+ Responder ao Tópico



  1. #1
    Oi galera,
    Tenho um conectiva 8 como servidor de internet. Uso o Squid como proxy e o Iptables como filtro de pacotes.

    A Caixa Econimica Federal instalou um programa de cobranca que precisa pingar os seguintes enderecos e portas:

    200.244.109.67:2007
    200.244.109.94:2008
    200.231.155.65:3006

    Preciso liberar estes enderecos para ping e tambem para o telnet.

    Segue abaixo meus arquivos Squid.conf e iptables.txt

    #Recommended minimum configuration:
    acl all src 0.0.0.0/0.0.0.0
    acl manager proto cache_object
    acl localhost src 127.0.0.1/255.255.255.255
    acl SSL_ports port 443 563
    acl Safe_ports port 80 # http
    acl Safe_ports port 21 # ftp
    acl Safe_ports port 443 563 # https, snews
    acl Safe_ports port 70 # gopher
    acl Safe_ports port 210 # wais
    acl Safe_ports port 1025-65535 # unregistered ports
    acl Safe_ports port 280 # http-mgmt
    acl Safe_ports port 488 # gss-http
    acl Safe_ports port 591 # filemaker
    acl Safe_ports port 777 # multiling http
    acl Safe_ports port 25 110 # POP3 SMTP
    acl Safe_ports port 2007 2008 3006
    acl CONNECT method CONNECT
    acl rede_interna src 192.168.2.0/24
    acl noblock_ports port 25 110
    acl noblock_ports port 2007 2008 3006 # Portas para conexao CEF
    #INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS
    #
    # And finally deny all other access to this proxy
    #http_access deny all

    http_access allow rede_interna
    # http_port 3128

    httpd_accel_with_proxy off
    cache_dir ufs /cache/ 1000 16 256
    httpd_accel_port 80
    # httpd_accel_host virtual
    cache_mem 16 MB


    *****Iptables.txt*****

    /sbin/modprobe ip_tables
    /sbin/modprobe iptable_filter
    /sbin/modprobe ip_conntrack
    /sbin/modprobe ip_conntrack_ftp
    /sbin/modprobe iptable_nat
    /sbin/modprobe ip_nat_ftp
    /sbin/modprobe ipt_LOG
    /sbin/modprobe ipt_state
    /sbin/modprobe ipt_MASQUERADE


    /usr/sbin/iptables -F
    /usr/sbin/iptables -Z
    /usr/sbin/iptables -X
    /usr/sbin/iptables -t nat -F
    /usr/sbin/iptables -P INPUT DROP
    /usr/sbin/iptables -P FORWARD DROP
    /usr/sbin/iptables -P OUTPUT ACCEPT


    echo "1" > /proc/sys/net/ipv4/ip_forward

    echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts



    /usr/sbin/iptables -A INPUT -p ALL -s 127.0.0.1 -i lo -j ACCEPT
    /usr/sbin/iptables -A INPUT -p ALL -s 192.168.2.0 -i lo -j ACCEPT
    /usr/sbin/iptables -A INPUT -p ALL -s 200.149.0.0 -i lo -j ACCEPT


    /usr/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

    /usr/sbin/iptables -A INPUT -p icmp --icmp-type 8 -i eth0 -j ACCEPT
    /usr/sbin/iptables -A INPUT -p icmp --icmp-type 0 -j ACCEPT
    /usr/sbin/iptables -A INPUT -p icmp -s 192.168.2.0 -d 200.244.109.67 -j ACCEPT
    /usr/sbin/iptables -A INPUT -p icmp -s 192.168.2.0 -d 200.244.109.94 -j ACCEPT
    /usr/sbin/iptables -A INPUT -p icmp -s 192.168.2.0 -d 200.231.155.65 -j ACCEPT


    /usr/sbin/iptables -A INPUT -p udp -s 200.202.193.71 --sport 53 -d 200.149.0.0 -j ACCEPT
    /usr/sbin/iptables -A INPUT -p udp -s 200.149.55.140 --sport 53 -d 200.149.0.0 -j ACCEPT


