적수네 동네 - 질문과 답변 [ 게시물 수정 ]

	>> Edit article


			이름
			제목
			패스워드

방화벽 설정에서 네임서버를 열었다고 생각했는데 외부에서는 안열리네요.
설정을 보시는게 가장 빠를것 같아 설정을 올립니다. 모듈부분이나 필요없을
것 같은 부분은 뺐습니다.
기존 되어있는것을 참고 했습니다.
  # 변수값 설정
#	IPTABLES=/sbin/iptables
EXTIF="eth0"
INTIF="eth1"
echo "  External Interface:  $EXTIF"
echo "  Internal Interface:  $INTIF"
EXTIP="`/sbin/ifconfig $EXTIF | grep &#039;inet addr&#039; | awk &#039;{print $2}&#039; | sed -e &#039;s/.*://&#039;`"
echo "  External IP: $EXTIP"
INTNET="192.168.0.0/24"
INTIP="192.168.0.1/24"
UNIVERSE="0.0.0.0/0"
echo "  Internal Network: $INTNET"
echo "  Internal IP:      $INTIP"
echo "  Universe Network: $UNIVERSE"
LSMOD=/sbin/lsmod
GREP=/bin/grep
AWK=/bin/awk
 echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
 # DROP 체인 설정
$IPTABLES -N drop-and-log-it
$IPTABLES -A drop-and-log-it -j LOG --log-level info 
$IPTABLES -A drop-and-log-it -j DROP
 # INPUT 체인 설정
$IPTABLES -A INPUT -i lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT
$IPTABLES -A INPUT -i $INTIF -s $INTNET -d $UNIVERSE -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -s $INTNET -d $UNIVERSE -j drop-and-log-it
$IPTABLES -A INPUT -i $EXTIF -p ICMP -s $UNIVERSE -d $EXTIP -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -p TCP -s $UNIVERSE -d $EXTIP -j ACCEPT
$IPTABLES -A INPUT -p tcp -s $UNIVERSE -d $EXTIP -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it
$IPTABLES -A INPUT -i $EXTIF -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT (네임서버 설정)
 # OUPUT 체인 설정
$IPTABLES -A OUTPUT -o lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT
$IPTABLES -A OUTPUT -o $INTIF -s $EXTIP -d $INTNET -j ACCEPT
$IPTABLES -A OUTPUT -o $INTIF -s $INTIP -d $INTNET -j ACCEPT
$IPTABLES -A OUTPUT -o $EXTIF -s $UNIVERSE -d $INTNET -j drop-and-log-it
$IPTABLES -A OUTPUT -o $EXTIF -s $EXTIP -d $UNIVERSE -j ACCEPT
$IPTABLES -A OUTPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it
$IPTABLES -A OUTPUT -o $EXTIF -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT (네임서버설정)
 # 포워딩 설정
#################################################
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j drop-and-log-it
 # NAT (MASQ 마스거레이딩) 설정
#====================================================================
echo "     - NAT: Enabling SNAT (MASQUERADE) functionality on $EXTIF"
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP
 $IPTABLES -A FORWARD -p tcp -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -p udp -i $INTIF -o $EXTIF -j ACCEPT--~m^^m~