적수네 동네 - 질문과 답변 [ 게시물 수정 ]

	>> Edit article


			이름
			제목
			패스워드

공인 아이피가 4개가 있는데 이것을 다 살리면서 방화벽 구축을 할려고 
하는데 어떻게 하는지..
 1. 이렇게 했는데 이상하게 인터넷도 안 되고, ping도 안 통하는데 어디가 잘
못되었는지 좀 봐 주세요..
2. input,output,forward는 기본 정책입니다.
3. ping는 리눅스서버하고는 핑이 되는데,  밖에서는 안되고,밖으로도 안 나가요.
4. 클라이언트에서 nslookup을 하면 DNS를 못 찾는데 어떻게 하죠? 
5. 포트번호를 정할때 dport부분이 있잖습니까?
 이 포트번호를 정하면 예를 들어 http에 8080이라고 할때 nt서버일 경우에
 iis에서도 8080으로 포트번호를 변경해 주어야 하나요?
 --|------------------|-----|---------|-- 60.30.205.202서버(http)
  | 리눅스 서버      |     |  허브   |-- 60.30.205.203서버(http,mail) 
  |_(firewall 머신)__|     |_________|-- 60.30.205.204서버(ftp)       
     
  외부(61.37.214.201)-eth0 ip:61.37.214.201 MK:255.255.255.224
                           G.W:61.37.214.193 DNS:203.248.252.2
  내부(192.168.1.1)  -eth1 ip:192.168.1.1  MK:255.255.255.0 
    
  60.30.205.202서버(http)=>ip:192.168.1.2  MK:255.255.255.0 
GW:192.168.1.1 
 60.30.205.203서버(http,mail)=>ip:192.168.134  MK:255.255.255.0 
GW:192.168.1.1 
 60.30.205.204서버(ftp) =>ip:192.168.1.4  MK:255.255.255.0 GW:192.168.1.1
 DNS:203.248.252.2
  
##############################################################
###########          FORWARD            ###############
##############################################################
  /sbin/iptables -Z FORWARD
  /sbin/iptables -P FORWARD ACCEPT
  /sbin/iptables -F FORWARD
  /sbin/iptables -A FORWARD -i eth1 -o eht1 -m state --state 
ESTABLISHED,RELATED -j ACCEPT
  /sbin/iptables -Z FORWARD -i eth0 -o eth1 -j ACCEPT
  /sbin/iptables -Z FORWARD -j LOG
  
##############################################################
###########         OUTPUT               ###############
##############################################################
  /sbin/iptables -Z OUTPUT
  /sbin/iptables -P OUTPUT ACCEPT
  /sbin/iptables -F OUTPUT
 ##############################################################
###########         NAT                   ###############
##############################################################
  /sbin/iptables -t nat -F
   /sbin/iptables -t nat -A PREROUTING -p tcp -d 60.30.205.202 -
-dport 8080 -j DNAT --to 192.168.1.2:80
  /sbin/iptables -t nat -A PREROUTING -p tcp -d 60.30.205.203 -
-dport 8025 -j DNAT --to 192.168.1.3:25
  /sbin/iptables -t nat -A PREROUTING -p tcp -d 60.30.205.203 -
-dport 8110 -j DNAT --to 192.168.1.3:110
  /sbin/iptables -t nat -A PREROUTING -p tcp -d 60.30.205.203 -
-dport 8081 -j DNAT --to 192.168.1.3:81
  /sbin/iptables -t nat -A PREROUTING -p tcp -d 60.30.205.204 -
-dport 8021 -j DNAT --to 192.168.1.4:21
  /sbin/iptables -t nat -A PREROUTING -d  60.30.205.202 -j DNAT --to 
192.168.1.2
  /sbin/iptables -t nat -A PREROUTING -d  60.30.205.203 -j DNAT --to 
192.168.1.3
  /sbin/iptables -t nat -A PREROUTING -d  60.30.205.204 -j DNAT --to 
192.168.1.4
 /sbin/iptables -t nat -A POSTROUTING -s 192.168.1.2  -o eth0 -j SNAT --
to 60.30.205.202
/sbin/iptables -t nat -A POSTROUTING -s 192.168.1.3  -o eth0 -j SNAT --
to 60.30.205.203
/sbin/iptables -t nat -A POSTROUTING -s 192.168.1.4  -o eth0 -j SNAT --
to 60.30.205.204
/sbin/iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 60.30.205.201
/sbin/iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to 191.168.1.1