代理服务器安全配置

killapper

于 2015-05-31 22:13:50 发布

阅读量858

点赞数

CC 4.0 BY-SA版权

本文链接：https://blog.youkuaiyun.com/killapper/article/details/46292547

代理服务器安全隔离，防止用户通过代理访问服务器本身其他端口

代理服务运行以ssuser权限运行

服务器地址ipv4 133.130.48.1 ipv6 ::1,2400:8500:1301:727:133:130:48:01

代理服务器端口:127.0.0.1:11000

groupadd ssuser
useradd ssuser -g ssuser
iptables -t nat -A PREROUTING -d 133.130.48.1/32 -p tcp -m tcp --dport 110 -j DNAT --to-destination 133.130.48.1:11000
iptables -t nat -A PREROUTING -d 133.130.48.1/32 -p udp -m udp --dport 110 -j DNAT --to-destination 133.130.48.1:11000
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 11000 -j ACCEPT
iptables -A INPUT -p udp -m state --state NEW -m udp --dport 11000 -j ACCEPT
iptables -t filter -m owner --gid-owner ssuser -A OUTPUT -d 127.0.0.1,133.130.48.1 -j DROP
ip6tables -t filter -m owner --gid-owner ssuser -A OUTPUT -d ::1,2400:8500:1301:727:133:130:48:01/64 -j DROP