Visite também:
Br-Linux ·
VivaOLinux ·
LinuxSecurity ·
Dicas-L ·
NoticiasLinux ·
SoftwareLivre.org ·
[mais]
|
|||||||
| Wiki | Classificados | Galeria | Reviews | Jogos | Comunidades | RSS Feeds | FAQ | Termos de Uso | Sobre |
| Cadastre-se | Fotos | Blogs | Lista de Membros | Calendário | Pesquisar | Mensagens de Hoje | Marcar Fóruns Como Lidos |
SCRIPT DO IPTABLES
 |
|
|
LinkBack | Opções do Tópico |
28-12-2005, 11:28
|
#1 (permalink) |
SCRIPT DO IPTABLES
Fala galera!!!! blz??
Entao.... estou testando um script do Iptables, mas ele funciona somente com os Windows XP e 2000, os 9X nao acessam a Web, mas funcionam o Outlook e o VNC!! Este é meu script: #!/bin/bash ################################### ################################### ############## # # ################################### ################################### ############## #Variáreis Globais REDE_EXTERNA="200.00.00.000" REDE_INTERNA="192.168.1.1" #Carregando os Modulos modprobe ip_tables modprobe ip_nat_ftp modprobe ip_conntrack modprobe ip_conntrack_ftp #Limpando as regras das tabelas iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD #Definindo a Politica Padrão iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT #Liberando a entrada e a saida LOOPBACK iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT #Liberando o Ping iptables -A INPUT -p icmp --icmp-type 0 -j ACCEPT iptables -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT iptables -A OUTPUT -p icmp --icmp-type 0 -j ACCEPT #Habilitando o Ip Forward echo 1 > /proc/sys/net/ipv4/ip_forward ################################### ################################### ############## # Inicio da Cadeia INPUT # ################################### ################################### ############## #Verifica se tem alguma conexão relacionada e libera as portas iptables -A INPUT -m tcp -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT #Liberando acessp a Navegacao Completa a Internet iptables -A INPUT -p tcp --syn -j ACCEPT #Liberando acesso de navegação no servidor BROUSWSER iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_EXTERNA --sport 80 -j ACCEPT iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_INTERNA --sport 80 -j ACCEPT #Liberando servidor HTTP na porta 8080 iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_EXTERNA --dport 8080 -j ACCEPT iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_INTERNA --dport 8080 -j ACCEPT #Liberendo acesso para Outlook POP / SMTP iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_EXTERNA --sport 25 -j ACCEPT iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_INTERNA --sport 25 -j ACCEPT iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_EXTERNA --sport 110 -j ACCEPT iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_INTERNA --sport 110 -j ACCEPT #Liberando a consulta ao servidor DNS - Entrada iptables -A INPUT -m udp -p udp -d 0/0 --sport 53 -j ACCEPT #Liberando acesso do servidor a um servidor FTP iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_EXTERNA --sport 21 -j ACCEPT #Liberando conexão ao ssh do servidor iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_EXTERNA --dport 22 -j ACCEPT iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_INTERNA --dport 22 -j ACCEPT #Liberando a Porta 3128 SQUID iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_INTERNA --dport 3128 -j ACCEPT #Fazendo log de todos os pacotes barrados pela cadeia INPUT iptables -A INPUT -i eth0 -j LOG --log-level 7 --log-prefix "INPUT ACCEPT ETH0: " #Fazendo log de todos os pacotes barrados pela cadeia INPUT iptables -A INPUT -i eth1 -j LOG --log-level 7 --log-prefix "INPUT ACCEPT ETH1: " ################################### ################################### ############## # Inicio da Cadeia OUTPUT # ################################### ################################### ############## #Verifica se tem alguma conexão relacionada e libera as portas iptables -A OUTPUT -m tcp -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT #Liberando acessp a Navegacao Completa a Internet iptables -A INPUT -p tcp --syn -j ACCEPT #Liberando acesso de navegação no servidor BROUSER iptables -A OUTPUT -m