IPTables - Unix script and Smoothwall
David Wilson <dgwilson-wUU9E3n5/[email protected]> Sun, 31 Oct 2004 13:11:33 +1300
| Newsgroups | gmane.comp.security.firewalls.smoothwall.general |
|---|---|
| Message-ID | <BDAA9505.126C%[email protected]> |
[Resending this. No response first time and I'm not sure it got out...]
Hello....
I have a unix script below. It has been provided to me by someone out in the
wicked wide world and was not coded to run on smoothwall. It's intent is to
setup packet forwarding/routing rules. The script is syntactically correct
and does run.
What I want to know is, Will it work on smoothwall, and will it have the
desired effect. [I have edited the external ip address to preserver the
identify of the innocent]
[this e-mail has a bit of line wrap in it, sorry about that. Makes it a bit
difficult to read]
- David
#!/bin/sh
# by TRex
# IPTABLES path
# The number below depends on your system configuration
#IPT=`whereis iptables | awk ' {print $2}'`
IPT="iptables"
echo "script underway..."
#---------------------------------------
PORT="16185"
EXT_IP="202.0.xx.xx"
BATTLE_HOST="192.168.10.185 192.168.10.186 192.168.10.187 192.168.10.188
192.168.10.189 192.168.10.190 192.168.10.191 192.168.10.192 192.168.10.193
192.168.10.194 192.168.10.195 192.168.10.196 192.168.10.197 192.168.10.98
192.168.10.199 192.168.10.200"
#---------------------------------------
usage()
{
echo "Usage: $0 {start|stop}"
}
case "$1" in
start)
echo "received START"
PORT_II=$PORT
for HOST in $BATTLE_HOST; do
PORT_I=$PORT_II
$IPT -t nat -A PREROUTING -p udp -d $EXT_IP --dport $PORT_II -j DNAT
--to-destination $HOST:$PORT_II
$IPT -t nat -A POSTROUTING -p udp -s $HOST --sport $PORT_II -j SNAT
--to-source $EXT_IP:$PORT_II
PORT_II=$[PORT_I + 1]
done
$IPT -L -v -t nat |grep "udp spt:16"
$IPT -L -v -t nat |grep "udp dpt:16"
echo "Battle - START - OK"
;;
stop)
PORT_II=$PORT
for HOST in $BATTLE_HOST; do
PORT_I=$PORT_II
$IPT -t nat -D PREROUTING -p udp -d $EXT_IP --dport $PORT_II -j DNAT
--to-destination $HOST:$PORT_II
$IPT -t nat -D POSTROUTING -p udp -s $HOST --sport $PORT_II -j SNAT
--to-source $EXT_IP:$PORT_II
PORT_II=$[PORT_I + 1]
done
$IPT -L -v -t nat |grep "udp spt:16"
$IPT -L -v -t nat |grep "udp dpt:16"
echo "Battle - STOP - OK"
;;
*)
usage
;;
Esac
When it runs, it produces the following output.
received START
0 0 SNAT udp -- any any 192.168.10.185 anywhere
udp spt:16185 to:202.0.52.111:16185
0 0 SNAT udp -- any any 192.168.10.186 anywhere
udp spt:16186 to:202.0.52.111:16186
0 0 SNAT udp -- any any 192.168.10.187 anywhere
udp spt:16187 to:202.0.52.111:16187
0 0 SNAT udp -- any any 192.168.10.188 anywhere
udp spt:16188 to:202.0.52.111:16188
0 0 SNAT udp -- any any 192.168.10.189 anywhere
udp spt:16189 to:202.0.52.111:16189
0 0 SNAT udp -- any any 192.168.10.190 anywhere
udp spt:16190 to:202.0.52.111:16190
0 0 SNAT udp -- any any 192.168.10.191 anywhere
udp spt:16191 to:202.0.52.111:16191
0 0 SNAT udp -- any any 192.168.10.192 anywhere
udp spt:16192 to:202.0.52.111:16192
0 0 SNAT udp -- any any 192.168.10.193 anywhere
udp spt:16193 to:202.0.52.111:16193
0 0 SNAT udp -- any any 192.168.10.194 anywhere
udp spt:16194 to:202.0.52.111:16194
0 0 SNAT udp -- any any 192.168.10.195 anywhere
udp spt:16195 to:202.0.52.111:16195
0 0 SNAT udp -- any any 192.168.10.196 anywhere
udp spt:16196 to:202.0.52.111:16196
0 0 SNAT udp -- any any 192.168.10.197 anywhere
udp spt:16197 to:202.0.52.111:16197
0 0 SNAT udp -- any any 192.168.10.98 anywhere
udp spt:16198 to:202.0.52.111:16198
0 0 SNAT udp -- any any 192.168.10.199 anywhere
udp spt:16199 to:202.0.52.111:16199
0 0 SNAT udp -- any any 192.168.10.200 anywhere
udp spt:16200 to:202.0.52.111:16200
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16185 to:192.168.10.185:16185
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16186 to:192.168.10.186:16186
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16187 to:192.168.10.187:16187
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16188 to:192.168.10.188:16188
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16189 to:192.168.10.189:16189
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16190 to:192.168.10.190:16190
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16191 to:192.168.10.191:16191
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16192 to:192.168.10.192:16192
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16193 to:192.168.10.193:16193
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16194 to:192.168.10.194:16194
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16195 to:192.168.10.195:16195
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16196 to:192.168.10.196:16196
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16197 to:192.168.10.197:16197
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16198 to:192.168.10.98:16198
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16199 to:192.168.10.199:16199
0 0 DNAT udp -- any any anywhere
202-0-xx-xxx.cable.myplace.netudp dpt:16200 to:192.168.10.200:16200
_______________________________________________
gpl mailing list
[email protected]
http://lists.smoothwall.org/mailman/listinfo/gpl
SmoothWall Stash - Buy Our Stuff! http://cafepress.com/smoothwall