Meu firewall me bloqueou.. não faço mais nada

Abaixo estão as configurações de meu firewall e quando ponho essas regras pra rodarem, não consigo ter acesso a internet nem pelo servidor. Me ajudem.

#Start Serv
#Escript de Firewall e Roteamento de portas
#
#Apaga Regras pre Definidas
iptables -F
iptables -t nat -F
#
#APAGANDO REGRAS
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -X
iptables -A INPUT -i lo -j ACCEPT
iptables -A FORWARD -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
#
#adicionando modulos
modprobe ip_conntrack
modprobe ipt_MASQUERADE
modprobe ipt_LOG
modprobe iptable_nat
modprobe ip_nat_ftp
modprobe iptable_filter
#
#Habilita o Roteamento de Kernel
echo 1 > /proc/sys/net/ipv4/ip_forward
#
#Protecao contra IP spoofing
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
#
#Habilita (NAT)
iptables -t nat -A POSTROUTING -s 192.168.172.0/24 -o eth0 -j MASQUERADE
#
#Redireciona Todas as portas para a 8080 (http) (Squid)
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to 8080
#
# Dropa pacotes TCP indesejaveis
# -------------------------------------------------------
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j LOG --log-level 6 --log-prefix "FIREWALL: NEW sem syn: "
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
#
# Protecao contra syn-flood
# -------------------------------------------------------
iptables -A FORWARD -p tcp --syn -m limit --limit 2/s -j ACCEPT
#
#Protecao contra ping da morte
# -------------------------------------------------------
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
#
#-------------------- CONTROLA TODAS AS INPUT NO SERVIDOR ---------------------
#
#Libera as portas para entrada no servidor
#
iptables -A INPUT -p tcp -s 192.168.172.0/24 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -s 192.168.172.0/24 --dport 53 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.172.0/24 --dport 8080 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.172.0/24 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.172.0/24 --dport 25 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.172.0/24 --dport 110 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.172.0/24 --dport 137:139 -j ACCEPT
iptables -A INPUT -p udp -s 192.168.172.0/24 --dport 137:139 -j ACCEPT
#Mantem a conexao das portas liberada acima
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#--------------------- CONTROLA TODOS OS FORWARD NO SERVIDOR ------------------
#
#libera as portas para passar pelo servidor e ter acesso externo
iptables -A FORWARD -s 192.168.172.0/24 -i eth1 -j ACCEPT
iptables -A FORWARD -p tcp -s 192.168.172.0/24 --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp -s 192.168.172.0/24 --dport 110 -j ACCEPT
iptables -A FORWARD -p tcp -s 192.168.172.0/24 --dport 80 -j ACCEPT
#Mantem a conexao das portas acima liberada
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

#Portas Bloqueadas (MSN)
iptables -A FORWARD -p TCP --dport 1863 -j DROP
iptables -A FORWARD -d 64.4.13.0/24 -j REJECT

Amigo,
tente escrever está linha de outra forma:
#Habilita (NAT)
iptables -t nat -A POSTROUTING -s 192.168.172.0/24 -o eth0 -j MASQUERADE
para :
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE... se essa interface for a da internete....
outra coisa carregue os nódulos primeiro e depois implemente as politicas..
Um Abraço
Paulo Fernando Lamellas

Amigo,
Outra coisa... a porta padrão do squid é 3128...caso vc queira que ele funcione na 8080 vc vai ter que editar o squid.conf....com esta regra vc direciona todos os pacotes da porta 80 para a 8080

Meu squid esta na 8080. Sem as regras abaixo ele funciona perfeito mas com elas ele trava tudo e não funciona nada.

********************************
#Protecao contra IP spoofing
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
*
*
*
*
# Dropa pacotes TCP indesejaveis
# -------------------------------------------------------
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j LOG --log-level 6 --log-prefix "FIREWALL: NEW sem syn: "
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
#
# Protecao contra syn-flood
# -------------------------------------------------------
iptables -A FORWARD -p tcp --syn -m limit --limit 2/s -j ACCEPT
#
#Protecao contra ping da morte
# -------------------------------------------------------
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
*********************************************

Adicionei a linha que o pflamellas disse e olhem o erro agora:

[root@lasertools-serv etc]# service iptables start
[root@lasertools-serv etc]# ./firewall
: No such file or directorysys/net/ipv4/conf/all/rp_filter
'ptables v1.2.7a: Invalid target name `ACCEPT
Try `iptables -h' or 'iptables --help' for more information.
'ptables v1.2.7a: Invalid target name `ACCEPT
Try `iptables -h' or 'iptables --help' for more information.

