如何为家用路由器配置iptables？

0

我正在将Raspberry PI设置为家庭路由器，下面是我当前的iptables脚本。路由器也有

  • 代理人，
  • 桑巴，
  • CUPS，
  • BIND9，
  • 一个WLAN接入点和
  • DHCP服务器。

我不确定下面的设置是否有效，如果bind无法回答dns请求：我是否必须在输出链中的端口53上打开“NEW”连接？或者我必须将它放在FORWARD链中，因为LAN客户端执行上游请求而不是绑定。

路由器应从我的ISP通过DHCP获得IP（用于WAN接口）。路由器还应为（W）LAN客户端分配IP。我是否必须在输入和输出链的所有接口上允许udp端口67/68？

有没有办法让我的脚本更短，即在提高可读性的同时获得相同的结果？我的基本目标是向（W）LAN客户端提供已安装的服务（见上文），并为（W）LAN客户端提供对HTTP（s），IMAP，SMTP，NTP和WhatsApp的访问。

#!/bin/sh
log() {
 echo "$(date '+%b %d %H:%M:%S') $(hostname) iptablesInit: $1"
 echo "$(date '+%b %d %H:%M:%S') $(hostname) iptablesInit: $1" >> /var/log/iptablesInit.log
}

IPT="/sbin/iptables"

WAN="WAN"
LAN="LAN"
WLAN="WLAN"

# Flush all chaines
log 'Flush everything...'
$IPT -F
$IPT -X
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -t nat -F
$IPT -t nat -X

$IPT -F INPUT
$IPT -F FORWARD
$IPT -F OUTPUT
log 'Flush done'

# unlimited
$IPT -A INPUT  -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

# set policies
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP

# NAT
$IPT -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE

#===== BLOCK =====
# Block sync
$IPT -A INPUT -i ${WAN} -p tcp ! --syn -m state --state NEW  -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Drop Sync"
$IPT -A INPUT -i ${WAN} -p tcp ! --syn -m state --state NEW -j DROP

# Block Fragments
$IPT -A INPUT -i ${WAN} -f  -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fragments Packets"
$IPT -A INPUT -i ${WAN} -f -j DROP

# Block bad stuff
$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags ALL ALL -j DROP

$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "NULL Packets"
$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags ALL NONE -j DROP # NULL packets

$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "XMAS Packets"
$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS

$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fin Packets Scan"
$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans

$IPT  -A INPUT -i ${WAN} -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

# Block CUPS WAN access
$IPT -A OUTPUT -o ${WAN} -p tcp --dport 631 -j REJECT
$IPT -A OUTPUT -o ${WAN} -p udp --dport 631 -j REJECT

#===== ALLOW =====
# Allow full connection but no incomming stuff between LAN and router
#$IPT -A INPUT  -i ${LAN} -m state --state ESTABLISHED,RELATED -j ACCEPT
#$IPT -A OUTPUT -o ${LAN} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Allow ssh 
$IPT -A INPUT -i ${LAN}  -p tcp --dport 22 -j ACCEPT
$IPT -A OUTPUT -o ${LAN} -p tcp --dport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT

# allow ICMP ping pong stuff
$IPT -A INPUT  -i ${LAN}  -p icmp -j ACCEPT
$IPT -A OUTPUT -o ${LAN}  -p icmp -j ACCEPT
$IPT -A INPUT  -i ${WLAN} -p icmp -j ACCEPT
$IPT -A OUTPUT -o ${WLAN} -p icmp -j ACCEPT

# Allow port 53 tcp/udp (DNS Server)
$IPT -A INPUT  -p tcp --dport 53 -m state --state NEW,ESTABLISHED,RELATED  -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A INPUT  -p udp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A INPUT  -p tcp --dport 953 -m state --state NEW,ESTABLISHED,RELATED  -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 953 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Proxy
$IPT -A INPUT -i ${LAN}  -p tcp --dport 3128 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p tcp --dport 3128 -j ACCEPT

#DHCP
$IPT -A INPUT -p udp --dport 67 -j ACCEPT
$IPT -A INPUT -p udp --dport 68 -j ACCEPT

