방화벽 설정에서 네임서버를 열었다고 생각했는데 외부에서는 안열리네요.
설정을 보시는게 가장 빠를것 같아 설정을 올립니다. 모듈부분이나 필요없을
것 같은 부분은 뺐습니다.
기존 되어있는것을 참고 했습니다.
# 변수값 설정
# IPTABLES=/sbin/iptables
EXTIF="eth0"
INTIF="eth1"
echo " External Interface: $EXTIF"
echo " Internal Interface: $INTIF"
EXTIP="`/sbin/ifconfig $EXTIF | grep 'inet addr' | awk '{print $2}' | sed -e 's/.*://'`"
echo " External IP:$EXTIP"
INTNET="192.168.0.0/24"
INTIP="192.168.0.1/24"
UNIVERSE="0.0.0.0/0"
echo " Internal Network:$INTNET"
echo " Internal IP: $INTIP"
echo " Universe Network:$UNIVERSE"
LSMOD=/sbin/lsmod
GREP=/bin/grep
AWK=/bin/awk
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
# DROP 체인 설정
$IPTABLES -N drop-and-log-it
$IPTABLES -A drop-and-log-it -j LOG --log-level info
$IPTABLES -A drop-and-log-it -j DROP
# INPUT 체인 설정
$IPTABLES -A INPUT -i lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT
$IPTABLES -A INPUT -i $INTIF -s $INTNET -d $UNIVERSE -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -s $INTNET -d $UNIVERSE -j drop-and-log-it
$IPTABLES -A INPUT -i $EXTIF -p ICMP -s $UNIVERSE -d $EXTIP -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -p TCP -s $UNIVERSE -d $EXTIP -j ACCEPT
$IPTABLES -A INPUT -p tcp -s $UNIVERSE -d $EXTIP -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it
$IPTABLES -A INPUT -i $EXTIF -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT (네임서버 설정)
# OUPUT 체인 설정
$IPTABLES -A OUTPUT -o lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT
$IPTABLES -A OUTPUT -o $INTIF -s $EXTIP -d $INTNET -j ACCEPT
$IPTABLES -A OUTPUT -o $INTIF -s $INTIP -d $INTNET -j ACCEPT
$IPTABLES -A OUTPUT -o $EXTIF -s $UNIVERSE -d $INTNET -j drop-and-log-it
$IPTABLES -A OUTPUT -o $EXTIF -s $EXTIP -d $UNIVERSE -j ACCEPT
$IPTABLES -A OUTPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it
$IPTABLES -A OUTPUT -o $EXTIF -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT (네임서버설정)
# 포워딩 설정
#################################################
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j drop-and-log-it
# NAT (MASQ 마스거레이딩) 설정
#====================================================================
echo " - NAT: Enabling SNAT (MASQUERADE) functionality on $EXTIF"
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP
$IPTABLES -A FORWARD -p tcp -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -p udp -i $INTIF -o $EXTIF -j ACCEPT--~m^^m~