DMZ配置

           1.内外网映射
           2.开机自启iptable规则
           3.修改ssh远程连接端口
           4.端口开放以及指定ip段访问以及
           5.防ping
           6.关闭时间同步服务
           7.日志过大自动转移至moosefs
           8.1473网页跳转

内外网映射

DMZ主机配置

在创建好Ubuntu虚拟机后，我们做内网映射

vi /etc/rc.local进去以后加入下列命令

然后进入网卡设置

vi /etc/network/interfaces后添加网卡

然后进入iptables

cd 
vi iptables.rule
输入下列代码

#!/bin/bash
#1,input parameters
EXTIF="ens160"		#出站网卡
INIF="ens192"
INIF="ens192:1"
INIF="ens192:2"		#入站网卡
EXTIP="10.3.14.41"	#出站ip
INNET="172.16.10.0/24"	#入站ip
INNET="172.16.9.0/24"
INNET="172.16.8.0/24"

#2,linux kernel network function
echo "1"> /proc/sys/net/ipv4/tcp_syncookies
echo "1"> /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
for i in /proc/sys/net/ipv4/conf/*/rp_filter;do
    echo "1">$i
done
for i in /proc/sys/net/ipv4/conf/*/log_martians;do
    echo "1">$i
done
for i in /proc/sys/net/ipv4/conf/*/accept_source_route; do
    echo "0">$i
done
for i in /proc/sys/net/ipv4/conf/*/accept_redirects;do 
   echo "0">$i
done
for i in /proc/sys/net/ipv4/conf/*/send_redirects;do
   echo "0">$i
done

#3,clear rules init eth
iptables -F
iptables -X
iptables -Z
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED -j ACCEPT

#3.1  allow nat internet
iptables -A FORWARD -i $INIF -j ACCEPT

#4,start other iptables modules
if [ -f /root/iptables/iptables.deny ];then
    sh /root/iptables/iptables.deny
fi
if [ -f /root/iptables/iptables.allow ];then
    sh /root/iptables/iptables.allow
fi
if [ -f /usr/local/virus/httpd-err/iptables.http ];then
    sh /usr/local/virus/httpd-err/iptables.http
fi
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

#5,allow some type icmp data in
AICMP="0 3 3/4 4 8 11 12 14 16 18"
for tyicmp in $AICMP
do
    iptables -A INPUT -i $EXTIF -p icmp --icmp-type $tyicmp -j ACCEPT
done

#开放部分端口
#6,allow some services in
iptables -A INPUT -p TCP -i $EXTIF --dport 1221 -j ACCEPT 
iptables -A INPUT -p TCP -i $EXTIF --dport 3000 -j ACCEPT
#iptables -A INPUT -p TCP -i $EXTIF --dport 53 -j ACCEPT 
iptables -A INPUT -p TCP -i $EXTIF --dport 80 -j ACCEPT 
iptables -A INPUT -p TCP -i $EXTIF --dport 25 -j ACCEPT 
iptables -A INPUT -p TCP -i $EXTIF --dport 110 -j ACCEPT 
iptables -A INPUT -p TCP -i $EXTIF --dport 3306 -j ACCEPT 
iptables -A INPUT -p TCP -i $EXTIF --dport 443 -j ACCEPT 
iptables -A INPUT -p TCP -i $EXTIF --dport 8080 -j ACCEPT

#7,load some useful modules
modules="ip_tables iptable_nat ip_nat_ftp ip_nat_irc ip_conntrack ip_conntrack_ftp ip_conntrack_irc"
for mod in $modules
do 
    testmod=`lsmod | grep "^$(mod)" | awk '{print $1}'`
    if [ "$testmod" == "" ];then
          modeprobe $mod
    fi
done

#8 clear nat tables rule
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT

#9 open for router  ip share
if [ "$INIF" != "" ];then
	iptables -A INPUT -i $INIF -j ACCEPT
	echo "1" > /proc/sys/net/ipv4/ip_forward
	if [ "$INNET" != "" ];then
		for innet in $INNET
		do 
			iptables -t nat -A POSTROUTING -s $innet -o $EXTIF -j MASQUERADE
		done
	fi 
fi

#F
#端口映射
#moosefs
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14810 -j DNAT --to 172.16.8.10:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 9425 -j DNAT --to 172.16.8.10:9425
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14811 -j DNAT --to 172.16.8.11:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14812 -j DNAT --to 172.16.8.12:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14813 -j DNAT --to 172.16.8.13:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14814 -j DNAT --to 172.16.8.14:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14815 -j DNAT --to 172.16.8.15:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14816 -j DNAT --to 172.16.8.16:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14817 -j DNAT --to 172.16.8.17:22


#mysql_cluster
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14910 -j DNAT --to 172.16.9.10:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14911 -j DNAT --to 172.16.9.11:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14912 -j DNAT --to 172.16.9.12:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14913 -j DNAT --to 172.16.9.13:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14914 -j DNAT --to 172.16.9.14:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14915 -j DNAT --to 172.16.9.15:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14916 -j DNAT --to 172.16.9.16:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14917 -j DNAT --to 172.16.9.17:22
iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14918 -j DNAT --to 172.16.9.18:22

注解：iptables -t nat -A PREROUTING -d $EXTIP -p tcp --dport 14918 -j DNAT --to 172.16.9.18:22
      其中14918为映射端口，172.16.9.18:22为所需映射主机的服务端口，22端口为远程端口  

然后保存退出，执行iptables

sh iptables.rule

然后当你需要远程的时候就在putty上