tcp -p tcp -s $REDE_EXTERNA -d 0/0 --dport 80 -j ACCEPT iptables -A OUTPUT -m tcp -p tcp -s $REDE_INTERNA -d 0/0 --dport 80 -j ACCEPT #Liberando a consulta ao servidor DNS - Saida iptables -A OUTPUT -m udp -p udp -d 0/0 --dport 53 -j ACCEPT #Liberando acesso do servidor a um servidor FTP iptables -A OUTPUT -m tcp -p tcp -s $REDE_EXTERNA -d 0/0 --dport 21 -j ACCEPT #Liberando o servidor para acesso ao terminal server 3389 #iptables -A OUTPUT -m tcp -p tcp -s $REDE_EXTERNA -d 0/0 --dport 3389 -j ACCEPT #Liberando conexão ao ssh do servidor iptables -A OUTPUT -m tcp -p tcp -s $REDE_EXTERNA -d 0/0 --sport 22 -j ACCEPT iptables -A OUTPUT -m tcp -p tcp -s $REDE_INTERNA -d 0/0 --sport 22 -j ACCEPT #Liberando a saida do servidor HTTP na porta 8080 iptables -A OUTPUT -m tcp -p tcp -s $REDE_EXTERNA -d 0/0 --sport 8080 -j ACCEPT iptables -A OUTPUT -m tcp -p tcp -s $REDE_INTERNA -d 0/0 --sport 8080 -j ACCEPT #Liberendo acesso para Outlook POP / SMTP iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_EXTERNA --sport 25 -j ACCEPT iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_INTERNA --sport 25 -j ACCEPT iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_EXTERNA --sport 110 -j ACCEPT iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_INTERNA --sport 110 -j ACCEPT #Liberando a saida Porta 3128 SQUID iptables -A OUTPUT -m tcp -p tcp -s $REDE_INTERNA -d 0/0 --sport 3128 -j ACCEPT #Fazendo log de todos os pacotes barrados pela cadeia OUTPUT iptables -A OUTPUT -o eth0 -j LOG --log-level 7 --log-prefix "OUTPUT DROP ETH0: " #Fazendo log de todos os pacotes barrados pela cadeia OUTPUT iptables -A OUTPUT -o eth1 -j LOG --log-level 7 --log-prefix "OUTPUT DROP ETH1: " ################################### ################################### ############## # Inicio da Cadeia Forward # ################################### ################################### ############## #Mascaramento para a Rede Interna iptables -t nat -A POSTROUTING -s 192.168.1.1/24 -d 0/0 -j MASQUERADE #Verifica se tem alguma conexão relacionada e libera as portas iptables -A FORWARD -m tcp -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -m udp -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT #Fazendo log de todos os pacotes barrados pela cadeia FORWARD iptables -A FORWARD -i eth0 -j LOG --log-level 7 --log-prefix "FORWARD DROP ETH0: " #Fazendo log de todos os pacotes barrados pela cadeia FORWARD iptables -A FORWARD -i eth1 -j LOG --log-level 7 --log-prefix "FORWARD DROP ETH1: " ################################### ################################### ############## # Inicio da Cadeia NAT # ################################### ################################### ############## #Proxy Transparente #iptables -t nat -A PREROUTING -p tcp -m tcp -s 192.168.1.1/24 -d 0/0 --dport 80 -j REDIRECT --to-port 3128 #iptables -t nat -A PREROUTING -p tcp -m tcp -s 192.168.1.1/24 -d 0/0 --dport 8080 -j REDIRECT --to-port 3128 #Redirecionando o acesso externo para os terminais da rede interna -- Terminal com VNC iptables -t nat -A PREROUTING -p tcp -m tcp -s 0/0 -d $REDE_EXTERNA --dport 5900 -j DNAT --to 192.168.1.8 iptables -t nat -A PREROUTING -p tcp -m tcp -s 192.168.1.8 --sport 5900 -j DNAT --to $REDE_EXTERNA ################################### ################################### ############## # Fim do Arquivo # ################################### ################################### ############## "iptables_teste" [converted] 131L, 7279C written [root@edgar sysconfig]# ./iptables_teste status [root@edgar sysconfig]# service iptables status O firewall está parado. [root@edgar sysconfig]# iptables testparm Bad argument `testparm' Try `iptables -h' or 'iptables --help' for more information. [root@edgar sysconfig]# iptables --help iptables v1.2.11 iptables -A OUTPUT -m tcp -p tcp -s $REDE_EXTERNA -d 0/0 --dport 80 -j ACCEPT iptables -A OUTPUT -m tcp -p tcp -s $REDE_INTERNA -d 0/0 --dport 80 -j ACCEPT #Liberando a consulta ao servidor DNS - Saida iptables -A OUTPUT -m udp -p udp -d 0/0 --dport 53 -j ACCEPT #Liberando acesso do servidor a um servidor FTP iptables -A OUTPUT -m tcp -p tcp -s $REDE_EXTERNA -d 0/0 --dport 21 -j