regras de iptables alguem tem mais alguma sugestao?
Galera peguei esse exemplo no VOL achei bem completo.. e adicionei umas coisas... Esse FW seria para uma maquina nesses data centers americanos, mas é para hospedar só um site, os servicos ativos serao: Apache c/ (php5), BD (mysql e postgresql), email, ftp, WHM/CPANEL. alguem tem alguma critica ou ideia??!!
:-D
#!/bin/sh
#
# cftk Bring up/down the packet filtering rules
#
# chkconfig: 345 08 92
# description: Bring up/down the packet filtering rules
# description(pt_BR): Bring up/down the packet filtering rules
# probe: true
#
#
# Observações:
#
# O conntrack aplica o conceito de "ESTABLISHED" e "NEW" inclusive
# para conexões UDP e ICMP, além de TCP.
#
#
#
#
##################################################################
# DEFINIÇÃO DE VARIÁVEIS
#################################################################
IPTABLES="/usr/sbin/iptables"
MODPROBE="/sbin/modprobe"
# Alterar os dados abaixo de acordo com a rede do cliente
IF_LOC="lo" # Interface Loopback
IF_EXT="eth0" # Interface da internet (externa)
IF_INT="eth1" # Interface da intranet (interna)
IP_INT="192.168.0.100" # IP da interface IF_INT
IP_EXT="192.168.1.100" # IP da interface IF_EXT (Link)
NET_LOC="127.0.0.0/24" # Rede da interface IF_LOC
NET_INT="192.168.0.0/24" # Rede da interface IF_INT
NET_EXT="192.168.1.0/24" # Rede da interface IF_EXT
BRO_INT="192.168.0.255" # Broadcast da IF_INT
BRO_EXT="192.168.1.255" # Broadcast da IF_EXT
IP_CLIENTESSH="xxx.xxx.xxx.xxx" / Caso vc queira definir somente um ip que tera acesso ao ssh
IP_CLIENTESSH="xxx.xxx.xxx.xxx" / Caso vc queira definir somente um ip que tera acesso ao ssh
IP_CLIENTESSH="xxx.xxx.xxx.xxx" / Caso vc queira definir somente um ip que tera acesso ao ssh
IP_CLIENTESSH="xxx.xxx.xxx.xxx" / Caso vc queira definir somente um ip que tera acesso ao ssh
IP_CLIENTESSH="xxx.xxx.xxx.xxx" / Caso vc queira definir somente um ip que tera acesso ao ssh
#################################################################
# CARGA DE MÓDULOS
#################################################################
carrega_modulos() {
$MODPROBE ip_tables
$MODPROBE iptable_filter
$MODPROBE ip_conntrack
$MODPROBE ip_conntrack_ftp
# $MODPROBE ip_conntrack_irc
$MODPROBE ip_nat_ftp
# $MODPROBE ip_nat_irc
}
#################################################################
# CARGA DE REGRAS
#################################################################
cria_regras() {
cria_regras_auxiliares
cria_regras_PREROUTING
cria_regras_INPUTOUTPUT
cria_regras_INT2EXT
cria_regras_EXT2INT
cria_regras_FORWARD
cria_regras_POSTROUTING
}
#################################################################
# FLUSH E POLÍTICAS DEFAULT
#################################################################
destroi_regras() {
# Define política default para chains defaults
$IPTABLES -P INPUT DROP # política default para filter
$IPTABLES -P FORWARD DROP # política default para filter
$IPTABLES -P OUTPUT DROP # política default para filter
$IPTABLES -F -t filter # flush nas regras de filter
$IPTABLES -F -t nat # flush nas regras de nat
$IPTABLES -F -t mangle # flush nas regras de mangle
$IPTABLES -X -t filter # deleta chains de filter
$IPTABLES -X -t nat # deleta chains de nat
$IPTABLES -X -t mangle # deleta chains de mangle
$IPTABLES -Z -t filter # zera contadores de filter
$IPTABLES -Z -t nat # zera contadores de nat
$IPTABLES -Z -t mangle # zera contadores de mangle
}
abre_regras() {
# Define política default para chains defaults
$IPTABLES -P INPUT ACCEPT # política default para filter
$IPTABLES -P FORWARD ACCEPT # política default para filter
$IPTABLES -P OUTPUT ACCEPT # política default para filter
$IPTABLES -F -t filter # flush nas regras de filter
$IPTABLES -F -t nat # flush nas regras de nat
$IPTABLES -F -t mangle # flush nas regras de mangle
$IPTABLES -X -t filter # deleta chains de filter
$IPTABLES -X -t nat # deleta chains de nat
$IPTABLES -X -t mangle # deleta chains de mangle
$IPTABLES -Z -t filter # zera contadores de filter
$IPTABLES -Z -t nat # zera contadores de nat
$IPTABLES -Z -t mangle # zera contadores de mangle
}
#################################################################
# CHAIN DE PREROUTING
#################################################################
#
cria_regras_PREROUTING() {
#
# Melhora latência de ssh pra fora
$IPTABLES -A PREROUTING -t mangle -p tcp --dport ssh -j TOS --set-tos Minimize-Delay
#
# Aqui vc podera direcionar portas para outras maquinas na rede ou portas para outras portas
#
# $IPTABLES -A PREROUTING -t nat -p tcp -i $IF_EXT --dport 22 -j DNAT --to 192.168.1.100 / Direciona a porta 22 para a maquina 192.168.1.100
# $IPTABLES -A PREROUTING -t nat -p tcp -i $IF_EXT --dport 8080 -j DNAT --to 192.168.1.100:80 / Direcina a porta 8080 para a maquina 192.168.100 na porta 80
# $IPTABLES -A PREROUTING -t nat -p tcp -i $IF_EXT --dport 3306 -j DNAT --to 192.168.1.10 / Direciona a porta 3306 MySQL para a maquina 192.168.1.10
