적수네 동네 - 질문과 답변 [ 게시물 수정 ]

	>> Edit article


			이름
			제목
			패스워드

제가 iptables관한 설정을 하려고 하는데요.
어디서 잘되어 있는것 가저다가 사용할려고 하는데.
제 컴에서는 외부로 접근이 잘되는데 외부에서 제컴에 접근이 안되게 됩니다.
제가 보기에는 외부에서 접근하는데 이상이 없어 보이는데 
안되네요 가르쳐 주세요..
 #!/bin/sh
 modprobe ip_tables
modprobe ip_conntrack 
modprobe ip_conntrack_ftp
 iptables -F
iptables -X
iptables -Z
 iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
 IFACE="eth0"
IPADDR="xxx.xxx.xxx.xxx" 
NAMESERVER_1="210.114.8.131" 
NAMESERVER_2="203.245.15.9" 
BROADCAST="211.113.54.127" 
LOOPBACK="127.0.0.0/8" 
CLASS_A="10.0.0.0/8"
CLASS_B="172.16.0.0/12" 
CLASS_C="192.168.0.0/16" 
CLASS_D_MULTICAST="224.0.0.0/4" 
CLASS_E_RESERVED_NET="240.0.0.0/5"
P_PORTS="0:1023" 
UP_PORTS="1024:65535" 
TR_SRC_PORTS="32769:65535"
TR_DEST_PORTS="33434:33523" 
  
/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all 
 /bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts 
 /bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route 
 /bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
 /bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
 for interface in /proc/sys/net/ipv4/conf/*/rp_filter; do
   /bin/echo "1" > ${interface}
done
 /bin/echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
 /bin/echo "0" > /proc/sys/net/ipv4/ip_forward
  iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
 iptables -N syn-flood
iptables -A INPUT -i $IFACE -p tcp --syn -j syn-flood
iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
iptables -A syn-flood -j DROP
 iptables -A INPUT -i $IFACE -p tcp ! --syn -m state --state NEW -j DROP
 iptables -A INPUT -i $IFACE -f -j DROP
 iptables -A INPUT  -i $IFACE -s $IPADDR -j DROP
 iptables -A INPUT  -i $IFACE -s $CLASS_A -j DROP
 iptables -A INPUT  -i $IFACE -s $CLASS_B -j DROP
 iptables -A INPUT  -i $IFACE -s $CLASS_C -j DROP
 iptables -A INPUT -i $IFACE -s $CLASS_D_MULTICAST -j DROP
 iptables -A INPUT -i $IFACE -s $CLASS_E_RESERVED_NET -j DROP
 iptables -A INPUT  -i $IFACE -d $LOOPBACK -j DROP
 
iptables -A INPUT -i $IFACE -d $BROADCAST -j DROP 
 ## DNS 
 iptables -A INPUT -i $IFACE -p udp -s $NAMESERVER_1 --sport 53 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i $IFACE -p udp -s $NAMESERVER_2 --sport 53 -m state --state ESTABLISHED -j ACCEPT
 # Allow UDP packets to DNS servers from client. 
 iptables -A OUTPUT -o $IFACE -p udp -d $NAMESERVER_1 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o $IFACE -p udp -d $NAMESERVER_2 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
 ## SSH 
# Allow ssh outbound. 
iptables -A INPUT  -i $IFACE -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o $IFACE -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
 ## WWW 
# Allow www outbound to 80. 
iptables -A INPUT  -i $IFACE -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o $IFACE -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
# Allow www outbound to 443. 
iptables -A INPUT  -i $IFACE -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o $IFACE -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
 ## TELNET 
# Allow telnet outbound. 
iptables -A INPUT  -i $IFACE -p tcp --sport 23 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o $IFACE -p tcp --dport 23 -m state --state NEW,ESTABLISHED -j ACCEPT
  ## FTP 
# Allow ftp outbound. 
iptables -A INPUT  -i $IFACE -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o $IFACE -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 iptables -A INPUT  -i $IFACE -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o $IFACE -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
 
iptables -A INPUT  -i $IFACE -p tcp --sport $UP_PORTS --dport $UP_PORTS  -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o $IFACE -p tcp --sport $UP_PORTS --dport $UP_PORTS  -m state --state ESTABLISHED,RELATED -j ACCEPT
  ## SMTP 
# Allow smtp outbound. 
iptables -A INPUT  -i $IFACE -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o $IFACE -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT
 ## AUTH server 
 iptables -A INPUT -i $IFACE -p tcp --dport 113 -j REJECT --reject-with tcp-reset
 ## TRACEROUTE 
 iptables -A OUTPUT -o $IFACE -p udp --sport $TR_SRC_PORTS --dport $TR_DEST_PORTS  -m state --state NEW -j ACCEPT
 # ICMP 
 iptables -A INPUT  -i $IFACE -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s xxx.xxx.xxx.xxx -p icmp --icmp-type echo-request -j ACCEPT
 iptables -A OUTPUT -o $IFACE -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
 iptables -A INPUT  -i $IFACE -p udp -j DROP
 
iptables -A OUTPUT -o $IFACE -p udp -j DROP
 iptables -A INPUT -p icmp --icmp-type echo-request -j REJECT
 iptables -A OUTPUT -o $IFACE -p icmp -j DROP
 iptables -A INPUT  -i $IFACE -p tcp -j DROP
 iptables -A OUTPUT -o $IFACE -p tcp -j DROP
 iptables -A INPUT  -i $IFACE -j DROP
 iptables -A OUTPUT -o $IFACE -j DROP