Ontem a noite esses paus não davam. O que será que foi agora?

Citação:

---

iptables -A INPUT -p tcp -s 192.168.172.0/24 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -s 192.168.172.0/24 --dport 53 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.172.0/24 --dport 8080 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.172.0/24 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.172.0/24 --dport 25 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.172.0/24 --dport 110 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.172.0/24 --dport 137:139 -j ACCEPT
iptables -A INPUT -p udp -s 192.168.172.0/24 --dport 137:139 -j ACCEPT

---

Cara, acho que você nem precisa disso, já que você não definiu política alguma. O firewall já está liberando essas portas...

Abraços!

Mudei minhas regras e elas estão assim:

# Variaveis
# -------------------------------------------------------

# Ativa modulos
# -------------------------------------------------------
iptable_nat
ip_conntrack
ip_conntrack_ftp
ip_nat_ftp
ipt_LOG
ipt_REJECT
ipt_MASQUERADE


# Ativa roteamento no kernel
# -------------------------------------------------------
echo "1" > /proc/sys/net/ipv4/ip_forward


# Protecao contra IP spoofing
# -------------------------------------------------------
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter


# Zera regras
# -------------------------------------------------------
iptables -F
iptables -X
iptables -F -t nat
iptables -X -t nat
iptables -F -t mangle
iptables -X -t mangle


# Determina a politica padrao
# -------------------------------------------------------
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP


#########################################################
# Tabela FILTER
#########################################################


# Aceita os pacotes que realmente devem entrar
# -------------------------------------------------------
iptables -A INPUT -i ! eth0 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT


# Protecao contra worms
# -------------------------------------------------------
iptables -A FORWARD -p tcp --dport 135 -i eth1 -j REJECT


# Protecao contra syn-flood
# -------------------------------------------------------
iptables -A FORWARD -p tcp --syn -m limit --limit 2/s -j ACCEPT


# Protecao contra ping da morte
# -------------------------------------------------------
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT



# Loga tentativa de acesso a determinadas portas
# -------------------------------------------------------
iptables -A INPUT -p tcp --dport 21 -i eth0 -j LOG --log-level 6 --log-prefix "FIREWALL: ftp: "
iptables -A INPUT -p tcp --dport 23 -i eth0 -j LOG --log-level 6 --log-prefix "FIREWALL: telnet: "
iptables -A INPUT -p tcp --dport 25 -i eth0 -j LOG --log-level 6 --log-prefix "FIREWALL: smtp: "
iptables -A INPUT -p tcp --dport 80 -i eth0 -j LOG --log-level 6 --log-prefix "FIREWALL: http: "
iptables -A INPUT -p tcp --dport 110 -i eth0 -j LOG --log-level 6 --log-prefix "FIREWALL: pop3: "
iptables -A INPUT -p udp --dport 111 -i eth0 -j LOG --log-level 6 --log-prefix "FIREWALL: rpc: "
iptables -A INPUT -p tcp --dport 113 -i eth0 -j LOG --log-level 6 --log-prefix "FIREWALL: identd: "
iptables -A INPUT -p tcp --dport 137:139 -i eth0 -j LOG --log-level 6 --log-prefix "FIREWALL: samba: "
iptables -A INPUT -p udp --dport 137:139 -i eth0 -j LOG --log-level 6 --log-prefix "FIREWALL: samba: "
iptables -A INPUT -p tcp --dport 161:162 -i eth0 -j LOG --log-level 6 --log-prefix "FIREWALL: snmp: "
iptables -A INPUT -p tcp --dport 6667:6668 -i eth0 -j LOG --log-level 6 --log-prefix "FIREWALL: irc: "
iptables -A INPUT -p tcp --dport 3128 -i eth0 -j LOG --log-level 6 --log-prefix "FIREWALL: squid: "


# Libera acesso externo a determinadas portas
# -------------------------------------------------------
iptables -A INPUT -p tcp --dport 22 -i eth0 -j ACCEPT



#########################################################
# Tabela NAT
#########################################################


# Ativa mascaramento de saida
# -------------------------------------------------------
iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE


