gearfox

@qiaofanxing 我手贱用 TR069 给光猫 NTP 对时了后，通用密码就登不进去了

别安装这个，直接安装 nomachine
链接 https://downloads.nomachine.com/linux/?id=1

搜了几个教程，汇总成如下，请各位大神看看有没有问题，没有敢运行，怕有问题影响生产。
[安装组件]
yum install ipset iptables-services iptables-devel ipset-service -y

[下载 ip 段做 ipset]
wget http://www.ipdeny.com/ipblocks/data/countries/cn.zone
for i in `cat cn.zone`; do echo "ipset add china $i" >>ipset_result.sh; done
chmod +x ipset_result.sh
ipset create china hash:net hashsize 10000 maxelem 1000000
sh ipset_result.sh

ipset add china 10.0.0.0/8
ipset add china 172.16.0.0/12
ipset add china 192.168.0.0/16
ipset list china | wc -l
ipset test china 192.168.1.0
ipset save china > /etc/ipset.conf

chmod +x /etc/rc.d/rc.local
echo "ipset restore < /etc/ipset.conf" >> /etc/rc.d/rc.local

[iptables 脚本]
#!/bin/bash
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

service iptables restart

iptables -F
iptables -X
iptables -Z
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat

modprobe iptable_filter
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ip_tables
modprobe iptable_nat

iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

IP1=111.111.111.111
LAN1=192.168.1.0/24

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A INPUT -m set --match-set china src -j ACCEPT
iptables -A FORWARD -m set --match-set china src -j ACCEPT

iptables -A INPUT -s $LAN1 -j ACCEPT
iptables -A FORWARD -s $LAN1 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -m set --match-set china src -d $IP1 --dport 80 -j DNAT --to-destination 192.168.1.10:80
iptables -t nat -A PREROUTING -p tcp -m set --match-set china src -d $IP1 --dport 443 -j DNAT --to-destination 192.168.1.10:443
iptables -t nat -A PREROUTING -p tcp -m set --match-set china src -d $IP1 --dport 58000 -j DNAT --to-destination 192.168.1.10:58000

iptables -A INPUT -p tcp --dport 57000 -j ACCEPT #本机 SSH
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 192.168.1.0/24 -j SNAT --to-source 192.168.1.254
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

sysctl -w net.ipv4.tcp_keepalive_time=600
sysctl -w net.ipv4.tcp_synack_retries=1
sysctl -w net.ipv4.tcp_syn_retries=1
sysctl -w net.ipv4.tcp_max_syn_backlog=16384
sysctl -w net.nf_conntrack_max=655360

[持久化规则]
iptables-save > /etc/sysconfig/iptables
echo "/usr/sbin/iptables-restore < /etc/sysconfig/iptables" >> /etc/rc.d/rc.local

群晖 威联通这 2 家里选一个即可，别再胡买了

Welcome to nginx!
If you see this page, the nginx web server is successfully installed and working. Further configuration is required.

For online documentation and support please refer to nginx.org.
Commercial support is available at nginx.com.

Thank you for using nginx.

我几乎不玩游戏，4060

京东上买山泽、TP 的 6 类线即可，我买过用过很多箱，给企业做布线