# Open port 631 for CUPS/Printing
$IPT -A INPUT -i ${LAN}  -p tcp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${LAN}  -p udp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p tcp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p udp --dport 631 -j ACCEPT

# Samba
$IPT -A INPUT -p tcp -m multiport --dport 139,445 -j ACCEPT
$IPT -A INPUT -p udp -m multiport --dport 137,138 -j ACCEPT

#===== FORWARD =====
# HTTP(s)
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p tcp -m multiport --dport 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p udp -m multiport --dport 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${LAN} -o ${WAN} -p tcp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p udp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p tcp -m multiport --dport 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p udp -m multiport --dport 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p tcp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p udp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# IMAP(s)
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p tcp -m multiport --dport 143,993 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p udp -m multiport --dport 143,993 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${LAN} -o ${WAN} -p tcp -m multiport --dport 143,993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p udp -m multiport --dport 143,993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p tcp -m multiport --dport 143,993 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p udp -m multiport --dport 143,993 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p tcp -m multiport --dport 143,993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p udp -m multiport --dport 143,993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# SMTP
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p tcp --dport 25 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p udp --dport 25 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${LAN} -o ${WAN} -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p udp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p tcp --dport 25 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p udp --dport 25 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p udp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# NTP
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p udp --dport 123 -m state --state ESTABLISHED,RELATED  -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p udp --dport 123 -m state --state NEW,ESTABLISHED,RELATED  -j ACCEPT

$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p udp --dport 123 -m state --state ESTABLISHED,RELATED  -j ACCEPT 
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p udp --dport 123 -m state --state NEW,ESTABLISHED,RELATED  -j ACCEPT 
# WhatsApp
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p tcp --dport 5222 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p tcp --dport 5222 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p tcp --dport 5222 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p tcp --dport 5222 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Reject (W)LAN Traffic rather than drop
$IPT -A INPUT   -i ${LAN}  -j REJECT --reject-with icmp-host-prohibited
$IPT -A INPUT   -i ${WLAN} -j REJECT --reject-with icmp-host-prohibited
$IPT -A FORWARD -i ${LAN}  -j REJECT --reject-with icmp-host-prohibited
$IPT -A FORWARD -i ${WLAN} -j REJECT --reject-with icmp-host-prohibited
$IPT -A OUTPUT             -j REJECT --reject-with icmp-host-prohibited

exit 0
linux  networking  wireless-networking  router  iptables 
— kiigass
source
你的剧本充满了这么多的冗余，我几乎不知道从哪里开始！
— 网络时间
为什么不安装LEDE并让自己更容易？否则你可能想看看FirewallBuilder
— JW0914，19年

Answers:

0

您的整个DNS部分，删除它我已经为您替换整个INPUT部分。删除你的DHCP 67,68，它现在由相关的，已建立的覆盖。

IPT -I INPUT 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT


IPT -I FORWARD 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

现在擦除前向链中包含RELATED，ESTABLISHED的所有其他命令。然后现在都是冗余的，这基本上意味着所有其他命令。

你的代码

# Open port 631 for CUPS/Printing
$IPT -A INPUT -i ${LAN}  -p tcp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${LAN}  -p udp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p tcp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p udp --dport 631 -j ACCEPT

# Samba
$IPT -A INPUT -p tcp -m multiport --dport 139,445 -j ACCEPT
$IPT -A INPUT -p udp -m multiport --dport 137,138 -j ACCEPT

INPUT链的新代码。

$IPT -N INTERNET
$IPT -I INPUT 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$IPT -I INPUT -d <internet ip> -j INTERNET
$IPT -I INTERNET <add ports and protocols here from internet>
## insert **block bad** here
# Change INPUT to INTERNET for the chain in block bad
$IPT -I INTERNET -j drop


## You may want to add $IPT -A INPUT  -d <internet IP> -j DROP
## so random internet people can connect to 139,445,631
$IPT -A INPUT -p tcp -m multiport --dport 139,445,631 -j ACCEPT
$IPT -A INPUT -p udp -m multiport --dport 137,138,631 -j ACCEPT
$IPT -A INPUT -j drop

任何不被接受的东西都会被删除

— cybernard
source
By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.