ECHO = 'echo' or '#', depending the verbosity you want
ECHO='echo'

# This script use ulogd to log accepted or rejected connexions
# in the default /var/log/ulogd/syslogemu.log file.
# Because of that, you need the ulogd deamon to be installed on your host.
# If you can not have ulogd on your host, replace ULOG by LOG, and all the log
# will be in the /var/log/syslog file

if [ `which ulogd` ] ; then
LOGFILE='ULOG'
else LOGFILE='LOG'
fi

do_start() {


####################
## Default policy ##
####################

if [ $verbose ]; then
$ECHO -n "Setting default policy ... "
fi

# the FILTER table is used to filter, so DROP policy by default
for chain in INPUT FORWARD ; do
$IPTABLES -t filter -P $chain DROP
done
$IPTABLES -t filter -P OUTPUT ACCEPT # except for the OUTPUT chain (adapt it according your needs)

# the NAT table is used to nat packet, it does not work for filtering, so ACCEPT policy by default
for chain in PREROUTING POSTROUTING OUTPUT ; do
$IPTABLES -t nat -P $chain ACCEPT
done

# the MANGLE table is used to make a lot of things (don't know in details - it alters packets, usefull for QoS - and don't used in this firewall configuration)
for chain in PREROUTING FORWARD INPUT OUTPUT POSTROUTING ; do
$IPTABLES -t mangle -P $chain ACCEPT
done

if [ $verbose ] ; then
$ECHO "done"
fi



############################
## Loading needed modules ##
############################
if [ $verbose ] ; then
$ECHO -n "Loading iptables & conntrack modules ... "
fi

kernel_release=`uname -r` # to find the kernel version in use

for i in `ls /lib/modules/$kernel_release/kernel/net/ipv4/netfilter/` ; do # list all modules available
$MODPROBE `basename $i .ko` # extract the name of the module, without the extension .ko
done

if [ $verbose ] ; then
$ECHO "done"
fi


##########################
## Kernel configuration ##
##########################

# IP_FORWARD='1' -> your host is used as a router; 0 if not
if [ $verbose ] ; then
if [ $IP_FORWARD ] ; then
$ECHO -n "Enabling IP forwarding ... "
else $ECHO -n "Disabling IP forwarding ... "
fi
fi

if [ -r /proc/sys/net/ipv4/ip_forward ]; then
echo $IP_FORWARD > /proc/sys/net/ipv4/ip_forward
fi

if [ $verbose ] ; then
$ECHO "done"
fi


# rp_filter prevents from receiving packets from an interface with an IP address not in the range defined in this interface
if [ $verbose ] ; then
if [ $RP_FILTER ] ; then
$ECHO -n "Enabling rp_filter ... "
else $ECHO -n "Disabling rp_filter ... "
fi
fi

if [ -r /proc/sys/net/ipv4/conf/all/rp_filter ] ; then
echo $RP_FILTER > /proc/sys/net/ipv4/conf/all/rp_filter
fi

if [ $verbose ] ; then
$ECHO "done"
fi


#########################
## Clear configuration ##
#########################

if [ $verbose ] ; then
$ECHO -n "Clearing configuration ... "
fi

for table in filter nat mangle ; do
$IPTABLES -t $table -F # clear the predefined chains for the table $table
$IPTABLES -t $table -X # clear the user chains for the table $table
done

if [ $verbose ] ; then
$ECHO "done"
fi


#############################################################
## Creation & configuration of user chains to log packets ##
#############################################################
if [ $verbose ] ; then
$ECHO -n "Creating & configuring user chains ... "
fi

for chain in LOG SSH HTTP ICMP P2P WRONG_PACKET ; do
#echo "create chain" $chain
$IPTABLES -t filter -N ${chain}_ACCEPT # create the accepted packets chain
$IPTABLES -t filter -N ${chain}_DROP # create the dropped packets chain

$IPTABLES -t filter -A ${chain}_ACCEPT -j $LOGFILE --ulog-prefix "[${chain}_ACCEPT]" # first it logs the packet
$IPTABLES -t filter -A ${chain}_ACCEPT -j ACCEPT # then it accepts the packet

$IPTABLES -t filter -A ${chain}_DROP -j $LOGFILE --ulog-prefix "[${chain}_DROP]" # first it logs the packet
$IPTABLES -t filter -A ${chain}_DROP -j DROP # then it drops the packet
done

if [ $verbose ] ; then
$ECHO "done"
fi


###################################################################
# now the tables and the chains are initialized and ready
# we will create the rules for each chain
# the configuration follows the path taken by a packet
###################################################################


#===============================================================#
# PREROUTING chain ... #
#===============================================================#

#############################
## ... of the mangle table ##
#############################