    /usr/sbin/iptables -A INPUT -i eth1 -f -j LOG --log-prefix "Pacote INPUT fragmentado: "
    /usr/sbin/iptables -A INPUT -i eth1 -f -j DROP


    /usr/sbin/iptables -A INPUT -p TCP -i eth0 -s 192.168.2.0/24 --dport 3128 -j ACCEPT

    /usr/sbin/iptables -A INPUT -p TCP --dport 22 -j ACCEPT

    /usr/sbin/iptables -A INPUT -p TCP -i eth1 --sport 80 -j ACCEPT
    /usr/sbin/iptables -A INPUT -p TCP -i eth1 --sport 443 -j ACCEPT
    /usr/sbin/iptables -A INPUT -p TCP -i eth1 --sport 20 -j ACCEPT
    /usr/sbin/iptables -A INPUT -p UDP -i eth1 --sport 21 -j ACCEPT

    /usr/sbin/iptables -A FORWARD -m state --state INVALID -j DROP

    /usr/sbin/iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

    /usr/sbin/iptables -A FORWARD -p udp -s 192.168.2.0/24 -d 200.202.193.71 --dport 53 -j ACCEPT
    /usr/sbin/iptables -A FORWARD -p udp -s 192.168.2.0/24 -d 200.149.55.140 --dport 53 -j ACCEPT
    /usr/sbin/iptables -A FORWARD -p udp -s 200.202.193.71 --sport 53 -d 192.168.2.0/24 -j ACCEPT
    /usr/sbin/iptables -A FORWARD -p udp -s 200.149.55.140 --sport 53 -d 192.168.2.0/24 -j ACCEPT

    /usr/sbin/iptables -A FORWARD -p TCP -s 192.168.2.0/24 --dport 25 -j ACCEPT
    /usr/sbin/iptables -A FORWARD -p TCP -s 192.168.2.0/24 --dport 110 -j ACCEPT
    /usr/sbin/iptables -A FORWARD -p tcp --sport 25 -j ACCEPT
    /usr/sbin/iptables -A FORWARD -p tcp --sport 110 -j ACCEPT

    /usr/sbin/iptables -A FORWARD -j LOG --log-prefix "Pacote forward descartado: "
    /usr/sbin/iptables -A FORWARD -j DROP

    /usr/sbin/iptables -t nat -A POSTROUTING -j MASQUERADE


    Se algume puder me ajudar.


    Agradeco desde ja


    Alexandre de Souza
    alexandreoliveira@veloxmail.com.br

  2. #2
    Alexandre tente usar isso e ve se vai funcionar
    para vc liberar o telnet use
    iptables -A Forward -p tcp -s ip_sua_rede -d 200.244.109.67 --dport 23 -J ACCEPT
    iptables -A Forward -p udp -s ip_sua_rede -d 200.244.109.67 --dport 23 -J ACCEPT
    Use tbm para as regras de Input e Output e mudando os outros endereços de ips que vc precisa liberar.
    Espero que isso te ajude

    [ Esta mensagem foi editada por: em 18-11-2003 15:19 ]






Tópicos Similares

  1. LIBERANDO PING DO CONTROLE DE BANDA (DICA)
    Por standart no fórum Redes
    Respostas: 7
    Último Post: 06-12-2013, 16:47
  2. Respostas: 9
    Último Post: 08-05-2012, 09:41
  3. Respostas: 6
    Último Post: 05-05-2012, 20:30
  4. Commando ping funciona, mas telnet e ftp NÃO !!!!
    Por AndrewAmorimdaSilva no fórum Servidores de Rede
    Respostas: 5
    Último Post: 31-10-2002, 12:44
  5. Servidor Telnet
    Por dubelon no fórum Servidores de Rede
    Respostas: 2
    Último Post: 05-08-2002, 09:38

Visite: BR-Linux ·  VivaOLinux ·  Dicas-L