ACCEPT #Liberando o servidor para acesso ao terminal server 3389 #iptables -A OUTPUT -m tcp -p tcp -s $REDE_EXTERNA -d 0/0 --dport 3389 -j ACCEPT #Liberando conexão ao ssh do servidor iptables -A OUTPUT -m tcp -p tcp -s $REDE_EXTERNA -d 0/0 --sport 22 -j ACCEPT iptables -A OUTPUT -m tcp -p tcp -s $REDE_INTERNA -d 0/0 --sport 22 -j ACCEPT #Liberando a saida do servidor HTTP na porta 8080 iptables -A OUTPUT -m tcp -p tcp -s $REDE_EXTERNA -d 0/0 --sport 8080 -j ACCEPT iptables -A OUTPUT -m tcp -p tcp -s $REDE_INTERNA -d 0/0 --sport 8080 -j ACCEPT #Liberendo acesso para Outlook POP / SMTP iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_EXTERNA --sport 25 -j ACCEPT iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_INTERNA --sport 25 -j ACCEPT iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_EXTERNA --sport 110 -j ACCEPT iptables -A INPUT -m tcp -p tcp -s 0/0 -d $REDE_INTERNA --sport 110 -j ACCEPT #Liberando a saida Porta 3128 SQUID iptables -A OUTPUT -m tcp -p tcp -s $REDE_INTERNA -d 0/0 --sport 3128 -j ACCEPT #Fazendo log de todos os pacotes barrados pela cadeia OUTPUT iptables -A OUTPUT -o eth0 -j LOG --log-level 7 --log-prefix "OUTPUT DROP ETH0: " #Fazendo log de todos os pacotes barrados pela cadeia OUTPUT iptables -A OUTPUT -o eth1 -j LOG --log-level 7 --log-prefix "OUTPUT DROP ETH1: " ################################### ################################### ############## # Inicio da Cadeia Forward # ################################### ################################### ############## #Mascaramento para a Rede Interna iptables -t nat -A POSTROUTING -s 192.168.1.1/24 -d 0/0 -j MASQUERADE #Verifica se tem alguma conexão relacionada e libera as portas iptables -A FORWARD -m tcp -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -m udp -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT #Fazendo log de todos os pacotes barrados pela cadeia FORWARD iptables -A FORWARD -i eth0 -j LOG --log-level 7 --log-prefix "FORWARD DROP ETH0: " #Fazendo log de todos os pacotes barrados pela cadeia FORWARD iptables -A FORWARD -i eth1 -j LOG --log-level 7 --log-prefix "FORWARD DROP ETH1: " ################################### ################################### ############## # Inicio da Cadeia NAT # ################################### ################################### ############## #Proxy Transparente #iptables -t nat -A PREROUTING -p tcp -m tcp -s 192.168.1.1/24 -d 0/0 --dport 80 -j REDIRECT --to-port 3128 #iptables -t nat -A PREROUTING -p tcp -m tcp -s 192.168.1.1/24 -d 0/0 --dport 8080 -j REDIRECT --to-port 3128 #Redirecionando o acesso externo para os terminais da rede interna -- Terminal com VNC iptables -t nat -A PREROUTING -p tcp -m tcp -s 0/0 -d $REDE_EXTERNA --dport 5900 -j DNAT --to 192.168.1.8 iptables -t nat -A PREROUTING -p tcp -m tcp -s 192.168.1.8 --sport 5900 -j DNAT --to $REDE_EXTERNA ################################### ################################### ############## # Fim do Arquivo # ################################### ################################### ############## Vlw galera!!! t+ |
 
Registrado em: May 2005
Mensagens: 3
Agradeceu: 0
Agradecido 0 vez(es) em 0 Posts
Reputação: 0
 |
|
|
28-12-2005, 12:15
|
#2 (permalink) |
|
SCRIPT DO IPTABLES
veja o que esta sendo bloqueado no log!
__________________
Pra programar em shell, é preciso texaco!<br /><br />!!!! =D<br /><br />fabricio_@underlinux.com.br |
Registrado em: Jul 2005
Mensagens: 282
Agradeceu: 0
Agradecido 0 vez(es) em 0 Posts
Reputação: 0
|
|
|
|
| Opções do Tópico | |
|
|
Tópicos Similares
|
||||
| Tópico | Tópico Iniciado Por | Fórum | Respostas | Última Mensagem |
| Script Iptables | Elvis | Adm. em Geral | 1 | 21-05-2008 19:53 |
| Gerador script IPTABLES ?? | H_Franzin | Proxy/NAT/Firewall | 2 | 06-08-2005 2:11 |
| Script nat/iptables | Jupso | Proxy/NAT/Firewall | 4 | 24-10-2003 18:12 |
| script iptables | navarro | Adm. em Geral | 7 | 09-05-2003 10:27 |
| Script Iptables | Elvis | Proxy/NAT/Firewall | 2 | 07-05-2003 11:41 |
Horários baseados na GMT -3. Agora são 18:12.
Powered by vBulletin®
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd
SEO by vBSEO 3.2.0 ©2008, Crawlability, Inc.
