>> Delete No. 45333 article
No. iptable로 방화벽구성하고 네임서버 가 막히네여..

등록 2002-03-22 13:53:00 By localhost     조회 2
이름 실론티    

		방화벽 설정에서 네임서버를 열었다고 생각했는데 외부에서는 안열리네요.
설정을 보시는게 가장 빠를것 같아 설정을 올립니다. 모듈부분이나 필요없을
것 같은 부분은 뺐습니다.
기존 되어있는것을 참고 했습니다.
  # 변수값 설정
#	IPTABLES=/sbin/iptables
EXTIF="eth0"
INTIF="eth1"
echo "  External Interface: $EXTIF"
echo "  Internal Interface: $INTIF"
EXTIP="`/sbin/ifconfig $EXTIF | grep 'inet addr' | awk '{print $2}' | sed -e 's/.*://'`"
echo "  External IP:$EXTIP"
INTNET="192.168.0.0/24"
INTIP="192.168.0.1/24"
UNIVERSE="0.0.0.0/0"
echo "  Internal Network:$INTNET"
echo "  Internal IP:     $INTIP"
echo "  Universe Network:$UNIVERSE"
LSMOD=/sbin/lsmod
GREP=/bin/grep
AWK=/bin/awk
 echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
 # DROP 체인 설정
$IPTABLES -N drop-and-log-it
$IPTABLES -A drop-and-log-it -j LOG --log-level info
$IPTABLES -A drop-and-log-it -j DROP
 # INPUT 체인 설정
$IPTABLES -A INPUT -i lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT
$IPTABLES -A INPUT -i $INTIF -s $INTNET -d $UNIVERSE -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -s $INTNET -d $UNIVERSE -j drop-and-log-it
$IPTABLES -A INPUT -i $EXTIF -p ICMP -s $UNIVERSE -d $EXTIP -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -p TCP -s $UNIVERSE -d $EXTIP -j ACCEPT
$IPTABLES -A INPUT -p tcp -s $UNIVERSE -d $EXTIP -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it
$IPTABLES -A INPUT -i $EXTIF -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT (네임서버 설정)
 # OUPUT 체인 설정
$IPTABLES -A OUTPUT -o lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT
$IPTABLES -A OUTPUT -o $INTIF -s $EXTIP -d $INTNET -j ACCEPT
$IPTABLES -A OUTPUT -o $INTIF -s $INTIP -d $INTNET -j ACCEPT
$IPTABLES -A OUTPUT -o $EXTIF -s $UNIVERSE -d $INTNET -j drop-and-log-it
$IPTABLES -A OUTPUT -o $EXTIF -s $EXTIP -d $UNIVERSE -j ACCEPT
$IPTABLES -A OUTPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it
$IPTABLES -A OUTPUT -o $EXTIF -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT (네임서버설정)
 # 포워딩 설정
#################################################
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j drop-and-log-it
 # NAT (MASQ 마스거레이딩) 설정
#====================================================================
echo "     - NAT: Enabling SNAT (MASQUERADE) functionality on $EXTIF"
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP
 $IPTABLES -A FORWARD -p tcp -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -p udp -i $INTIF -o $EXTIF -j ACCEPT--~m^^m~
[관리자] 패스워드를 입력 하십시오. 답장이 존재하면 함께 삭제됩니다.[ 목록 | 이전 ]
패스워드:    

Copyleft 1999-2026 by JSBoard Open Project
Theme Designed by IDOO All right reserved