# ...

##########################
## ... of the nat table ##
##########################

# ...


#================================================================#
# INPUT chain ... #
#================================================================#

#############################
## ... of the filter table ##
#############################

$IPTABLES -t filter -A INPUT -i $LOOP -j ACCEPT
$IPTABLES -t filter -A INPUT -i $NET -s 127.0.0.0/8 -j WRONG_PACKET_DROP # packets with IP 127.x.x.x can not come from the $NET interface

$IPTABLES -t filter -A INPUT -i $NET -p udp --sport 67:68 -j ACCEPT # for DHCP packets

$IPTABLES -t filter -A INPUT -p tcp --syn -m multiport --dports $SSH_PORT,$TORRENT_PORT -j LOG_ACCEPT
$IPTABLES -t filter -A INPUT -p tcp --syn --dport $TORRENT_PORT -j P2P_ACCEPT
#$IPTABLES -t filter -A INPUT -p tcp --syn --dport $EKIGA_PORT -j LOG_ACCEPT
$IPTABLES -t filter -A INPUT -p tcp --syn --dport $EMULE_TCP_PORT -j P2P_ACCEPT
$IPTABLES -t filter -A INPUT -p udp --dport $EMULE_UDP_PORT -j P2P_ACCEPT
#$IPTABLES -t filter -A INPUT -p udp --dport $SIP_UDP_PORT -j ACCEPT
#$IPTABLES -t filter -A INPUT -p udp --dport $RTP_PORT -j ACCEPT
#$IPTABLES -t filter -A INPUT -p udp --dport $WENGO_UDP_PORT1 -j ACCEPT
#$IPTABLES -t filter -A INPUT -p udp --dport $WENGO_UDP_PORT2 -j ACCEPT


# Bacula Director daemon access
$IPTABLES -t filter -A INPUT -p tcp --syn -s $PORCINET --dport $BACULA_DIR -j ACCEPT
$IPTABLES -t filter -A INPUT -p tcp --syn -s $TIGROU --dport $BACULA_DIR -j ACCEPT

# Bacula Storage daemon access
$IPTABLES -t filter -A INPUT -p tcp --syn -s $PORCINET --dport $BACULA_SD -j ACCEPT
$IPTABLES -t filter -A INPUT -p tcp --syn -s $TIGROU --dport $BACULA_SD -j ACCEPT



$IPTABLES -t filter -A INPUT -p icmp --icmp-type echo-request -j ICMP_ACCEPT # for incoming ping request
$IPTABLES -t filter -A INPUT -p icmp --icmp-type echo-reply -j ICMP_ACCEPT # for replies from our ping request

$IPTABLES -t filter -A INPUT -d 255.255.255.255 -j DROP
$IPTABLES -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -t filter -A INPUT -m state --state NEW -j LOG_DROP


#############################
## ... of the mangle table ##
#############################

# ...


#================================================================#
# OUTPUT chain ... #
#================================================================#

#############################
## ... of the mangle table ##
#############################

# ...

##########################
## ... of the nat table ##
##########################

# ...

#############################
## ... of the filter table ##
#############################

$IPTABLES -t filter -A OUTPUT -o $LOOP -j ACCEPT

#================================================================#
# FORWARD chain ... #
#================================================================#

#############################
## ... of the mangle table ##
#############################

# ...

#############################
## ... of the filter table ##
#############################

$IPTABLES -t filter -A FORWARD -i $LAN -o $NET -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -t filter -A FORWARD -i $NET -o $LAN -m state --state ESTABLISHED,RELATED -j ACCEPT


#================================================================#
# POSTROUTING chain ... #
#================================================================#

#############################
## ... of the mangle table ##
#############################

# ...

##########################
## ... of the nat table ##
##########################

$IPTABLES -t nat -A POSTROUTING -s $LOCAL_NETWORK/$LOCAL_NETMASK -o $NET -j MASQUERADE

}



do_stop() {
if [ $verbose ] ; then
$ECHO -n "Clearing configuration ... "
fi

for chain in INPUT FORWARD OUTPUT; do
$IPTABLES -t filter -P $chain ACCEPT
done

for chain in PREROUTING POSTROUTING OUTPUT ; do
$IPTABLES -t nat -P $chain ACCEPT
done

for chain in PREROUTING FORWARD INPUT OUTPUT POSTROUTING ; do
$IPTABLES -t mangle -P $chain ACCEPT
done


for table in filter nat mangle ; do
$IPTABLES -t $table -F # clear the predefined chains for the table $table
$IPTABLES -t $table -X # clear the user chains for the table $table
done

if [ $verbose ] ; then
$ECHO "done"
fi
}



case "1ドル" in
start|"")
do_start
;;

stop)
do_stop
;;

*)
echo "Usage: firewall.sh [start|stop]" >&2
exit
;;
esac