regras de iptables alguem tem mais alguma sugestao?

[daniell]

Galera peguei esse exemplo no VOL achei bem completo.. e adicionei umas coisas... Esse FW seria para uma maquina nesses data centers americanos, mas é para hospedar só um site, os servicos ativos serao: Apache c/ (php5), BD (mysql e postgresql), email, ftp, WHM/CPANEL. alguem tem alguma critica ou ideia??!!

:-D


#!/bin/sh
#
# cftk Bring up/down the packet filtering rules
#
# chkconfig: 345 08 92
# description: Bring up/down the packet filtering rules
# description(pt_BR): Bring up/down the packet filtering rules
# probe: true
#
#
# Observações:
#
# O conntrack aplica o conceito de "ESTABLISHED" e "NEW" inclusive
# para conexões UDP e ICMP, além de TCP.
#

#
#
#


##################################################################
# DEFINIÇÃO DE VARIÁVEIS
#################################################################

IPTABLES="/usr/sbin/iptables"
MODPROBE="/sbin/modprobe"

# Alterar os dados abaixo de acordo com a rede do cliente
IF_LOC="lo" # Interface Loopback
IF_EXT="eth0" # Interface da internet (externa)
IF_INT="eth1" # Interface da intranet (interna)

IP_INT="192.168.0.100" # IP da interface IF_INT
IP_EXT="192.168.1.100" # IP da interface IF_EXT (Link)

NET_LOC="127.0.0.0/24" # Rede da interface IF_LOC
NET_INT="192.168.0.0/24" # Rede da interface IF_INT
NET_EXT="192.168.1.0/24" # Rede da interface IF_EXT

BRO_INT="192.168.0.255" # Broadcast da IF_INT
BRO_EXT="192.168.1.255" # Broadcast da IF_EXT

IP_CLIENTESSH="xxx.xxx.xxx.xxx" / Caso vc queira definir somente um ip que tera acesso ao ssh
IP_CLIENTESSH="xxx.xxx.xxx.xxx" / Caso vc queira definir somente um ip que tera acesso ao ssh
IP_CLIENTESSH="xxx.xxx.xxx.xxx" / Caso vc queira definir somente um ip que tera acesso ao ssh
IP_CLIENTESSH="xxx.xxx.xxx.xxx" / Caso vc queira definir somente um ip que tera acesso ao ssh
IP_CLIENTESSH="xxx.xxx.xxx.xxx" / Caso vc queira definir somente um ip que tera acesso ao ssh


#################################################################
# CARGA DE MÓDULOS
#################################################################

carrega_modulos() {

$MODPROBE ip_tables
$MODPROBE iptable_filter
$MODPROBE ip_conntrack
$MODPROBE ip_conntrack_ftp
# $MODPROBE ip_conntrack_irc
$MODPROBE ip_nat_ftp
# $MODPROBE ip_nat_irc

}

#################################################################
# CARGA DE REGRAS
#################################################################

cria_regras() {

cria_regras_auxiliares
cria_regras_PREROUTING
cria_regras_INPUTOUTPUT

cria_regras_INT2EXT
cria_regras_EXT2INT

cria_regras_FORWARD
cria_regras_POSTROUTING

}


#################################################################
# FLUSH E POLÍTICAS DEFAULT
#################################################################

destroi_regras() {

# Define política default para chains defaults
$IPTABLES -P INPUT DROP # política default para filter
$IPTABLES -P FORWARD DROP # política default para filter
$IPTABLES -P OUTPUT DROP # política default para filter
$IPTABLES -F -t filter # flush nas regras de filter
$IPTABLES -F -t nat # flush nas regras de nat
$IPTABLES -F -t mangle # flush nas regras de mangle
$IPTABLES -X -t filter # deleta chains de filter
$IPTABLES -X -t nat # deleta chains de nat
$IPTABLES -X -t mangle # deleta chains de mangle
$IPTABLES -Z -t filter # zera contadores de filter
$IPTABLES -Z -t nat # zera contadores de nat
$IPTABLES -Z -t mangle # zera contadores de mangle


