+ Responder ao Tópico



  1. #1
    Visitante

    Padrão Squid - IpTables

    #************** LIMPA E ZERA AS REGRAS **********
    /usr/sbin/iptables -F
    /usr/sbin/iptables -Z
    /usr/sbin/iptables -t nat -F

    #***** NEGA TODA ENTRADA E A PASSAGEM DE PACOTES ****
    /usr/sbin/iptables -t filter -P INPUT DROP
    /usr/sbin/iptables -t filter -P FORWARD DROP

    #***** ACEITA TODA A ENTRADA E SAIDA DE PACOTES PARA O LOOPBACK ******
    /usr/sbin/iptables -t filter -A INPUT -i lo -j ACCEPT
    /usr/sbin/iptables -t filter -A OUTPUT -o lo -j ACCEPT

    #***** PING OF DEATH*******************************************************************
    /usr/sbin/iptables -t filter -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
    /usr/sbin/iptables -t filter -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

    #***** SYN-FLOAD ***********************************************************************
    /usr/sbin/iptables -t filter -A INPUT -p tcp -m limit --limit 1/s -j ACCEPT
    /usr/sbin/iptables -t filter -A FORWARD -p tcp -m limit --limit 1/s -j ACCEPT

    #***** NMAP *******************************************************************************
    /usr/sbin/iptables -t filter -A INPUT -p tcp --tcp-flags ALL SYN,ACK,FIN,RST -m limit --limit 1/s -j ACCEPT
    /usr/sbin/iptables -t filter -A FORWARD -p tcp --tcp-flags ALL SYN,ACK,FIN,RST -m limit --limit 1/s -j ACCEPT

    #***** CONEXOES JA ESTABELECIDAS *******************************
    /usr/sbin/iptables -t filter -A INPUT -m state --state NEW -j ACCEPT
    /usr/sbin/iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

    /usr/sbin/iptables -t filter -A FORWARD -m state --state NEW -j ACCEPT
    /usr/sbin/iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

    #***** ACEITA A PASSAGEM ****************************************
    /usr/sbin/iptables -t filter -A FORWARD -d 0/0 -s 192.168.1.0/24 -o eth0 -j ACCEPT
    /usr/sbin/iptables -t filter -A FORWARD -d 192.168.1.0/24 -s 0/0 -i eth0 -j ACCEPT

    #***** TODA SAIDA SERA MASCARADA ********************************************
    /usr/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
    /usr/sbin/iptables -t filter -A INPUT -s 192.168.1.0/24 -d 0/0 -j ACCEPT
    /usr/sbin/iptables -t filter -A OUTPUT -s 192.168.1.0/24 -d 0/0 -j ACCEPT

    #***** PING DA MAKINA FIREWALL PARA QUALQUER LUGAR SERA ACEITA ****
    /usr/sbin/iptables -t filter -A OUTPUT -p icmp -s 192.168.1.0/24 -d 0/0 -j ACCEPT

    #* TODA ENTRADA PORTA 80 SERA DIRECIONADA PARA A PORTA DO SQUID (312
    /usr/sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

    #***** REGRAS DO ICQ *******************************************************************************
    #/usr/sbin/iptables -t filter -A INPUT -p udp --source-port 4000 -d 192.168.1.0/24 -i ppp0 -j ACCEPT
    #/usr/sbin/iptables -t filter -A INPUT -p udp -s 192.168.1.0/24 --dport 4000 -j ACCEPT
    #/usr/sbin/iptables -t filter -A INPUT -p udp --source-port 5190 -d 192.168.1.0/24 -i ppp0 -j ACCEPT
    #/usr/sbin/iptables -t filter -A INPUT -p udp -s 192.168.1.0/24 --dport 5190 -j ACCEPT
    ;;

    stop)
    gprintf "Parando o serviço %s: " "IPtables"
    echo
    echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
    echo 0 > /proc/sys/net/ipv4/ip_forward

    /usr/sbin/iptables -t nat -F
    /usr/sbin/iptables -Z
    /usr/sbin/iptables -F
    ;;
    *)
    gprintf "Uso: iptables (start|stop)"
    echo

    ;;

    esac

    exit 0

    Galera estou com esse script de firewall, mas nao consigo mandar nem receber email, nem no server nem nas estacoes


    Valeu...... Aguardo Respostas Pessoal

  2. #2
    Visitante

    Padrão Squid - IpTables

    kra só faltou uma coisinha no seu script, vc adicionar esse dois comandinhos aqui:

    #iptables -A FORWARD -p tcp --dport 110 -j ACCEPT
    #iptables -A FORWARD -p tcp --dport 25 -j ACCEPT






  3. #3
    Visitante

    Padrão Squid - IpTables

    Blz manu

    Ja adicionel essas regras q vc me passou mas mesmo assim nao funcionou.

    reiniciei o iptables e squid e nem funcionou

    Que devo fazer . . . .

    Ajudem - me please

  4. #4
    AndrewAmorimdaSilva
    Visitante

    Padrão Squid - IpTables

    Faz um teste....

    ipatbles -P FORWARD ACCEPT



  5. #5
    Visitante

    Padrão Squid - IpTables

    Falai Andrew nem funcionou kara . . .

    e diz akelas regras q se me passou no outro topico sobre o ReceitaNet

    o mais alguma sugestao nesse caso do email, num sei pq nao esta funcionado . . .

    Agurado respostas

    valeu

  6. #6
    Webtech
    Visitante

    Padrão Squid - IpTables

    iptables -t nat -A PREROUTING -s (sua rede) -p tcp --dport 110 -j ACCEPT
    iptables -t nat -A PREROUTING -s (sua rede) -p tcp --dport 25 -j ACCEPT



  7. #7
    Visitante

    Padrão Squid - IpTables

    Nem funcionou desse jeito tbm

    O Andrew manda akela regra la pra q vc mandou no outro topico pra mim do Receita Net

    Valew <IMG SRC="images/forum/icons/icon_biggrin.gif">

  8. #8
    AndrewAmorimdaSilva
    Visitante

    Padrão Squid - IpTables

    Fala blz??

    Para e-mail.

    # iptables - A FORWARD -i eth0 -p tcp --dport 25 -j ACCEPT
    # iptables - A FORWARD -i eth0 -p tcp --dport 110 -j ACCEPT


    Para o receita net:

    -Verifique a porta que o programa usa, ligue para o suporte e pergunte qual a porta ele usa, depois...

    # iptables -A FORWARD -p tcp --dport 0000 -j ACCEPT
    # iptables -A FORWARD -p udp --dport 0000 -j ACCEPT
    # iptables -A FORWARD -p sport --dport 0000 -j ACCEPT
    # iptables -A FORWARD -p sport --dport 0000 -j ACCEPT

    Onde 0000 é o nº da porta que vc obteve.


    Um abraço!!! <IMG SRC="images/forum/icons/icon_wink.gif"> <IMG SRC="images/forum/icons/icon_wink.gif"> <IMG SRC="images/forum/icons/icon_wink.gif">