|
接下来去配置防火墙： 安装squid [root@localhost Server]# rpm -ivh squid-2.6.STABLE21-3.el5.i386.rpm 查看规则 [root@localhost ~]# iptables -L Chain INPUT (policy ACCEPT) targetprot opt sourcedestination Chain FORWARD (policy ACCEPT) targetprot opt sourcedestination Chain OUTPUT (policy ACCEPT) targetprot opt sourcedestination 保证自己能够正常连接到防火墙 [root@localhost ~]# iptables -t filter -A INPUT -s 192.168.20.129 -p tcp --dport 22 -j ACCEPT [root@localhost ~]# iptables -t filter -A OUTPUT -d 192.168.20.129 -p tcp --sport 22 -j ACCEPT 拒绝所有过防火墙的流量 [root@localhost ~]# iptables -P INPUT DROP [root@localhost ~]# iptables -P OUTPUT DROP [root@localhost ~]# iptables -P FORWARD DROP 允许内网用户流量通过POSTROUTING从eth2网卡出去 [root@localhost ~]# iptables -t nat -A POSTROUTING -s 192.168.20.0/24 -o eth2 -j MASQUERADE 允许工程部的人员在上班时间能够访问ftp [root@localhost ~]# iptables -t filter -A FORWARD -m iprange --src-range 192.168.20.10-192.168.20.20 -m time --timestart 08:00 --timestop 20:00 --weekdays Mon,Tue,Wed,Thu,Fri -p tcp --dport 21 -j ACCEPT 接收进入内网的所有流量 [root@localhost ~]# iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT 只允许工程部人员在上班时间访问192.168.102.10的ftp [root@localhost ~]# iptables -t filter -R FORWARD 1 -m iprange --src-range 192.168.20.10-192.168.20.20 -m time --timestart 08:00 --timestop 20:00 -d 192.168.102.10 -o eth2 --weekdays Mon,Tue,Wed,Thu,Fri -p tcp --dport 21 -j ACCEPT 验证 [root@localhost ~]# date Thu May 16 10:00:04 CST 2013  不允许工程部人员在上班时间登录qq [root@localhost ~]# iptables -t filter -A FORWARD-m iprange --src-range 192.168.20.10-192.168.20.20 -m time --timestart 08:00 --timestop 20:00-o eth2 --weekdays Mon,Tue,Wed,Thu,Fri -m layer7 --l7proto qq-j DROP [root@localhost ~]# date Thu May 16 10:06:47 CST 2013   下班时间无限制 [root@localhost ~]# iptables -t filter -A FORWARD -s 192.168.20.0/24 -m time --timestart 20:01 --timestop 07:59 -o eth2 -j ACCEPT [root@localhost ~]# date -s 21:00:00 Thu May 16 21:00:00 CST 2013  
|
|
|