}

abre_regras() {

# Define política default para chains defaults
$IPTABLES -P INPUT ACCEPT # política default para filter
$IPTABLES -P FORWARD ACCEPT # política default para filter
$IPTABLES -P OUTPUT ACCEPT # política default para filter
$IPTABLES -F -t filter # flush nas regras de filter
$IPTABLES -F -t nat # flush nas regras de nat
$IPTABLES -F -t mangle # flush nas regras de mangle
$IPTABLES -X -t filter # deleta chains de filter
$IPTABLES -X -t nat # deleta chains de nat
$IPTABLES -X -t mangle # deleta chains de mangle
$IPTABLES -Z -t filter # zera contadores de filter
$IPTABLES -Z -t nat # zera contadores de nat
$IPTABLES -Z -t mangle # zera contadores de mangle

}


#################################################################
# CHAIN DE PREROUTING
#################################################################
#
cria_regras_PREROUTING() {
#
# Melhora latência de ssh pra fora
$IPTABLES -A PREROUTING -t mangle -p tcp --dport ssh -j TOS --set-tos Minimize-Delay
#
# Aqui vc podera direcionar portas para outras maquinas na rede ou portas para outras portas
#
# $IPTABLES -A PREROUTING -t nat -p tcp -i $IF_EXT --dport 22 -j DNAT --to 192.168.1.100 / Direciona a porta 22 para a maquina 192.168.1.100
# $IPTABLES -A PREROUTING -t nat -p tcp -i $IF_EXT --dport 8080 -j DNAT --to 192.168.1.100:80 / Direcina a porta 8080 para a maquina 192.168.100 na porta 80
# $IPTABLES -A PREROUTING -t nat -p tcp -i $IF_EXT --dport 3306 -j DNAT --to 192.168.1.10 / Direciona a porta 3306 MySQL para a maquina 192.168.1.10
#
#}
#
#################################################################
# CHAIN DE POSTROUTING
#################################################################

cria_regras_POSTROUTING() {

# Faz o mascaramento da rede interna.
$IPTABLES -A POSTROUTING -t nat -o $IF_EXT -j MASQUERADE
}



#################################################################
# CHAINS DE INPUT, OUTPUT
#################################################################

cria_regras_INPUTOUTPUT() {

#Libera tudo ateh a casa arrumar
$IPTABLES -A INPUT -j ACCEPT
$IPTABLES -A OUTPUT -j ACCEPT

#LIbera interface local
$IPTABLES -A INPUT -j ACCEPT -i $IF_LOC
$IPTABLES -A OUTPUT -j ACCEPT -o $IF_LOC

# Recusa pacotes invaálidos em primeiro lugar
$IPTABLES -A INPUT -j END_INVALID -m state --state INVALID

### Serviços que rodam na máquina

# Aceita ssh da maquina definida (manutenção)
$IPTABLES -A INPUT -j ACCEPT -p tcp -s $IP_CLIENTESSH --dport ssh
$IPTABLES -A OUTPUT -j ACCEPT -p tcp -d $IP_CLIENTESSH --sport ssh

#Aceita que o firewall acesse a web
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport 80
$IPTABLES -A OUTPUT -j ACCEPT -p tcp --dport 80

#Aceita squid
$IPTABLES -A INPUT -j ACCEPT -s $NET_INT -p tcp --dport squid
$IPTABLES -A OUTPUT -j ACCEPT -p tcp --sport squid

#Aceita que o firewall faca ssh pra fora
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport ssh
$IPTABLES -A OUTPUT -j ACCEPT -p tcp --dport ssh

#Aceita conexao com o MySQL
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport 3306
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 3306

#Aceita conexao com o Apache
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport 80
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 80

#Aceita conexao com o Proftpd
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport 21
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 21

#Aceita conexao com o ssh
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport 22
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 22

#Aceita conexao com o cPanel/WHM
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport 2083
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 2083

#Aceita conexao com o WHM/cPanel
$IPTABLES -A INPUT -j ACCEPT -p tcp --sport 2086
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 2086

# Testa por broadcasts e descarta (sem logar)
$IPTABLES -A INPUT -j DROP -d $BRO_INT
$IPTABLES -A INPUT -j DROP -d $BRO_EXT
$IPTABLES -A INPUT -j DROP -d 255.255.255.255
$IPTABLES -A OUTPUT -j DROP -d $BRO_INT
$IPTABLES -A OUTPUT -j DROP -d $BRO_EXT
$IPTABLES -A OUTPUT -j DROP -d 255.255.255.255

