我正在将 Raspberry PI 设置为家用路由器，下面是我当前的 iptables 脚本。路由器还
- 代理，
- 桑巴舞，
- 杯子，
- bind9，
- WLAN 接入点和
- DHCP 服务器。
如果 bind 无法响应 dns 请求，我不确定下面的设置是否有效：我是否必须能够在输出链中的端口 53 上打开“NEW”连接？或者我必须将其放在 FORWARD 链中，因为 LAN 客户端执行上游请求而不是 bind。
路由器将通过 DHCP 从我的 ISP 获取 IP（用于 WAN 接口）。路由器还将为 (W)LAN 客户端分配 IP。为此，我是否必须在所有接口上允许输入和输出链的 udp 端口 67/68？
有没有办法让我的脚本更短，即在提高可读性的同时获得相同的结果？我的基本目标是向 (W)LAN 客户端提供已安装的服务（见上文），并让 (W)LAN 客户端访问 HTTP(s)、IMAP(s)、SMTP、NTP 和 WhatsApp。
#!/bin/sh
log() {
echo "$(date '+%b %d %H:%M:%S') $(hostname) iptablesInit: $1"
echo "$(date '+%b %d %H:%M:%S') $(hostname) iptablesInit: $1" >> /var/log/iptablesInit.log
}
IPT="/sbin/iptables"
WAN="WAN"
LAN="LAN"
WLAN="WLAN"
# Flush all chaines
log 'Flush everything...'
$IPT -F
$IPT -X
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -F INPUT
$IPT -F FORWARD
$IPT -F OUTPUT
log 'Flush done'
# unlimited
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
# set policies
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP
# NAT
$IPT -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE
#===== BLOCK =====
# Block sync
$IPT -A INPUT -i ${WAN} -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Drop Sync"
$IPT -A INPUT -i ${WAN} -p tcp ! --syn -m state --state NEW -j DROP
# Block Fragments
$IPT -A INPUT -i ${WAN} -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fragments Packets"
$IPT -A INPUT -i ${WAN} -f -j DROP
# Block bad stuff
$IPT -A INPUT -i ${WAN} -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPT -A INPUT -i ${WAN} -p tcp --tcp-flags ALL ALL -j DROP
$IPT -A INPUT -i ${WAN} -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "NULL Packets"
$IPT -A INPUT -i ${WAN} -p tcp --tcp-flags ALL NONE -j DROP # NULL packets
$IPT -A INPUT -i ${WAN} -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPT -A INPUT -i ${WAN} -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "XMAS Packets"
$IPT -A INPUT -i ${WAN} -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS
$IPT -A INPUT -i ${WAN} -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "Fin Packets Scan"
$IPT -A INPUT -i ${WAN} -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans
$IPT -A INPUT -i ${WAN} -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
# Block CUPS WAN access
$IPT -A OUTPUT -o ${WAN} -p tcp --dport 631 -j REJECT
$IPT -A OUTPUT -o ${WAN} -p udp --dport 631 -j REJECT
#===== ALLOW =====
# Allow full connection but no incomming stuff between LAN and router
#$IPT -A INPUT -i ${LAN} -m state --state ESTABLISHED,RELATED -j ACCEPT
#$IPT -A OUTPUT -o ${LAN} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# Allow ssh
$IPT -A INPUT -i ${LAN} -p tcp --dport 22 -j ACCEPT
$IPT -A OUTPUT -o ${LAN} -p tcp --dport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT
# allow ICMP ping pong stuff
$IPT -A INPUT -i ${LAN} -p icmp -j ACCEPT
$IPT -A OUTPUT -o ${LAN} -p icmp -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p icmp -j ACCEPT
$IPT -A OUTPUT -o ${WLAN} -p icmp -j ACCEPT
# Allow port 53 tcp/udp (DNS Server)
$IPT -A INPUT -p tcp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -p udp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -p tcp --dport 953 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -p tcp --sport 953 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Proxy
$IPT -A INPUT -i ${LAN} -p tcp --dport 3128 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p tcp --dport 3128 -j ACCEPT
#DHCP
$IPT -A INPUT -p udp --dport 67 -j ACCEPT
$IPT -A INPUT -p udp --dport 68 -j ACCEPT
# Open port 631 for CUPS/Printing
$IPT -A INPUT -i ${LAN} -p tcp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${LAN} -p udp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p tcp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p udp --dport 631 -j ACCEPT
# Samba
$IPT -A INPUT -p tcp -m multiport --dport 139,445 -j ACCEPT
$IPT -A INPUT -p udp -m multiport --dport 137,138 -j ACCEPT
#===== FORWARD =====
