su questo forum ho trovato uno script per settare iptables secondo le occorrenze di ognuno, l'ho quindi copiato e modificato per le mie esigenze:
Codice: Seleziona tutto
#!/bin/bash
#
# Firewall
############################################
#########################
# Definizione Variabili #
#########################
IPTABLES="/sbin/iptables"
IFLO="lo"
IFEXT="eth0" # Da sostituire con la propria interfaccia: eth0, eth1, ppp0, etc
case "$1" in
start)
########################
# Attivazione Firewall #
########################
echo -n "Attivazione Firewall: "
#################################
# Caricamento Moduli del Kernel #
#################################
modprobe ip_tables
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ipt_LOG
modprobe ipt_MARK
modprobe ipt_MASQUERADE
modprobe ipt_REDIRECT
modprobe ipt_REJECT
modprobe ipt_TOS
modprobe ipt_limit
modprobe ipt_mac
modprobe ipt_mark
modprobe ipt_multiport
modprobe ipt_state
modprobe ipt_tos
modprobe iptable_mangle
############################
# Reset delle impostazioni #
############################
$IPTABLES -F
$IPTABLES -F -t nat
$IPTABLES -F -t mangle
$IPTABLES -X
$IPTABLES -X -t nat
$IPTABLES -X -t mangle
################################
# Impostazione Policy standard #
################################
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT ACCEPT
#################################
# Abilitazione traffico interno #
#################################
$IPTABLES -A INPUT -i $IFLO -j ACCEPT
$IPTABLES -A OUTPUT -o $IFLO -j ACCEPT
#############################################################################
# Regole #
#############################################################################
$IPTABLES -A INPUT -p tcp -i $IFEXT -m state -s 0/0 --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p icmp -i $IFEXT -m state -s 0/0 --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p udp -i $IFEXT -m state -s 0/0 --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p tcp -i $IFEXT --dport 80 -j ACCEPT
$IPTABLES -A INPUT -p tcp -i $IFEXT --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -i $IFEXT --dport 20:21 -j ACCEPT
$IPTABLES -A INPUT -p tcp -i $IFEXT --dport 60000:60050 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m state -s 0/0 --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -p icmp -m state -s 0/0 --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -p udp -m state -s 0/0 --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 80 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 443 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 20:21 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 43 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 123 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset
echo "ok"
;;
stop)
###########################
# Disattivazione Firewall #
###########################
echo -n "Disattivazione Firewall: "
$IPTABLES -F
$IPTABLES -F -t nat
$IPTABLES -F -t mangle
$IPTABLES -X
$IPTABLES -X -t nat
$IPTABLES -X -t mangle
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT
echo "ok"
;;
status)
##############################
# Display stato del Firewall #
##############################
echo -n "Regole attuali nel Firewall: "
$IPTABLES -L
;;
restart|reload)
$0 stop
$0 start
;;
*)
echo "Utilizzo: firewall {start|stop|restart|reload|status}" >&2
exit 1
;;
esac
exit 0
quello che non mi torna è perchè così come è impostato il firewall tutto funziona, ma se cambio la policy standard
$IPTABLES -P OUTPUT ACCEPT
droppandola
$IPTABLES -P OUTPUT DROP
ftp non funziona più (mentre ssh si per esempio).
eppure le porte 20 e 21 le ho aperte sia in input che in output, perciò dovrebbe comunque funzionare...
chi mi spiega dove sbaglio?
