Beh, se vuoi avere un'idea ecco il post con le mie configurazioni.. Io uso iptables "manualmente" xche nessuno dei vari tool grafici (io consiglio vivamente guarddog, uno dei migliori, a mio parere) non dava in modo immediato la possibilità di scrivere regole per iptables che contemplassero una rete con 2 IP sulla stessa scheda di rete (ho diversi PC + MODEM ADSL connessi a un solo hub, cosi il PC con router/firewall ha una sola scheda), in genere gli script che trovi via internet contemplano una scehda dedicata a internet e una diversa per la rete interna.. Non è uno script "paranoico" ma mi sembra sufficiente per una rete casalinga:

#!/bin/sh<br />## script to enable masquerading<br />## must be run as root after the DSL connection is up<br />## usage: sh nat.sh<br />#<br /># bring up alias interface eth0:0 :<br />#ifconfig eth0:1 192.168.0.1 netmask 255.255.255.0 broadcast 192.168.0.255 up<br />#N.B. To load this script at boot put "sh /path/to/scrip/firewall.sh" at the bottom of /etc/rc.local<br /><br />######### RESET IPTABLES<br />echo -n "Cleaning Tables... "<br />#<br /># reset the default policies in the filter table.<br />#<br />iptables -P INPUT ACCEPT<br />iptables -P FORWARD ACCEPT<br />iptables -P OUTPUT ACCEPT<br /><br />#<br /># reset the default policies in the nat table.<br />#<br />iptables -t nat -P PREROUTING ACCEPT<br />iptables -t nat -P POSTROUTING ACCEPT<br />iptables -t nat -P OUTPUT ACCEPT<br /><br />#<br /># reset the default policies in the mangle table.<br />#<br />iptables -t mangle -P PREROUTING ACCEPT<br />iptables -t mangle -P OUTPUT ACCEPT<br /><br />#<br /># flush all the rules in the filter and nat tables.<br />#<br />iptables -F<br />iptables -t nat -F<br />iptables -t mangle -F<br />#<br /># erase all chains that's not default in filter and nat table.<br />#<br />iptables -X<br />iptables -t nat -X<br />iptables -t mangle -X<br /><br />######### RESET DONE<br />echo "done!"<br />######### BRING UP FIREWALL<br />echo "Bringing Up Firewall... "<br /># Determine the external IP automatically:<br />EXTIP="`/sbin/ifconfig ppp0 | grep 'inet addr' | awk '{print $2}' | sed -e 's/.*://'`"<br /><br /># if u want to share your internet securely. u must do that by FORWARD chain.<br /> <br />iptables -P FORWARD DROP # assing the default policy to drop for FORWARD chain<br />iptables -A FORWARD -s 192.168.0.0/24 -j ACCEPT # accept all which come from your net and go to other net (like internet)<br />iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT<br />iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT # allow all established related packets.<br /> <br />#now your local networks behind your firewall is in secure enough. <br /><br />#and if u wanna secure your gateway linux, u must do that by INPUT chain:<br /><br />iptables -P INPUT DROP<br />iptables -A INPUT -s 127.0.0.1/8 -j ACCEPT<br />iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT<br />iptables -A INPUT -s 10.0.0.0/24 -j ACCEPT<br />iptables -A INPUT -s $EXTIP -j ACCEPT<br />iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT<br /><br />#open port:<br />#rule: iptables -A INPUT -i ppp0 -p (protocol) --dport (port_no) -j ACCEPT<br /><br />#FTP<br />iptables -A INPUT -i ppp0 -p tcp --dport 21 -j ACCEPT<br />#SSH<br />iptables -A INPUT -i ppp0 -p tcp --dport 22 -j ACCEPT<br />#SMTP<br />iptables -A INPUT -i ppp0 -p tcp --dport 25 -j ACCEPT<br />#HTTP and HTTPS<br />#iptables -A INPUT -i ppp0 -p tcp --dport 80 -j ACCEPT<br />#iptables -A INPUT -i ppp0 -p tcp --dport 443 -j ACCEPT<br />#POP3<br />iptables -A INPUT -i ppp0 -p tcp --dport 110 -j ACCEPT<br />iptables -A INPUT -i ppp0 -p tcp --dport 113 -j ACCEPT<br />#NTP<br />#iptables -A INPUT -i ppp0 -p tcp --dport 123 -j ACCEPT<br />#GAIM and C. on M$N<br />iptables -A INPUT -i ppp0 -p tcp --dport 1863 -j ACCEPT<br />#eDonkey-aMule<br />iptables -A INPUT -i ppp0 -p tcp --dport 4661 -j ACCEPT<br />iptables -A INPUT -i ppp0 -p tcp --dport 4662 -j ACCEPT<br />iptables -A INPUT -i ppp0 -p udp --dport 4665 -j ACCEPT<br />iptables -A INPUT -i ppp0 -p udp --dport 4664 -j ACCEPT<br />iptables -A INPUT -i ppp0 -p udp --dport 4672 -j ACCEPT<br />#edonkey webserber<br />iptables -A INPUT -i ppp0 -p tcp --dport 4711 -j ACCEPT<br />iptables -A INPUT -i ppp0 -p tcp --dport 4712 -j ACCEPT<br />#Webmin<br />iptables -A INPUT -i ppp0 -p tcp --dport 10000 -j ACCEPT<br />#FreeDB and CDDB<br />#iptables -A INPUT -i ppp0 -p tcp --dport 888 -j ACCEPT<br />#iptables -A INPUT -i ppp0 -p tcp --dport 8880 -j ACCEPT<br />#Nicotine/Soulseek<br />iptables -A INPUT -i ppp0 -p tcp --dport 2234 -j ACCEPT<br />#DNS<br />iptables -A INPUT -i ppp0 -p tcp --dport 53 -j ACCEPT<br />#PING (now disabled)<br />iptables -A INPUT -i ppp0 -p ICMP -j ACCEPT<br />#Mute port<br />iptables -A INPUT -i ppp0 -p tcp --dport 4900 -j ACCEPT<br />iptables -A INPUT -i ppp0 -p tcp --dport 4901 -j ACCEPT<br /><br />echo "Paranoid rules..."<br /># Deny and log (option -l) spoofed packets from external network (eth0) which mimic internal IP addresses<br />iptables -A INPUT -s 192.168.0.0/24 -i ppp0 -j REJECT<br />iptables -A INPUT -s 127.0.0.1/8 -i ppp0 -j DROP <br />#<br /># Per sicurezza imposto una regola di log finale ed una regola di drop come ultima risorsa<br />#<br />iptables -A INPUT -i ppp0 -j LOG --log-prefix "Default drop:"<br />iptables -A INPUT -i ppp0 -j DROP<br /><br />######### FIREWALL DONE<br />echo "Firewall done!"<br />######### MASQUERADING AND IP FORWARDING<br />echo -n "Enable Masquerading... "<br /># Next, an iptables rule to enable masquerading:<br /><br />iptables -t nat -I POSTROUTING -o ppp0 -j MASQUERADE<br /><br /># Finally, enable ip forwarding (already active by default in my conf):<br /><br />echo 1 > /proc/sys/net/ipv4/ip_forward<br /><br />######### MASQUERADING AND IP FORWARDING DONE<br />echo "done!"<br />#save iptables<br />#iptables-save >/etc/sysconfig/iptables<br />echo "All done!"