分类目录归档:WEB

linux做路由器下用iptables封qq

iptables -A FORWARD -p tcp –dport 8000 -j DROP
iptables -A FORWARD -p udp –dport 8000 -j DROP
iptables -A FORWARD -d tcpconn.tencent.com -j DROP
iptables -A FORWARD -d tcpconn4.tencent.com -j DROP
iptables -A FORWARD -d 218.17.209.23 -j DROP
iptables -A FORWARD -d tcpconn6.tencent.com -j DROP
iptables -A FORWARD -d tcpconn5.tencent.com -j DROP
iptables -A FORWARD -d tcpconn2.tencent.com  -j DROP
iptables -A FORWARD -d tcpconn3.tencent.com -j DROP
iptables -A FORWARD -d  http.tencent.com -j DROP
iptables -A FORWARD -d 218.17.209.42 -j DROP
iptables -A FORWARD -d http.tencent.com -j DROP
iptables -A FORWARD -d 218.17.209.42 -j DROP

nginx + php for mac 开机自动运行

sudo launchctl load -w /opt/local/etc/php5/php.plist

sudo vim /Library/LaunchDaemons/com.xxx.yyy.plist

<?xml version=’1.0′ encoding=’UTF-8’?>
<!DOCTYPE plist PUBLIC “-//Apple Computer//DTD PLIST 1.0//EN”
“http://www.apple.com/DTDs/PropertyList-1.0.dtd” >
<plist version=’1.0′>
<dict>
<key>Label</key><string>com.xxx.yyy</string>
<key>ProgramArguments</key>
<array>
<string>/opt/local/bin/php-cgi</string>
<string>-q</string>
<string>-b</string>
<string>127.0.0.1:900</string>
</array>
<key>Debug</key><false/>
<key>Disabled</key><true/>
<key>OnDemand</key><false/>
</dict>
</plist>

sudo launchctl load -w /Library/LaunchDaemons/com.xxx.yyy.plist

nginx+php虚拟目录下支持php脚本

sudo apt-get install nginx php5-cli php5-cgi

sudo apt-get install lighttpd rcconf

sudo vim /etc/nginx/sites-available/default

location /myweb {

root /home/admin;

autoindex on;

index index.htm index.html index.php;

}

location ~ \.php$ {

root /var/www/nginx-default;

if ( $uri ~ ^/myweb/ ) {

root /home/ihefeadmin;

}

fastcgi_pass   127.0.0.1:9000;

fastcgi_index  index.php;

#fastcgi_param  SCRIPT_FILENAME  /var/www/nginx-default$fastcgi_script_name;

include fastcgi_params;

}

sudo vim /etc/nginx/fastcgi_params

fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;

spawn-fcgi -a 127.0.0.1 -p 9000 -C 10 -u www-data -f /usr/bin/php-cgi

cd /etc/init.d
cp nginx php-cgi
vim php-cgi
nginx –> php-cgi

DAEMON=/usr/bin/spawn-fcgi
DAEMON_OPTS=”-a 127.0.0.1 -p 9000 -C 10 -u www-data -f /usr/bin/php-cgi”

stop)
echo -n “Stopping $DESC: ”
pkill -9 php-cgi
echo “$NAME.”

vpn穿透

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o ppp0 -j MASQUERADE

iptables -A INPUT -p gre -j ACCEPT
iptables -A FORWARD -p gre -j ACCEPT

//=====================================================

#!/bin/sh

iptables="/sbin/iptables"
modprobe="/sbin/modprobe"
depmod="/sbin/depmod"

EXTIF="eth1"
INTIF="eth2"

load () {

    $depmod -a

    $modprobe ip_tables
    $modprobe ip_conntrack
    $modprobe ip_conntrack_ftp
    $modprobe ip_conntrack_irc
    $modprobe iptable_nat
    $modprobe ip_nat_ftp
    $modprobe ip_conntrack_pptp
    $modprobe ip_nat_pptp

echo "enable forwarding..."
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "enable dynamic addr"
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