# Proxy transparente
# -------------------------------------------------------
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 8080
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 8080 -j REDIRECT --to-port 8080

E esses foram erros:

[root@lasertools-serv etc]# service iptables start
[root@lasertools-serv etc]# ./firewallnew
: command not found 3:
: command not found 6: iptable_nat
: command not found 7: ip_conntrack
: command not found 8: ip_conntrack_ftp
: command not found 9: ip_nat_ftp
: command not found 10: ipt_LOG
: command not found 11: ipt_REJECT
: command not found 12: ipt_MASQUERADE
: command not found 13:
: command not found 14:
: No such file or directoryoc/sys/net/ipv4/ip_forward
: command not found 18:
: command not found 19:
: No such file or directoryoc/sys/net/ipv4/conf/all/rp_filter
: command not found 23:
: command not found 24:
iptables: No chain/target/match by that name
iptables: Table does not exist (do you need to insmod?)
': Table does not exist (do you need to insmod?)e `nat
Perhaps iptables or your kernel needs to be upgraded.
': Table does not exist (do you need to insmod?)e `nat
Perhaps iptables or your kernel needs to be upgraded.
': Table does not exist (do you need to insmod?)e `mangle
Perhaps iptables or your kernel needs to be upgraded.
': Table does not exist (do you need to insmod?)e `mangle
Perhaps iptables or your kernel needs to be upgraded.
: command not found 33:
: command not found 34:
iptables: Bad policy name
iptables: Bad policy name
iptables: Bad policy name
: command not found 40:
: command not found 41:
: command not found 45:
: command not found 46:
'ptables v1.2.7a: Invalid target name `ACCEPT
Try `iptables -h' or 'iptables --help' for more information.
'ptables v1.2.7a: Invalid target name `ACCEPT
Try `iptables -h' or 'iptables --help' for more information.
'ptables v1.2.7a: Invalid target name `ACCEPT
Try `iptables -h' or 'iptables --help' for more information.
'ptables v1.2.7a: Invalid target name `ACCEPT
Try `iptables -h' or 'iptables --help' for more information.
: command not found 53:
: command not found 54:
: command not found 65:
: command not found 66:
: command not found 78:
: command not found 79:
'ptables v1.2.7a: Invalid target name `REJECT
Try `iptables -h' or 'iptables --help' for more information.
: command not found 83:
: command not found 84:
'ptables v1.2.7a: Invalid target name `ACCEPT
Try `iptables -h' or 'iptables --help' for more information.
: command not found 88:
: command not found 89:
'ptables v1.2.7a: Invalid target name `ACCEPT
Try `iptables -h' or 'iptables --help' for more information.
: command not found 93:
: command not found 94:
: command not found 107:
: command not found 108:
: command not found 123:
: command not found 124:
'ptables v1.2.7a: Invalid target name `ACCEPT
Try `iptables -h' or 'iptables --help' for more information.
: command not found 128:
: command not found 129:
: command not found 134:
: command not found 135:
: command not found 139:
: command not found 140:
'ptables v1.2.7a: Invalid target name `MASQUERADE
Try `iptables -h' or 'iptables --help' for more information.
: command not found 144:
: command not found 145:
: command not found 150:
: command not found 151:
: command not found 155:
: command not found 156:

cara vc ta baixando estes scripts da net né ??? verifique a sintaxe deles então ta faltado um monte de comando ou melhor leia uma documentação e faça um script vc mesmo .. aprenda .... veja no google o guia Focalinux la tem uma boa documentação sobre o Firewall ou iptables/netfilter ..


te+

O primeiro que usei foi o usuário amarcio que me ajudou. Este que estou com problemas foi um usuário daqui (não lembro o nome) que postou em um dos fóruns. Peguei e mudei de acordo com minhas necessidades. Ontem ele funcionou mas travou toda a net e hoje tentei rodar e dá esses erros que coloquei.

O primeiro que usei foi o usuário amarcio que me ajudou. Este que estou com problemas foi um usuário daqui (não lembro o nome) que postou em um dos fóruns. Peguei e mudei de acordo com minhas necessidades. Ontem ele funcionou mas travou toda a net e hoje tentei rodar e dá esses erros que coloquei.

