一个通用的NAT脚本，非常方便

发布: 2007-7-04 12:06 | 作者: admin | 来源: 　网友评论 | 查看: 13次 | 进入软件测试论坛讨论

支持直接接入方式和PPPOE拨号方式，前部分有配置和注解，应该不难看懂

#! /bin/bash
# Project by Platinum, 2005-05-12
# Debug on 2005-05-20

# Set MODE (LAN or ADSL)
MODE="ADSL"

# Set default gateway (如果MODE==ADSL，此项可以忽略)
GATEWAY="外网网关"

# Set Interface WAN (如果MODE==ADSL，此项可以忽略)
WAN_IP="外网IP地址"
WAN_ETH="外网网卡"
WAN_MASK="外网掩码"

# Set Interface LAN
LAN_IP="内网IP地址"
LAN_NET="内网网络地址"
LAN_ETH="内网网卡"
LAN_MASK="内网掩码"

# Set manager
MANAGER_IP="内网管理员IP"
MANAGER_MAC="内网管理员MAC"

# Initialize modules
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward

# Initialize Interface LAN
ifconfig $LAN_ETH $LAN_IP netmask $LAN_MASK

# Initialize policy
iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -F
iptables -t nat -F

# Deny ACK attack
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP

# Initialize Rules
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i $LAN_ETH -s $MANAGER_IP -m mac --mac-source $MANAGER_MAC -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

case "$MODE" in
LAN)
     # Initialize Interface WAN
     ifconfig $WAN_ETH $WAN_IP netmask $WAN_MASK
     iptables -t nat -A POSTROUTING -s $LAN_NET -o $WAN_ETH -j SNAT --to $WAN_IP
;;
ADSL)
     iptables -t nat -A POSTROUTING -s $LAN_NET -o ppp0 -j MASQUERADE
     GATEWAY=`ifconfig ppp0|grep inet|awk '{print }'|awk -F: '{print }'`
;;
esac

ip route replace default via $GATEWAY