#  start firewall

    #default policies
    $iptables -P INPUT DROP
    $iptables -F INPUT
    $iptables -P OUTPUT DROP
    $iptables -F OUTPUT
    $iptables -P FORWARD DROP
    $iptables -F FORWARD
    $iptables -t nat -F


echo "  opening loopback interface for socket based services."
$iptables -A INPUT -i lo -j ACCEPT
$iptables -A OUTPUT -o lo -j ACCEPT

echo "  allow all connections OUT and ONLY existing related ones IN"
$iptables -A INPUT -i $INTIF -j ACCEPT
$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A OUTPUT -o $EXTIF -j ACCEPT
$iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$iptables -A FORWARD -j LOG --log-level 7 --log-prefix "Dropped by firewall: "

$iptables -A INPUT -j LOG --log-level 7 --log-prefix "Dropped by firewall: "
$iptables -A OUTPUT -j LOG --log-level 7 --log-prefix "Dropped by firewall: "

echo "  enabling SNAT (MASQUERADE) functionality on $EXTIF"
$iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

$iptables -A INPUT -i $INTIF -j ACCEPT
$iptables -A OUTPUT -o $INTIF -j ACCEPT

echo "  Allowing packets with ICMP data (pings)"
$iptables -A INPUT -p icmp -j ACCEPT
$iptables -A OUTPUT -p icmp -j ACCEPT

$iptables -A INPUT -p udp -i $INTIF --dport 67 -m state --state NEW -j ACCEPT

echo "  port 137 for netBios"
$iptables -A INPUT -i $INTIF -p udp --dport 137 -j ACCEPT
$iptables -A OUTPUT -o $INTIF -p udp --dport 137 -j ACCEPT

echo "  opening port 53 for DNS queries"
$iptables -A INPUT -p udp -i $EXTIF --sport 53 -j ACCEPT

#echo "  opening port 22 for internal ssh"
$iptables -A INPUT -i $INTIF -p tcp --dport 22 -j ACCEPT


$iptables -A INPUT -p gre -j ACCEPT
$iptables -A FORWARD -p gre -j ACCEPT

echo "  opening port 1723 for VPN Server"
$iptables  -A INPUT -p tcp -i $EXTIF --dport 1723 -m state --state NEW -j ACCEPT

echo "  opening port 80 for webserver"
$iptables -A INPUT -p tcp -i $EXTIF --dport 80 -m state --state NEW -j ACCEPT

echo "  opening port 21 for FTP Server"
$iptables  -A INPUT -p tcp -i $EXTIF --dport 21 -m state --state NEW -j ACCEPT

echo "  opening ssh for web on port 2609 for firewig"
$iptables -A INPUT -p tcp --dport 2609 -j ACCEPT
$iptables -A OUTPUT -p tcp --dport 2609 -j ACCEPT

echo "  opening ssh for web on port 22  for betty"
$iptables -A PREROUTING -t nat -i $EXTIF -p tcp --dport 22 -j DNAT  --to 192.168.10.96:2302
$iptables -A FORWARD -p tcp -m state --state NEW -d 192.168.10.96 --dport 2302 -j ACCEPT

#echo "   opening Apache webserver for HoH"
$iptables -A PREROUTING -t nat -i $EXTIF -p tcp --dport 80 -j DNAT --to 192.168.10.96:80
$iptables -A FORWARD -p tcp -m state --state NEW -d 192.168.10.96 --dport 80 -j ACCEPT

}
flush() {
    echo "flushing rules...."
    $iptables -P FORWARD ACCEPT
    $iptables -F INPUT
    $iptables -P INPUT ACCEPT
}

case "$1" in

    start|restart)
    flush
    load
    ;;
    stop)
    flush
    ;;
*)
    echo "usage: start|stop|restart."
;;

esac
exit 0
}

stunnel配置

sudo apt-get install stunnel

sudo vim /etc/default/stunnel4
ENABLED=1

openssl req -new -x509 -days 36500 -nodes -out stunnel.pem -keyout stunnel.pem

sudo vim /etc/stunnel/stunnel.conf
cert = /etc/stunnel/stunnel.pem
key = /etc/stunnel/stunnel.pem

sudo /etc/init.d/stunnel4 restart