DLINK3326+IPTABLES 配置说明

时间:2007-01-03 21:28:19 来源: 作者:whsong 点击:次出处:技术无忧

关键字：DLIN

创建10 20 30 40 50 5个VLAN
create vlan vlan10 tag 10
create vlan vlan20 tag 20
create vlan vlan30 tag 30
create vlan vlan40 tag 40
create vlan vlan50 tag 50

从1-24删除默认VALN
config vlan default delete 1-24

把端口加到对应的VLAN里
config vlan vlan10 add untag 1-5
config vlan vlan20 add untag 6-10
config vlan vlan30 add untag 11-15
config vlan vlan40 add untag 16-20
config vlan vlan50 add untag 21-24

让所有的VLAN相通
create ipif if10 192.168.1.254/24 vlan10
create ipif if20 192.168.2.1/24 vlan20
create ipif if30 192.168.3.1/24 vlan30
create ipif if40 192.168.4.1/24 vlan40
create ipif if50 192.168.5.1/24 vlan50

关掉VLAN1跟VLAN3 VLAN1跟VLAN5通信
create access_profile ip source_ip_mask 255.255.255.0 destination_ip_mask 255.255.255.0 deny profile_id 40
config access_profile profile_id 40 add access_id 31 ip source_ip 192.168.1.254 destination_ip 192.168.3.1
config access_profile profile_id 40 add access_id 32 ip source_ip 192.168.3.1 destination_ip 192.168.1.254
config access_profile profile_id 40 add access_id 31 ip source_ip 192.168.1.254 destination_ip 192.168.5.1
config access_profile profile_id 40 add access_id 32 ip source_ip 192.168.5.1 destination_ip 192.168.1.254

加一条出去的路由
create iproute default 192.168.1.1
iptables里我加了这些模块
comment connlimit iprange quota time account ipp2p CONNMARK
ipv4options psd mport quota string limit

#!/bin/sh
modprobe ipt_MASQUERADE
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
iptables -F
iptables -t nat -F
iptables -X
iptables -t nat -X
#iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 110,80,25 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 139 -j ACCEPT
iptables -A INPUT -i eth1 -p udp -m multiport --dports 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
iptables -A INPUT -p gre -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp --syn -m connlimit --connlimit-above 15 -j DROP
iptables -A INPUT -s 192.168.1.0/24 -p tcp --syn -m connlimit --connlimit-above 15 -j DROP
iptables -A INPUT -p icmp -m limit --limit 3/s -j LOG --log-level INFO --log-prefix "ICMP packet IN: "
iptables -A INPUT -p icmp -j DROP
iptables -t nat -A POSTROUTING -o ppp0 -s 192.168.1.0/24 -j MASQUERADE
iptables -N syn-flood
iptables -A INPUT -p tcp --syn -j syn-flood
iptables -I syn-flood -p tcp -m limit --limit 3/s --limit-burst 6 -j RETURN
iptables -A syn-flood -j REJECT
#iptables -P FORWARD DROP
iptables -A FORWARD -p tcp -s 192.168.1.0/24 -m multiport --dports 80,110,21,25,1723 -j ACCEPT
iptables -A FORWARD -p udp -s 192.168.1.0/24 --dport 53 -j ACCEPT
iptables -A FORWARD -p gre -s 192.168.1.0/24 -j ACCEPT
iptables -A FORWARD -p icmp -s 192.168.1.0/24 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#iptables -I FORWARD -p udp --dport 53 -m string --string "tencent" -m time --timestart 9:30 --timestop 17:30 --days Mon,Tue,Wed,Thu,Fri -j DROP
#iptables -I FORWARD -p udp --dport 53 -m string --string "TENCENT" -m time --timestart 9:30 --timestop 17:30 --days Mon,Tue,Wed,Thu,Fri -j DROP
#iptables -I FORWARD -s 192.168.1.0/24 -m string --string "qq.com" -m time --timestart 9:30 --timestop 17:30 --days Mon,Tue,Wed,Thu,Fri -j DROP
#iptables -I FORWARD -s 192.168.1.0/24 -m string --string "qq.com" -m time --timestart 9:30 --timestop 17:30 --days Mon,Tue,Wed,Thu,Fri -j DROP
iptables -I FORWARD -s 192.168.1.0/24 -m string --string "ay2000.net" -j DROP
iptables -I FORWARD -d 192.168.1.0/24 -m string --string "¿íӰԺ" -j DROP
iptables -I FORWARD -s 192.168.1.0/24 -m string --string "ɫÇ" -j DROP
iptables -I FORWARD -p tcp --sport 80 -m string --string "¹ã" -j DROP
iptables -A FORWARD -m ipp2p --edk --kazaa --bit -j DROP
iptables -A FORWARD -p tcp -m ipp2p --ares -j DROP
iptables -A FORWARD -p udp -m ipp2p --kazaa -j DROP
iptables -A FORWARD -p tcp --syn --dport 80 -m connlimit --connlimit-above 15 --connlimit-mask 24 -j DROP
sysctl -w net.ipv4.ip_forward=1 &>/dev/null
sysctl -w net.ipv4.tcp_syncookies=1 &>/dev/null
sysctl -w net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=3800 &>/dev/null
sysctl -w net.ipv4.ip_conntrack_max=300000 &>/dev/null
/sbin/iptables -A FORWARD -p tcp --dport 22223 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 22221 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 22224 -j ACCEPT
iptables -I INPUT -s 192.168.1.213 -j ACCEPT
iptables -I FORWARD -s 192.168.1.213 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 8117 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 1863 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 569 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 443 -j ACCEPT

在linxu里加一条路由

route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.1

route add -net 192.168.4.0 netmask 255.255.255.0 gw 192.168.1.1

允许192.168.1.xx 192.168.4.xx网段上网。。
1，我的vlan1网关是192.168.1.254
我把LINUX代理LAN口接在VLAN1里
我把PC也接在VLAN1里
网关设为192.168.1.254
IP地址设为192.168.1.40
试测结果可以上网

2，我把PC接在其它的VLAN4里
把我的PC网关设为192.168.4.1
IP地址设为192.168.1.40
上不了网。。也ping不能192.168.1.1
但是能ping通192.168.1.254(vlan1的网关)
除了VLAN1之外其它的VLAN都ping不通linux代理

想自己动手组装电脑吗？想了解市场行情吗？来技术无忧 DIY资讯一切烦脑都没有！