操作基于ubuntu server10.10 上进行安装配置.进行配置iptables.ip转换.mac过虑功能.

1.建iptables

root@ptubuntufirewall:/# vi /etc/init.d/iptables

#fLUSH THE FILTER,NAT,Mangle chain!

/sbin/iptables -F -t filter

/sbin/iptables -F -t nat

/sbin/iptables -F -t mangle

 

#Flush the user's chain

/sbin/iptables -t filter -X

/sbin/iptables -t nat -X

/sbin/iptables -t mangle -X

 

#Set default policies to DROP

/sbin/iptables -P INPUT ACCEPT

/sbin/iptables -P OUTPUT ACCEPT

/sbin/iptables -P FORWARD ACCEPT

 

#LAN NAT

/sbin/iptables -A POSTROUTING -t nat -s 192.168.0.0/255.255.255.0 -o eth1 -j MASQUERADE

#/sbin/iptables -A POSTROUTING -t nat -s 192.168.0.0/255.255.255.0 -o eth0 -j MASQUERADE

 

if [ -f /etc/access_mac.conf ]    

then

    for i in `cat /etc/access_mac.conf | grep "^[^#]" | tr -s "[\012]" | cut -c1-17` ; do

        /sbin/iptables -A FORWARD -m mac –mac-source $i -i eth0 -j ACCEPT

    done

fi

 

/sbin/iptables -A FORWARD -i eth0 -j DROP

#VNC View Ptubuntu 这下面两条指:访问外网ip可以转换到内网ip:端口

/sbin/iptables -A PREROUTING -t nat -p tcp -m tcp -i eth1 –dport 5888 -j DNAT –to-destination 192.168.0.110:5888

/sbin/iptables -A PREROUTING -t nat -p tcp -m tcp -i eth1 –dport 5988 -j DNAT –to-destination 192.168.0.110:5988