Помогите с роутингом...
#!/bin/bash
IPTABLES='/sbin/iptables'
EXTIF='eth0'
INTIF1='eth1'
EXTIP='192.168.55.214'
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
$IPTABLES -A FORWARD -i $INTIF1 -o $EXTIF -m state --state NEW,ESTABLISHED -j ACCEPT
###########################################################################################
$IPTABLES -A INPUT -p tcp --dport 21 -s 192.168.115.106 -j DROP
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
# SMB
$IPTABLES -A INPUT -s 10.0.0.10/16 -p tcp --dport 137:139 -j ACCEPT
$IPTABLES -A INPUT -s 10.0.0.10/16 -p udp --dport 137:139 -j ACCEPT
$IPTABLES -A INPUT -s 10.0.0.10/16 -p tcp --dport 445 -j ACCEPT
$IPTABLES -A INPUT -s 10.0.0.10/16 -p udp --dport 445 -j ACCEPT
$IPTABLES -A INPUT -s 192.168.55.11 -p tcp --dport 137:139 -j ACCEPT
$IPTABLES -A INPUT -s 192.168.55.11 -p udp --dport 137:139 -j ACCEPT
$IPTABLES -A INPUT -s 192.168.55.11 -p tcp --dport 445 -j ACCEPT
$IPTABLES -A INPUT -s 192.168.55.11 -p udp --dport 445 -j ACCEPT
$IPTABLES -A INPUT -s 192.168.55.170 -p tcp --dport 137:139 -j ACCEPT
$IPTABLES -A INPUT -s 192.168.55.170 -p udp --dport 137:139 -j ACCEPT
$IPTABLES -A INPUT -s 192.168.55.170 -p tcp --dport 445 -j ACCEPT
$IPTABLES -A INPUT -s 192.168.55.170 -p udp --dport 445 -j ACCEPT
#"Counter-Strike: Source" ports 27015 SV / 27005 CL
$IPTABLES -A INPUT -p udp --dport 27015 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 27005 -j ACCEPT
#открою ка пока все юзерпорты
$IPTABLES -A INPUT -p tcp --dport 1024:65535 -j ACCEPT
# Мои сервисы
$IPTABLES -A INPUT --protocol tcp --dport 21 -j ACCEPT # ftp
$IPTABLES -A INPUT --protocol tcp --dport 22 -j ACCEPT # ssh
$IPTABLES -A INPUT --protocol tcp --dport 80 -j ACCEPT # apache
$IPTABLES -A INPUT --protocol tcp --dport 8001 -j ACCEPT # icecast
$IPTABLES -A INPUT --protocol tcp --dport 8112 -j ACCEPT #deluge
$IPTABLES -A INPUT --protocol tcp --dport rsync -j ACCEPT # gentoo rsync 873
$IPTABLES -A INPUT -s 192.168.0.0/16 --protocol tcp --dport 2010 -j ACCEPT # xapoh
# Разрешаем пакеты из установившихся и связаных соединений
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# ICMP
$IPTABLES -A INPUT -p icmp -j ACCEPT
############################
ip rule add from 10.0.0.0/24 to 192.168.0.0/16 table 100 priority 102
ip rule add from 10.0.0.0/24 to 172.16.0.0/12 table 100 priority 102
ip rule add from 10.0.0.0/24 to 78.108.64.0/20 table 100 priority 102
ip rule add from 10.0.0.0/24 to 62.165.52.0/24 table 100 priority 102
ip rule add from 10.0.0.0/24 to 62.165.62.0/24 table 100 priority 102
ip rule add from 10.0.0.0/24 to 83.146.72.15/32 table 100 priority 102
ip rule add from 10.0.0.0/24 to 83.146.76.0/24 table 100 priority 102
ip rule add from 10.0.0.0/24 to 83.146.78.0/24 table 100 priority 102
ip rule add from 10.0.0.0/24 to 83.146.79.0/24 table 100 priority 102
ip rule add from 10.0.0.0/24 to 83.146.125.0/24 table 100 priority 102
ip rule add from 10.0.0.0/24 to 195.161.195.128/25 table 100 priority 102
ip rule add from 10.0.0.0/24 to 213.24.188.0/25 table 100 priority 102
ip rule add from 10.0.0.0/24 to 213.59.50.0/24 table 100 priority 102
ip rule add from 10.0.0.0/24 to 217.106.58.0/26 table 100 priority 102
ip rule add from 10.0.0.0/24 to 195.239.58.160/27 table 100 priority 102
ip rule add from 10.0.0.0/24 to 195.239.132.0/24 table 100 priority 102
ip rule add from 10.0.0.0/24 to 80.237.48.70/32 table 100 priority 102
ip rule add from 10.0.0.0/24 to 80.237.48.80/28 table 100 priority 102
ip rule add from 10.0.0.0/24 to 10.0.0.0/8 table 100 priority 102
ip route add default via 172.17.55.1 table 100 priority 102
ip route add 10.0.0.0/24 dev eth1 src 10.0.0.10 table 100 priority 102
IF1='eth0' #интерфейс рас
IF2='eth0' #интерфейс 2
IF3='eth0' #интерфейс 3
#####Айпишники интерфейсоф
IP1='192.168.55.214'
IP2='[реальныip]'
IP3='172.17.55.7'
#### шлюзы ##########
P1='192.168.55.129'
P2='[реальныipшлюз]'
P3='172.17.55.1'
##############
ip route add default via $P1 table 91
ip route add default via $P2 table 92
ip route add default via $P3 table 93
ip route add 172.17.55.0/24 dev $IF3 src $IP3 table 93
ip route add [реальныipшлюз] dev $IF2 src $IP2 table 92
ip route add 192.168.55.0/24 dev $IF1 src $IP2
ip route add default via $P2
ip rule add from $IP1 table 91
ip rule add from $IP2 table 92
ip rule add from $IP3 table 93
ip route add 192.168.0.0/16 via $P1
ip route add 172.16.0.0/12 via $P1
ip route add 78.108.64.0/20 via $P1
ip route add 62.165.52.0/24 via $P1
ip route add 62.165.62.0/24 via $P1
ip route add 83.146.72.15/32 via $P1
ip route add 83.146.76.0/24 via $P1
ip route add 83.146.78.0/24 via $P1
ip route add 83.146.79.0/24 via $P1
ip route add 83.146.125.0/24 via $P1
ip route add 195.161.195.128/25 via $P1
ip route add 213.24.188.0/25 via $P1
ip route add 213.59.50.0/24 via $P1
ip route add 217.106.58.0/26 via $P1
ip route add 195.239.58.160/27 via $P1
ip route add 195.239.132.0/24 via $P1
ip route add 80.237.48.70/32 via $P1
ip route add 80.237.48.80/28 via $P1
ip route add 10.0.0.0/8 via $P1
#ip route add default scope global nexthop via $P2 dev $IF2 weight 1 nexthop via $P3 dev $IF3 weight 1
с локалки 10.0.0.0/24 (та что натицо маскарадом) невидно сам шлюз ни по 192.168.55.214 ни по 172.17.55.7 ни по [реальныip] только по 10.0.0.10
- Для комментирования войдите или зарегистрируйтесь