# HTTP(s)
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p tcp -m multiport --dport 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p udp -m multiport --dport 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p tcp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p udp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p tcp -m multiport --dport 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p udp -m multiport --dport 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p tcp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p udp -m multiport --dport 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# IMAP(s)
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p tcp -m multiport --dport 143,993 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p udp -m multiport --dport 143,993 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p tcp -m multiport --dport 143,993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p udp -m multiport --dport 143,993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p tcp -m multiport --dport 143,993 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p udp -m multiport --dport 143,993 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p tcp -m multiport --dport 143,993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p udp -m multiport --dport 143,993 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# SMTP
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p tcp --dport 25 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p udp --dport 25 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p udp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p tcp --dport 25 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p udp --dport 25 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p tcp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p udp --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# NTP
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p udp --dport 123 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p udp --dport 123 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p udp --dport 123 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p udp --dport 123 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# WhatsApp
$IPT -A FORWARD -i ${WAN} -o ${LAN} -p tcp --dport 5222 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${LAN} -o ${WAN} -p tcp --dport 5222 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WAN} -o ${WLAN} -p tcp --dport 5222 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -i ${WLAN} -o ${WAN} -p tcp --dport 5222 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# Reject (W)LAN Traffic rather than drop
$IPT -A INPUT -i ${LAN} -j REJECT --reject-with icmp-host-prohibited
$IPT -A INPUT -i ${WLAN} -j REJECT --reject-with icmp-host-prohibited
$IPT -A FORWARD -i ${LAN} -j REJECT --reject-with icmp-host-prohibited
$IPT -A FORWARD -i ${WLAN} -j REJECT --reject-with icmp-host-prohibited
$IPT -A OUTPUT -j REJECT --reject-with icmp-host-prohibited
exit 0
答案1
删除你的整个 DNS 部分，我已经为你替换了整个 INPUT 部分。删除你的 DHCP 67,68，它现在被 related,established 覆盖。
IPT -I INPUT 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
IPT -I FORWARD 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
现在删除前向链中包含 RELATED、ESTABLISHED 的所有其他命令。然后现在都是多余的，这基本上意味着所有其他命令都是多余的。
您的代码
# Open port 631 for CUPS/Printing
$IPT -A INPUT -i ${LAN} -p tcp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${LAN} -p udp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p tcp --dport 631 -j ACCEPT
$IPT -A INPUT -i ${WLAN} -p udp --dport 631 -j ACCEPT
# Samba
$IPT -A INPUT -p tcp -m multiport --dport 139,445 -j ACCEPT
$IPT -A INPUT -p udp -m multiport --dport 137,138 -j ACCEPT
INPUT 链的新代码。
$IPT -N INTERNET
$IPT -I INPUT 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$IPT -I INPUT -d <internet ip> -j INTERNET
$IPT -I INTERNET <add ports and protocols here from internet>
## insert **block bad** here
# Change INPUT to INTERNET for the chain in block bad
$IPT -I INTERNET -j drop
## You may want to add $IPT -A INPUT -d <internet IP> -j DROP
## so random internet people can connect to 139,445,631
$IPT -A INPUT -p tcp -m multiport --dport 139,445,631 -j ACCEPT
$IPT -A INPUT -p udp -m multiport --dport 137,138,631 -j ACCEPT
$IPT -A INPUT -j drop
任何不被接受的内容都会被丢弃。