#
#}
#
#################################################################
# CHAIN DE POSTROUTING
#################################################################
cria_regras_POSTROUTING() {
# Faz o mascaramento da rede interna.
$IPTABLES -A POSTROUTING -t nat -o $IF_EXT -j MASQUERADE
}
#################################################################
# CHAINS DE INPUT, OUTPUT
#################################################################
cria_regras_INPUTOUTPUT() {
#Libera tudo ateh a casa arrumar
$IPTABLES -A INPUT -j ACCEPT
$IPTABLES -A OUTPUT -j ACCEPT
#LIbera interface local
$IPTABLES -A INPUT -j ACCEPT -i $IF_LOC
$IPTABLES -A OUTPUT -j ACCEPT -o $IF_LOC
# Recusa pacotes invaálidos em primeiro lugar
$IPTABLES -A INPUT -j END_INVALID -m state --state INVALID
### Serviços que rodam na máquina
# Aceita ssh da maquina definida (manutenção)
$IPTABLES -A INPUT -j ACCEPT -p tcp -s $IP_CLIENTESSH --dport ssh
$IPTABLES -A OUTPUT -j ACCEPT -p tcp -d $IP_CLIENTESSH --sport ssh
#Aceita que o firewall acesse a web
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport 80
$IPTABLES -A OUTPUT -j ACCEPT -p tcp --dport 80
#Aceita squid
$IPTABLES -A INPUT -j ACCEPT -s $NET_INT -p tcp --dport squid
$IPTABLES -A OUTPUT -j ACCEPT -p tcp --sport squid
#Aceita que o firewall faca ssh pra fora
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport ssh
$IPTABLES -A OUTPUT -j ACCEPT -p tcp --dport ssh
#Aceita conexao com o MySQL
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport 3306
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 3306
#Aceita conexao com o Apache
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport 80
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 80
#Aceita conexao com o Proftpd
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport 21
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 21
#Aceita conexao com o ssh
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport 22
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 22
#Aceita conexao com o cPanel/WHM
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport 2083
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 2083
#Aceita conexao com o WHM/cPanel
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport 2086
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 2086
# Testa por broadcasts e descarta (sem logar)
$IPTABLES -A INPUT -j DROP -d $BRO_INT
$IPTABLES -A INPUT -j DROP -d $BRO_EXT
$IPTABLES -A INPUT -j DROP -d 255.255.255.255
$IPTABLES -A OUTPUT -j DROP -d $BRO_INT
$IPTABLES -A OUTPUT -j DROP -d $BRO_EXT
$IPTABLES -A OUTPUT -j DROP -d 255.255.255.255
# Aceita conexoes da rede interna
$IPTABLES -A INPUT -j ACCEPT -s $NET_INT
$IPTABLES -A OUTPUT -j ACCEPT -d $NET_INT
# Aceita consultas a DNSs externos
$IPTABLES -A INPUT -j ACCEPT -p udp --sport domain --dport 1024:
$IPTABLES -A OUTPUT -j ACCEPT -p udp --sport 1024: --dport domain
$IPTABLES -A INPUT -j ACCEPT -p udp --dport domain
$IPTABLES -A OUTPUT -j ACCEPT -p udp --sport domain
# Checa por trojans, para logar diferenciado
$IPTABLES -A INPUT -j TROJAN_CHECK -m state --state NEW
# Recusa e loga todo o resto
$IPTABLES -A INPUT -j END_INPUT
$IPTABLES -A OUTPUT -j END_OUTPUT
}
#################################################################
# CHAINS DE FORWARD
#################################################################
cria_regras_FORWARD() {
# regras de segurança
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
# Se for inválido, jogamos fora
$IPTABLES -A FORWARD -j END_INVALID -m state --state INVALID
# Se já está estabelecida, pode passar
$IPTABLES -A FORWARD -j ACCEPT -m state --state ESTABLISHED
# Se relacionada, pode passar (inclusive ftp & cia caem aqui)
$IPTABLES -A FORWARD -j ACCEPT -m state --state RELATED
## Apenas conexões NEW daqui pra frente
$IPTABLES -A FORWARD -p tcp --dport 1433 -j ACCEPT
# Checa por trojans (para registrar no log se encontrar)
$IPTABLES -A FORWARD -j TROJAN_CHECK
$IPTABLES -A FORWARD -j ACCEPT -s 192.168.0.0/24 -d 192.168.1.0/24
$IPTABLES -A FORWARD -j ACCEPT -s 192.168.1.0/24 -d 192.168.0.0/24
$IPTABLES -A FORWARD -j INT2EXT -s $NET_INT -o $IF_EXT
$IPTABLES -A FORWARD -j EXT2INT -i $IF_EXT -d $NET_INT
# Se sobreviver, dropa e loga
$IPTABLES -A FORWARD -j END_FORWARD
}
#################################################################