Amigo,
eu uso o RH9 ... e meu script de firewall tah assim:
#######################
#!/bin/bash
# /etc/init.d/firewall
# chkconfig: 2345 100 20
# description: Inicializacao do iptables
# processname: iptables
# pidfile : /var/run/iptabless.pid
. /etc/rc.d/init.d/functions
. /etc/sysconfig/network
if [ ${NETWORKING} = "no" ]
then
exit 0
fi
iptables=/sbin/iptables
modprobe=/sbin/modprobe
prog=firewall
LOG="iplog -i eth1 -w -d -l /var/log/iplogs"
case "$1" in
start)
echo -n $"Iniciando o serviço de $prog"
#gprintf "Iniciando o serviço de %s: " "IPtables"
$modprobe ip_tables
$modprobe iptable_filter
$modprobe iptable_nat
$modprobe ip_conntrack
$modprobe ip_conntrack_ftp
$modprobe ip_nat_ftp
$modprobe ipt_LOG
$modprobe ipt_state
$modprobe ipt_MASQUERADE
$iptables -F
$iptables -Z
$iptables -X
$iptables -t nat -F
$iptables -t nat -X
$iptables -t mangle -F
$iptables -t mangle -X
$iptables -P INPUT DROP
$iptables -P FORWARD DROP
$iptables -P OUTPUT ACCEPT
#echo "Ativando protecao de Entrada(Kernel)"
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
for i in /proc/sys/net/ipv4/conf/*; do
echo 0 > $i/accept_redirects
echo 0 > $i/accept_source_route
echo 1 > $i/log_martians
echo 0 > $i/rp_filter
done
#echo "Ativando protecao de Entrada(INPUT)"
$iptables -I INPUT -i lo -j ACCEPT
$iptables -I OUTPUT -o lo -j ACCEPT
$iptables -I INPUT -i ! lo -s 127.0.0.0/255.0.0.0 -j DROP
$iptables -A INPUT -p tcp ! --syn -i eth1 -j ACCEPT
#printf "."
$iptables -A INPUT -s 10.0.0.0/8 -i eth1 -j DROP
$iptables -A INPUT -s 172.16.0.0/12 -i eth1 -j DROP
#$iptables -A INPUT -s 192.168.0.0/16 -i eth1 -j DROP
$iptables -A INPUT -s 224.0.0.0/4 -i eth1 -j DROP
$iptables -A INPUT -s 240.0.0.0/5 -i eth1 -j DROP
$iptables -A INPUT -p ALL -s 127.0.0.1 -i lo -j ACCEPT
$iptables -A INPUT -p ALL -s 192.168.1.5 -i lo -j ACCEPT
$iptables -A INPUT -p ALL -s 192.168.0.1 -i lo -j ACCEPT
$iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#echo "Liberando o acesso ao squid e outras portas"
$iptables -A INPUT -p tcp -i eth0 -s 192.168.0.0/24 -j ACCEPT
$iptables -A INPUT -p tcp -i eth0 -s 192.168.0.0/24 --dport 3128 -j ACCEPT
$iptables -A INPUT -p udp -i eth0 -s 192.168.0.0/24 --dport 20000:30000 -j ACCEPT
$iptables -A INPUT -p tcp -i eth0 -s 192.168.0.0/24 --dport 7002 -j ACCEPT
$iptables -A INPUT -p tcp -i eth0 -s 192.168.0.0/24 --dport 23000 -j ACCEPT
$iptables -A INPUT -p udp -i eth0 -s 192.168.0.0/24 --dport 5273 -j ACCEPT
$iptables -A INPUT -p tcp -i eth0 -s 192.168.0.0/24 --dport 631 -j ACCEPT
$iptables -A INPUT -p tcp -i eth0 -s 192.168.0.0/24 --dport 8080 -j ACCEPT
$iptables -A INPUT -p tcp -i eth0 -s 192.168.0.0/24 --dport 8999 -j ACCEPT
$iptables -A INPUT -p tcp -i eth0 -s 192.168.0.0/24 --dport 23000 -j ACCEPT
$iptables -A INPUT -p tcp -i eth0 -s 192.168.0.0/24 --dport 137:139 -j ACCEPT
$iptables -A INPUT -p udp --dport 53 -j ACCEPT
$iptables -A INPUT -p tcp --dport 53 -j ACCEPT
$iptables -A INPUT -p tcp --dport 80 -j ACCEPT
$iptables -A INPUT -p tcp --dport 110 -j ACCEPT
$iptables -A INPUT -p tcp --dport 443 -j ACCEPT
$iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
#liberando respostas
