23:24:44 up 7 days, 13:50, 1 user, load average: 0.00, 0.00, 0.00
[root@RServer ~]# ipsec look
RServer Wed Aug 13 23:25:03 CST 2008
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 xx.xx.xx.xx 0.0.0.0 UG 0 0 0 eth0
10.1.1.0 xx.xx.xx.xx 255.255.255.0 UG 0 0 0 eth0
xxx.xxx.xxx.xxx 0.0.0.0 255.255.255.248 U 0 0 0 eth0
modprobe ip_tables
modprobe iptable_filter
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
#-----------------------------------------------------------
EXT_IF="eth1"
INT_IF="eth0"
EXT_IP="xx.xx.xx.xx" 本地公网ip
INT_IP="10.1.2.1"
#-----------------------------------------------------------
iptables -F -t filter
iptables -X -t filter
iptables -Z -t filter
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
#-----------------------------------------------------------
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#-----------------------------------------------------------
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -s xx.xx.xx.xx -j ACCEPT 对端外网卡配置的公网地址允许
iptables -A INPUT -s 10.1.1.0/24 -j ACCEPT 对端私有网络
iptables -A FORWARD -s 10.1.1.0/24 -j ACCEPT 对端私有网络
iptables -A FORWARD -s 10.1.2.0/24 -j ACCEPT 本端私有网络
#-----------------------------------------------------------
#------------------------------------nat--------------------
iptables -t nat -A POSTROUTING -s 10.1.2.0/24 -o eth1 -j SNAT --to xx.xx.xx.xx