script vpn

internet-------server-vpn------------router------------intranet kantor.

server vpn :
sisi internet : 192.168.1.10
sisi router : 192.168.222.3

router :
sisi ke server-vpn : 192.168.222.1
ssi intranet : 10.x.x.x


Kenapa dibutuhkan router, karena ketersediaan ip kantor sdh dibatasi oleh admin kantor sehingga saat user > 5 user, ip intranet sdh tdk ada lagi.

//Script utk mengatur/filter

iptables -F

iptables -t nat -F

iptables -t mangle -F

#Block paket2 email

iptables -I INPUT -p tcp --dport 25 -i ppp0 -m state --state NEW -m recent --update --seconds 120 --hitcount 4 -j DROP

#Block ping

iptables -N syn_flood

iptables -A INPUT -p tcp --syn -j syn_flood

iptables -A syn_flood -m limit --limit 1/s --limit-burst 3 -j RETURN

iptables -A syn_flood -j DROP

#Limiting the incoming icmp ping request:

iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j ACCEPT

iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j LOG --log-prefix PING-DROP:

iptables -A INPUT -p icmp -j DROP

iptables -A OUTPUT -p icmp -j ACCEPT

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE 

#setting di grup 1

iptables -A FORWARD --src 192.168.222.128/26 -d 10.2.1.5 -j ACCEPT

iptables -A FORWARD --src 192.168.222.128/26 -d 10.32.1.10 -j ACCEPT

iptables -A FORWARD --src 192.168.222.128/26 -d 10.42.2.26 -j ACCEPT 

#berfungsi meloloskan akses ke internet langsung di grup 1 

iptables -A FORWARD --src 192.168.222.128/26 -d ! 10.0.0.0/8 -j ACCEPT

#setting di grup 2

#blok telnet dan SSH

iptables -A INPUT --src 192.168.222.128/26 -p tcp --destination-port 23 -j DROP

iptables -A INPUT --src 192.168.222.128/26 -p tcp --destination-port 22 -j DROP

iptables -A FORWARD --src 192.168.222.128/26 -j DROP 

iptables -A INPUT --src 192.168.222.192/26 -p tcp --destination-port 23 -j DROP

iptables -A INPUT --src 192.168.222.192/26 -p tcp --destination-port 22 -j DROP

iptables -A FORWARD --src 192.168.222.192/26 -d 10.2.1.5 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.32.1.10 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.41.11.114 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.41.11.14 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.65.10.77 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.65.10.78 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.65.10.79 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.11.15.247 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.11.30.67 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.0.42.0/24 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.0.32.99 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.64.1.137 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.41.1.20 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.0.42.19 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.11.15.101 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.32.18.190 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.88.10.250 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.52.34.34 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.32.14.150 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.41.1.6 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.11.28.141 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.131.17.110 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.32.18.65 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.32.18.98 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.11.15.146 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.42.2.26 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.32.18.160 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.42.2.27 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 74.125.236.53 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 74.125.236.54 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 74.125.236.34 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 74.125.236.35 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 74.125.236.36 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 74.125.236.37 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 74.125.236.38 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 74.125.236.39 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 74.125.236.40 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 74.125.236.41 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.64.1.222 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 64.12.162.248 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 64.12.162.249 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 64.12.162.250 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.32.18.188 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -d 10.11.28.136 -j ACCEPT 

#berfungsi meloloskan akses ke internet langsung di grup 2

iptables -A FORWARD --src 192.168.222.192/26 -d ! 10.0.0.0/8 -j ACCEPT

iptables -A FORWARD --src 192.168.222.192/26 -j DROP

iptables -A FORWARD -i eth1 -j ACCEPT

file disimpan sbg fw_vpn di /etc/

Jgn lupa setting sbg router di /etc/init.d/rc.local

echo 1 > /proc/sys/net/ipv4/ip_forward
route del default
route add -net 10.0.0.0 netmask 255.0.0.0 gw 192.168.111.1
route add default dev ppp0
. /etc/fwvpn2

setting di /etc/network/interfaces
# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0 #sisi internet
iface eth0 inet static
address 192.168.1.10
netmask 255.255.255.0
gateway 192.168.1.1

auto eth1
iface eth1 inet static
address 192.168.222.3
netmask 255.255.255.0
broadcast 192.168.222.255
gateway 192.168.222.1

auto dsl-provider
iface dsl-provider inet ppp
pre-up /sbin/ifconfig eth0 up # line maintained by pppoeconf menggunakan aplikasi pppoeconf utk dial ke internet, Modem internet diset sebagai bridge (bukan router).
provider dsl-provider


Semoga bermanfaat.....