hjaelp til iptables
Jeg skal ha redirectet(maaske?) trafikken i min firewall så alt trafik fra subnet 192.168.223.0/24 paa port 80 der forsoeger at komme ud bliver sendt til 192.168.223.1:80(firewallen selv)Giver det mening?
Jeg har været ude i at prøve noget med:
iptables -t nat -A INPUT -s 192.168.223.0/24 -p tcp --dport 80 -j REDIRECT --to-destination 192.168.223.1:80
Er det korrekt? jeg tænker lidt at den bare vil loope og til sidst droppe pakken?
Nogen der har et løsnings forslag?
Her er en liste over mine interfaces og nuværende iptables.
wireless:/# ifconfig
eth0 Link encap:Ethernet HWaddr 00:c0:9f:09:d2:c2
inet addr:130.226.217.203 Bcast:130.226.217.223 Mask:255.255.255.224
inet6 addr: fe80::2c0:9fff:fe09:d2c2/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:592114658 errors:0 dropped:0 overruns:0 frame:0
TX packets:830280341 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2421290898 (2.2 GiB) TX bytes:2961439949 (2.7 GiB)
eth1 Link encap:Ethernet HWaddr 00:02:b3:da:78:e8
inet addr:192.168.223.1 Bcast:192.168.223.255 Mask:255.255.255.0
inet6 addr: fe80::202:b3ff:feda:78e8/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:825673034 errors:1036 dropped:0 overruns:0 frame:1036
TX packets:585979957 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3152120804 (2.9 GiB) TX bytes:4286640463 (3.9 GiB)
eth1:2 Link encap:Ethernet HWaddr 00:02:b3:da:78:e8
inet addr:192.168.224.1 Bcast:192.168.224.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
eth2 Link encap:Ethernet HWaddr 00:08:c7:19:4a:b6
inet addr:192.168.1.50 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::208:c7ff:fe19:4ab6/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:367741 errors:0 dropped:0 overruns:0 frame:0
TX packets:10735 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:22135675 (21.1 MiB) TX bytes:608806 (594.5 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:111587 errors:0 dropped:0 overruns:0 frame:0
TX packets:111587 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:23063345 (21.9 MiB) TX bytes:23063345 (21.9 MiB)
wireless:/etc/dhcp3# cat iptables.conf
#!/bin/sh
iptables -t nat -F
iptables -F
iptables -t nat -A POSTROUTING -s 192.168.224.0/22 -j SNAT --to 130.226.217.203
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:11:f5:4b:21:35 -s 192.168.224.10 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:1d:4f:f9:6d:3b -s 192.168.224.11 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:0d:93:eb:a4:e0 -s 192.168.224.12 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:24:d2:b5:42:46 -s 192.168.224.13 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:13:e8:70:62:9d -s 192.168.224.14 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:22:43:15:43:e1 -s 192.168.224.15 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:1b:63:02:dc:16 -s 192.168.224.16 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:0e:35:36:27:d1 -s 192.168.224.17 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:26:b0:b4:62:f3 -s 192.168.224.18 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:1e:c2:c0:de:24 -s 192.168.224.76 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:16:e3:a0:c0:bb -s 192.168.224.9 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0 -j ACCEPT
iptables -A INPUT -s 192.168.223.0/24 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.223.0/24 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.223.0/24 -p udp --dport 67:68 --sport 67:68 -j ACCEPT
iptables -A INPUT -s 192.168.223.0/24 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -s 192.168.224.0/22 -p udp --dport 67:68 --sport 67:68 -j ACCEPT
iptables -A INPUT -s 192.168.224.0/22 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -s 192.168.224.0/22 -p tcp --dport 22 -j ACCEPT
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
