Citação:
# # Limpando Regras
iptables -F
iptables -X
iptables -Z
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F -t nat
iptables -X -t nat
iptables -F -t mangle
iptables -X -t mangle
echo " Limpando Regras ..............................[ OK ]"
# Definindo Politica Padrao
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
echo " Alterando politica padrao.....................[ OK ]"
# Aceita os Pacotes que realmente devem entrar
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Paramentros do Controle de acesso
MACLIST=/etc/macxip
echo " Configuracoes necessarias.....................[ OK ]"
# # Controle de ACESSO # #
# Diretivas do BD IP, MAC e Port
for i in `cat $MACLIST`; do
IPSOURCE=`echo $i | cut -d ';' -f 1`
MACSOURCE=`echo $i | cut -d ';' -f 2`
# Controle de Acesso IPxMAC
iptables -t filter -A FORWARD -d 0/0 -s $IPSOURCE -m mac --mac-source $MACSOURCE -j ACCEPT
iptables -t filter -A INPUT -s $IPSOURCE -d 0/0 -m mac --mac-source $MACSOURCE -j ACCEPT
done
# Redireciona o trafego http(80) para o squid (3128)
iptables -t nat -A PREROUTING -i eth1 -p TCP ! -d 200.201.0.0/16 --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -i eth1 -p UDP ! -d 200.201.0.0/16 --dport 80 -j REDIRECT --to-port 3128
# Compartilha Conexao
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
echo "1" > /proc/sys/net/ipv4/ip_forward
# Aceita todo o trafego vindo do loopback e indo pro loopback
iptables -t filter -A INPUT -i lo -j ACCEPT
# # SSH - mude a porta caso necessario
iptables -A INPUT -p tcp --dport 22 --syn -m state --state NEW -j ACCEPT