$iptables -A INPUT -p tcp -i eth1 --dport 20 --syn -j ACCEPT
$iptables -A INPUT -p tcp -i eth1 --dport 21 --syn -j ACCEPT
$iptables -A INPUT -p tcp -i eth1 --dport 22 --syn -j ACCEPT
$iptables -A INPUT -p tcp -i eth1 --dport 23 --syn -j ACCEPT
$iptables -A INPUT -p tcp -i eth1 --dport 25 --syn -j ACCEPT
$iptables -A INPUT -p tcp -i eth1 --dport 80 --syn -j ACCEPT
$iptables -A INPUT -p tcp -i eth1 --dport 110 --syn -j ACCEPT
$iptables -A INPUT -p tcp -i eth1 --dport 443 --syn -j ACCEPT
$iptables -A INPUT -p icmp --icmp-type 8 -i eth0 -j ACCEPT
$iptables -A INPUT -p icmp --icmp-type 0 -j ACCEPT
$iptables -A INPUT -j LOG --log-prefix "Pacote input descartado:" --log-level 6
$iptables -A INPUT -j DROP
#echo "Liberando resposta DNS"
$iptables -A INPUT -p udp -s 200.196.99.2 --sport 53 -d 192.168.1.5 -j ACCEPT
$iptables -A INPUT -p udp -s 200.196.99.3 --sport 53 -d 192.168.1.5 -j ACCEPT
$iptables -A INPUT -i eth1 -f -j LOG --log-prefix "Pacote input fragmentado:" --log-level 6
$iptables -A INPUT -i eth1 -f -j DROP
#echo "Monitorando portas proibidas"
$iptables -A INPUT -p tcp -i eth1 --dport 31337 -j DROP
$iptables -A INPUT -p udp -i eth1 --dport 31337 -j DROP
$iptables -A INPUT -p tcp -i eth1 --dport 12345:12346 -j DROP
$iptables -A INPUT -p udp -i eth1 --dport 12345:12346 -j DROP
$iptables -A INPUT -p tcp -i eth1 --dport 1524 -j DROP
$iptables -A INPUT -p tcp -i eth1 --dport 27665 -j DROP
$iptables -A INPUT -p udp -i eth1 --dport 27444 -j DROP
$iptables -A INPUT -p udp -i eth1 --dport 31335 -j DROP
$iptables -A INPUT -p tcp -i eth1 --dport 113 -j REJECT
$iptables -A INPUT -p udp -i eth1 --dport 113 -j REJECT
$iptables -A INPUT -p tcp -i eth1 --dport 5999:6003 -j DROP
$iptables -A INPUT -p udp -i eth1 --dport 5999:6003 -j DROP
$iptables -A INPUT -p tcp -i eth1 --dport 7100 -j DROP
$iptables -A INPUT -p udp -s 0/0 -i eth1 --dport 33435:33525 -j DROP
#printf "."
#$LOG
#printf ".n"
#prontf "Your internet connection is up and running. IP logs can be #found in /va/log/iplogs.n"
$iptables -A INPUT -p tcp --dport 21 -j LOG --log-prefix "Porta FTP:" --log-level 6
$iptables -A INPUT -p tcp --dport 22 -j LOG --log-prefix "Porta SSH:" --log-level 6
$iptables -A INPUT -p tcp --dport 23 -j LOG --log-prefix "Porta TELNET:" --log-level 6
$iptables -A INPUT -p tcp --dport 137:139 -j LOG --log-prefix "Porta NETBUI:" --log-level 6
#echo "Monitorando BackDoors..."
$iptables -A INPUT -p tcp --dport 5042 -j LOG --log-prefix "Porta Wincrash:" --log-level 6
$iptables -A INPUT -p tcp --dport 12345 -j LOG --log-prefix "Porta BackOrifice:" --log-level 6
#Bloqueio a IP spoofing
$iptables -N syn-flood
$iptables -A INPUT -i eth1 -p tcp --syn -j syn-flood
$iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
$iptables -A syn-flood -j DROP
#echo "Configurando navegação..Repasse(FORWARD)"
$iptables -A FORWARD -m unclean -j DROP
$iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
$iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
$iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
$iptables -A FORWARD -m state --state INVALID -j DROP
$iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
$iptables -A FORWARD -p udp -s 192.168.0.0/24 -d 200.196.99.2 --dport 53 -j ACCEPT