# CHAINS DIRECIONAIS
#################################################################
### INT2EXT
cria_regras_INT2EXT() {
$IPTABLES -N INT2EXT
$IPTABLES -A INT2EXT -j ACCEPT
$IPTABLES -A INT2EXT -p tcp --dport 25 -j ACCEPT
$IPTABLES -A INT2EXT -p tcp --dport 110 -j ACCEPT
$IPTABLES -A INT2EXT -p tcp --dport 21 -j ACCEPT
$IPTABLES -A INT2EXT -p tcp --dport 20 -j ACCEPT
$IPTABLES -A INT2EXT -p tcp --dport 1299 -j ACCEPT
$IPTABLES -A INT2EXT -p tcp --dport 1024:5000 -j ACCEPT
# Bloqueia o que sobrou
$IPTABLES -A INT2EXT -j END_INT2EXT
}
### EXT2INT
cria_regras_EXT2INT() {
$IPTABLES -N EXT2INT
$IPTABLES -A EXT2INT -j ACCEPT -d 192.168.1.100
# Nenhum accept, simplesmente nega tudo
$IPTABLES -A EXT2INT -j END_EXT2INT
}
#################################################################
# CHAINS AUXILIARES
#################################################################
cria_regras_auxiliares() {
### END_INPUT
$IPTABLES -N END_INPUT
#$IPTABLES -A END_INPUT -j LOG --log-prefix "FIREWALL: End_Input! "
$IPTABLES -A END_INPUT -j DROP
### END_OUTPUT
$IPTABLES -N END_OUTPUT
$IPTABLES -A END_OUTPUT -j LOG --log-prefix "FIREWALL: End_Output! "
$IPTABLES -A END_OUTPUT -j DROP
### END_FORWARD
$IPTABLES -N END_FORWARD
$IPTABLES -A END_FORWARD -j LOG --log-prefix "FIREWALL: End_Forward! "
$IPTABLES -A END_FORWARD -j DROP
### END_INVALID
$IPTABLES -N END_INVALID
$IPTABLES -A END_INVALID -j LOG --log-prefix "FIREWALL: Invalid! "
$IPTABLES -A END_INVALID -j DROP
### END_TROJAN
$IPTABLES -N END_TROJAN
$IPTABLES -A END_TROJAN -j LOG --log-prefix "FIREWALL: Trojan! "
$IPTABLES -A END_TROJAN -j DROP
### END_INT2EXT
$IPTABLES -N END_INT2EXT
$IPTABLES -A END_INT2EXT -j LOG --log-prefix "FIREWALL: End_Int2Ext! "
$IPTABLES -A END_INT2EXT -j DROP
### END_EXT2INT
$IPTABLES -N END_EXT2INT
$IPTABLES -A END_EXT2INT -j LOG --log-prefix "FIREWALL: End_Ext2Int! "
$IPTABLES -A END_EXT2INT -j DROP
### TROJANS
# Alguns trojans, os mais comuns
# Nào é necessário checar por trojans se você adota a política de
# tudo fechado, abrem-se as excessões. Mas, você pode querer verificar
# mesmo assim, para poder registrar um log mais específico (nosso caso).
$IPTABLES -N TROJAN_CHECK
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 555 # phAse zero
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 555 # phAse zero
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 1243 # Sub-7, SubSeven
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 1243 # Sub-7, SubSeven
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 3129 # Masters Paradise
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 3129 # Masters Paradise
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 6670 # DeepThroat
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 6670 # DeepThroat
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 6711 # Sub-7, SubSeven
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 6711 # Sub-7, SubSeven
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 6969 # GateCrasher
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 6969 # GateCrasher
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 12345 # NetBus
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 12345 # NetBus
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 21544 # GirlFriend
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 21544 # GirlFriend
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 23456 # EvilFtp
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 23456 # EvilFtp
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 27374 # Sub-7, SubSeven
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 27374 # Sub-7, SubSeven
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 30100 # NetSphere
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 30100 # NetSphere
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 31789 # Hack'a'Tack
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 31789 # Hack'a'Tack
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 31337 # BackOrifice, and many others
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 31337 # BackOrifice, and many others
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 50505 # Sockets de Troie
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 50505 # Sockets de Troie
}
Re: regras de iptables alguem tem mais alguma sugestao?
Muita coisa desnecessaria !!!
