народ помогите...замучился..(только к iptables tutorial не отправляйте читал) есть Squid настроенный на прозрачное проксирование и iptables который должен пускать пользователей из подсети 192.168.0.0\255.255.255.0 eth0 в инет через eth1
# Generated by iptables-save v1.2.6a on Thu Oct 14 09:15:31 2004

*nat
:PREROUTING ACCEPT [113:19617]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
[0:0] -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
[0:0] -A POSTROUTING -o eth1 -j SNAT --to-source 83.149.204.26

COMMIT
# Completed on Thu Oct 14 09:15:31 2004
# Generated by iptables-save v1.2.6a on Thu Oct 14 09:15:31 2004
*mangle
:PREROUTING ACCEPT [434:45184]
:INPUT ACCEPT [434:45184]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:POSTROUTING ACCEPT [0:0]

COMMIT

# Completed on Thu Oct 14 09:15:31 2004

# Generated by iptables-save v1.2.6a on Thu Oct 14 09:15:31 2004

*filter

:INPUT DROP [297:33285]

:FORWARD DROP [0:0]

:OUTPUT DROP [0:0]

:allowed - [0:0]

:bad_tcp_packets - [0:0]

:icmp_packets - [0:0]

:tcp_packets - [0:0]

:udp_packets - [0:0]

[0:0] -A INPUT -p tcp -j bad_tcp_packets

[0:0] -A INPUT -s 192.168.0.0 -i eth0 -j ACCEPT

[0:0] -A INPUT -s 127.0.0.1 -i lo -j ACCEPT

[0:0] -A INPUT -s 192.168.0.30 -i lo -j ACCEPT

[0:0] -A INPUT -s 83.149.204.26 -i lo -j ACCEPT

[0:0] -A INPUT -d 83.149.204.26 -m state --state RELATED,ESTABLISHED -j ACCEPT

[0:0] -A INPUT -i eth1 -p tcp -j tcp_packets
[0:0] -A INPUT -i eth1 -p udp -j udp_packets

[0:0] -A INPUT -i eth1 -p icmp -j icmp_packets
[0:0] -A INPUT -d 224.0.0.0/255.0.0.0 -i eth1 -j DROP

[0:0] -A FORWARD -p tcp -j bad_tcp_packets
[0:0] -A FORWARD -i eth1 -j ACCEPT

[0:0] -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

[0:0] -A OUTPUT -p tcp -j bad_tcp_packets
[0:0] -A OUTPUT -s 127.0.0.1 -j ACCEPT

[0:0] -A OUTPUT -s 192.168.0.30 -j ACCEPT
[0:0] -A OUTPUT -s 83.149.204.26 -j ACCEPT

[0:0] -A allowed -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
[0:0] -A allowed -p tcp -m state --state

RELATED,ESTABLISHED -j ACCEPT

[0:0] -A allowed -o tcp -j DROP

[0:0] -A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
[0:0] -A bad_tcp_packets -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "New not syn:"
[0:0] -A bad_tcp_packets -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP

[0:0] -A icmp_packets -s 192.168.0.0/255.255.0.0 -p icmp -m icmp --icmp-type 8 -j ACCEPT

[0:0] -A icmp_packets -s 192.168.0.0/255.255.0.0 -p icmp -m icmp --icmp-type 11 -j ACCEPT

[0:0] -A tcp_packets -s 192.168.0.0/255.255.0.0 -p tcp -m tcp --dport 21 -j allowed

[0:0] -A tcp_packets -s 192.168.0.0/255.255.0.0 -p tcp -m tcp --dport 22 -j allowed

[0:0] -A udp_packets -s 192.168.0.0/255.255.0.0 -p udp -m udp --dport 53 -j ACCEPT

[0:0] -A udp_packets -d 83.149.204.27 -i eth1 -p udp -m udp --dport 135:139 -j DROP

COMMIT
# Completed on Thu Oct 14 09:15:31 2004

• iptables+squid, куа, 10:53 , 14-Окт-04, (1)  
  • iptables+squid, kid, 11:06 , 14-Окт-04, (2)  
    • iptables+squid, dimus, 15:36 , 15-Окт-04, (3)  
• iptables+squid, Hunter, 12:23 , 18-Окт-04, (4)