всем привет
имеется сервер на ubuntu 10.0.4.4
исполняет роль прокси сервера на squid 2.7 управляется sams и webmin'ом
интерфейсы:
eth1 интернет
eth0 локальная сеть
eth0 Link encap:Ethernet HWaddr 00:1f:e2:5d:da:2c
inet addr:192.168.100.254 Bcast:192.168.100.255 Mask:255.255.255.0
inet6 addr: fe80::21f:e2ff:fe5d:da2c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:41043 errors:0 dropped:0 overruns:0 frame:0
TX packets:20253 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:4550880 (4.5 MB) TX bytes:11641193 (11.6 MB)
Interrupt:26 Base address:0x8000
eth1 Link encap:Ethernet HWaddr 00:40:f4:91:43:19
inet addr:192.168.101.252 Bcast:192.168.101.255 Mask:255.255.255.0
inet6 addr: fe80::240:f4ff:fe91:4319/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:15857 errors:0 dropped:0 overruns:0 frame:0
TX packets:13237 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:9748063 (9.7 MB) TX bytes:2232208 (2.2 MB)
Interrupt:18 Base address:0xde00
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:210 errors:0 dropped:0 overruns:0 frame:0
TX packets:210 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:168437 (168.4 KB) TX bytes:168437 (168.4 KB)не получается пробросить почтовые пакеты через 110 и 25 порты
вывод iptables -L -v -n
Chain INPUT (policy ACCEPT 21335 packets, 6612K bytes)
pkts bytes target prot opt in out source destination
1369 93398 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
2 120 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
0 0 ACCEPT icmp -- eth1 * 0.0.0.0/0 0.0.0.0/0 icmp type 8
0 0 ACCEPT icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 icmp type 8
6 264 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:110
6 264 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED tcp dpt:110
Chain FORWARD (policy ACCEPT 6 packets, 240 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- eth0 eth1 0.0.0.0/0 0.0.0.0/0 tcp dpt:110
0 0 ACCEPT tcp -- eth0 eth1 0.0.0.0/0 0.0.0.0/0 tcp dpt:25
2331 608K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
145 12111 ACCEPT all -- eth0 eth1 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED
Chain OUTPUT (policy ACCEPT 18310 packets, 7305K bytes)
pkts bytes target prot opt in out source destination настройки конфигурируются посредством вот такого скрипта:
#!/bin/bash
#
modprobe ip_tables
echo 1 > /proc/sys/net/ipv4/ip_forward
#
/sbin/iptables -F
/sbin/iptables -t nat -F
/sbin/iptables -t mangle -F
/sbin/iptables -X
/sbin/iptables -t nat -X
/sbin/iptables -t mangle -X
#
/sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT --protocol tcp --dport 22 -j ACCEPT
#
#/sbin/iptables -A INPUT -i eth1 -m state --state NEW,INVALID -j DROP
#/sbin/iptables -A FORWARD -i eth1 -m state --state NEW,INVALID -j DROP
#
/sbin/iptables -I FORWARD -p all -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -I FORWARD -p tcp -i eth0 -o eth1 --dport 25 -j ACCEPT
/sbin/iptables -I FORWARD -p tcp -i eth0 -o eth1 --dport 110 -j ACCEPT
/sbin/iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
/sbin/iptables -A INPUT -i eth1 -p icmp --icmp-type echo-request -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -p icmp --icmp-type echo-request -j ACCEPT
