#!/bin/bash
echo "1" > /proc/sys/net/ipv4/ip_forward
arp -f /root/mac.txt
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
iptables -F INPUT
iptables -F FORWARD
iptables -F POSTROUTING -t nat
iptables -p FORWARD DROP
#客户机绑定mac地址才能上网，这样防止恶意增加IP在公司内部上网，引起不安全隐患
cat /root/mac.txt | while read LINE
do
ipaddress=`echo $LINE | awk '{print $1}'`
macaddress=`echo $LINE | awk '{print $2}'`
iptables -A FORWARD -s $ipaddress -m mac --mac-source $macaddress -j ACCEPT
done
#网关上有几块网卡，eth0接的是外网IP地址，eth1、eth2等对应该局域网IP，因是租用了电信的光纤，不存在着ADSL上网情况
iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.1.0/24 -j SNAT --to 59.195.233.234
#iptables -t nat -A POSTROUTING -o eth0 -s 192.168.1.0/24 -j MASQUERADE
cat /root/mac.txt
192.168.1.50 00:16:D3:F6:BD:F5
192.168.1.57 00:16:36:B4:6C:5D