$iptables -A FORWARD -p udp -s 192.168.0.0/24 -d 200.196.99.3 --dport 53 -j ACCEPT
$iptables -A FORWARD -p udp -s 200.196.99.2 --sport 53 -d 192.168.0.0/24 -j ACCEPT
$iptables -A FORWARD -p udp -s 200.196.99.3 --sport 53 -d 192.168.0.0/24 -j ACCEPT
$iptables -A FORWARD -p tcp --sport 53 -j ACCEPT
$iptables -A FORWARD -p udp --sport 53 -j ACCEPT
$iptables -A FORWARD -p tcp -s 192.168.0.0/24 --dport 20 -j ACCEPT
$iptables -A FORWARD -p tcp --sport 20 -j ACCEPT
$iptables -A FORWARD -p tcp -s 192.168.0.0/24 --dport 21 -j ACCEPT
$iptables -A FORWARD -p tcp --sport 21 -j ACCEPT
$iptables -A FORWARD -p tcp -s 192.168.0.0/24 --dport 22 -j ACCEPT
$iptables -A FORWARD -p tcp --sport 22 -j ACCEPT
$iptables -A FORWARD -j LOG --log-prefix "Pacote forward descartado:" --log-level 6
$iptables -A FORWARD -j DROP
$iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
#Diminuindo delay da rede para serviços essenciais
$iptables -t mangle -A INPUT -p tcp --dport 22 -j TOS --set-to Minimize-Delay
$iptables -t mangle -A INPUT -p tcp --dport 25 -j TOS --set-to Minimize-Delay
$iptables -t mangle -A INPUT -p tcp --dport 80 -j TOS --set-to Minimize-Delay
$iptables -t mangle -A INPUT -p tcp --dport 110 -j TOS --set-to Minimize-Delay
$iptables -t mangle -A INPUT -p tcp --dport 443 -j TOS --set-to Minimize-Delay
$iptables -t mangle -A INPUT -p tcp --dport 3128 -j TOS --set-to Minimize-Delay
$iptables -t mangle -A FORWARD -p udp --sport 8999 -j TOS --set-to Minimize-Delay
$iptables -t mangle -A FORWARD -p udp --sport 23000 -j TOS --set-to Minimize-Delay
$iptables -t mangle -A FORWARD -p tcp -s 192.168.0.0/24 --dport 25 -j TOS --set-to Minimize-Delay
$iptables -t mangle -A FORWARD -p tcp -s 192.168.0.0/24 --dport 110 -j TOS --set-to Minimize-Delay
$iptables -t mangle -A FORWARD -p tcp --sport 25 -j TOS --set-to Minimize-Delay
$iptables -t mangle -A FORWARD -p tcp --sport 110 -j TOS --set-to Minimize-Delay
;;
stop)
echo -n $"Parando o serviço de $prog:"
#gprintf "Parando o serviço de %s: " "IPtables"
$iptables -F
$iptables -X
$iptables -F -t nat
$iptables -F -t mangle
echo
;;
restart)
echo -n $"Reiniciando o serviço de $prog:"
#gprintf "Reiniciando o serviço de %s: " "IPtables"
$0 stop
$0 start
echo
;;
status)
echo -n $"Status do serviço de $prog:"
#gprintf "Status do serviço de $prog"
$iptables -L
$iptables -L -t nat
$iptables -L -t mangle
echo
;;
*)
echo -n $"Uso: iptables (start|stop|restart|status)"
#gprintf "Uso: iptables {start|stop|restart|status}"
echo
;;
esac
exit 0
#############3
antes de copiar de uma olhada onde estão os seus módulos!!!!
tipo:
iptables=/sbin/iptables
modprobe=/sbin/modprobe
caso não saiba de o comando which iptables ou which modprobe
o meu iptables também é 1.2.7
um Abraço
Paulo Fernando Lamellas

Valeu, vou dar uma testada e ver se funciona.

Kra,
qual é sua distro???

me diz uma coisa porque vc nao bloquei as portas de backoriffice e wincrash em vem de so fazer logs?

[] dotta

Amigo,
pq eu preciso saber quais máquinas que são colocadas na rede e foram atacadas ou já possuiam as pragas

mas se vc deixar abertas as chance de invasao nao sao maiores?

[] dotta