การทำ route ใน rc.local เพื่อแยก internet

route del default eth0
route del default eth2
route add default gw 122.154.37.201 eth2
ifconfig eth2 up
/etc/init.d/chilli.iptables

 

ส่วนใน chillispot คือ file chilli.iptables

IPTABLES="/sbin/iptables"
EXTIF="eth0"
EXTIF2="eth2"
INTIF="eth1"

$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT

#Allow related and established on all interfaces (input)
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

#Allow releated, established and ssh on $EXTIF. Reject everything else.
$IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 22 --syn -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 80 --syn -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -p tcp -m tcp --dport 3990 --syn -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -j REJECT

#Allow releated, established and ssh on $EXTIF. Reject everything else.
$IPTABLES -A INPUT -i $EXTIF2 -p tcp -m tcp --dport 22 --syn -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF2 -p tcp -m tcp --dport 80 --syn -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF2 -p tcp -m tcp --dport 3990 --syn -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF2 -j REJECT
#Allow related and established from $INTIF. Drop everything else.
$IPTABLES -A INPUT -i tun0 -p tcp -m tcp --dport 22 --syn -j ACCEPT
$IPTABLES -A INPUT -i $INTIF -j DROP

#Allow http and https on other interfaces (input).
#This is only needed if authentication server is on same server as chilli
$IPTABLES -A INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 443 --syn -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 3128 --syn -j ACCEPT
#Allow 3990 on other interfaces (input).
$IPTABLES -A INPUT -p tcp -m tcp --dport 3990 --syn -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp --dport 21 --syn -j ACCEPT
$IPTABLES -A INPUT -m mac --mac-source 00:23:69:17:61:8A -j DROP
$IPTABLES -A INPUT -m mac --mac-source 00:11:09:42:73:D0 -j DROP
$IPTABLES -A INPUT -m mac --mac-s#Allow everything on loopback interface.
$IPTABLES -A INPUT -i lo -j ACCEPT

# Drop everything to and from $INTIF (forward)
# This means that access points can only be managed from ChilliSpot
$IPTABLES -A FORWARD -i $INTIF -j DROP
$IPTABLES -A FORWARD -o $INTIF -j DROP

#Enable NAT on output device
$IPTABLES -t nat -A POSTROUTING -s 10.3.0.0/18 -o $EXTIF2 -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -s 10.3.0.0/18 -o $EXTIF  -j MASQUERADE

$IPTABLES -t nat -A POSTROUTING -o $EXTIF2 -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MAQUERADE

$IPTABLES -t nat -A PREROUTING -i tun0 -p tcp -m tcp -d 10.0.0.0/8 --dport 80 -j RETURN
$IPTABLES -t nat -A PREROUTING -i tun0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128
ource 00:13:8F:A4:EB:F7 -j DROP