# Aceita conexoes da rede interna
$IPTABLES -A INPUT -j ACCEPT -s $NET_INT
$IPTABLES -A OUTPUT -j ACCEPT -d $NET_INT

# Aceita consultas a DNSs externos
$IPTABLES -A INPUT -j ACCEPT -p udp --sport domain --dport 1024:
$IPTABLES -A OUTPUT -j ACCEPT -p udp --sport 1024: --dport domain
$IPTABLES -A INPUT -j ACCEPT -p udp --dport domain
$IPTABLES -A OUTPUT -j ACCEPT -p udp --sport domain

# Checa por trojans, para logar diferenciado
$IPTABLES -A INPUT -j TROJAN_CHECK -m state --state NEW

# Recusa e loga todo o resto
$IPTABLES -A INPUT -j END_INPUT
$IPTABLES -A OUTPUT -j END_OUTPUT

}

#################################################################
# CHAINS DE FORWARD
#################################################################

cria_regras_FORWARD() {

# regras de segurança

iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

# Se for inválido, jogamos fora
$IPTABLES -A FORWARD -j END_INVALID -m state --state INVALID

# Se já está estabelecida, pode passar
$IPTABLES -A FORWARD -j ACCEPT -m state --state ESTABLISHED

# Se relacionada, pode passar (inclusive ftp & cia caem aqui)
$IPTABLES -A FORWARD -j ACCEPT -m state --state RELATED

## Apenas conexões NEW daqui pra frente

$IPTABLES -A FORWARD -p tcp --dport 1433 -j ACCEPT

# Checa por trojans (para registrar no log se encontrar)
$IPTABLES -A FORWARD -j TROJAN_CHECK
$IPTABLES -A FORWARD -j ACCEPT -s 192.168.0.0/24 -d 192.168.1.0/24
$IPTABLES -A FORWARD -j ACCEPT -s 192.168.1.0/24 -d 192.168.0.0/24
$IPTABLES -A FORWARD -j INT2EXT -s $NET_INT -o $IF_EXT

$IPTABLES -A FORWARD -j EXT2INT -i $IF_EXT -d $NET_INT

# Se sobreviver, dropa e loga
$IPTABLES -A FORWARD -j END_FORWARD

}


#################################################################
# CHAINS DIRECIONAIS
#################################################################


### INT2EXT

cria_regras_INT2EXT() {

$IPTABLES -N INT2EXT

$IPTABLES -A INT2EXT -j ACCEPT

$IPTABLES -A INT2EXT -p tcp --dport 25 -j ACCEPT
$IPTABLES -A INT2EXT -p tcp --dport 110 -j ACCEPT
$IPTABLES -A INT2EXT -p tcp --dport 21 -j ACCEPT
$IPTABLES -A INT2EXT -p tcp --dport 20 -j ACCEPT
$IPTABLES -A INT2EXT -p tcp --dport 1299 -j ACCEPT
$IPTABLES -A INT2EXT -p tcp --dport 1024:5000 -j ACCEPT

# Bloqueia o que sobrou
$IPTABLES -A INT2EXT -j END_INT2EXT

}


### EXT2INT

cria_regras_EXT2INT() {

$IPTABLES -N EXT2INT

$IPTABLES -A EXT2INT -j ACCEPT -d 192.168.1.100

# Nenhum accept, simplesmente nega tudo
$IPTABLES -A EXT2INT -j END_EXT2INT

}

#################################################################
# CHAINS AUXILIARES
#################################################################

cria_regras_auxiliares() {

### END_INPUT
$IPTABLES -N END_INPUT
#$IPTABLES -A END_INPUT -j LOG --log-prefix "FIREWALL: End_Input! "
$IPTABLES -A END_INPUT -j DROP

### END_OUTPUT
$IPTABLES -N END_OUTPUT
$IPTABLES -A END_OUTPUT -j LOG --log-prefix "FIREWALL: End_Output! "
$IPTABLES -A END_OUTPUT -j DROP

### END_FORWARD
$IPTABLES -N END_FORWARD
$IPTABLES -A END_FORWARD -j LOG --log-prefix "FIREWALL: End_Forward! "
$IPTABLES -A END_FORWARD -j DROP

### END_INVALID
$IPTABLES -N END_INVALID
$IPTABLES -A END_INVALID -j LOG --log-prefix "FIREWALL: Invalid! "
$IPTABLES -A END_INVALID -j DROP

### END_TROJAN
$IPTABLES -N END_TROJAN
$IPTABLES -A END_TROJAN -j LOG --log-prefix "FIREWALL: Trojan! "
$IPTABLES -A END_TROJAN -j DROP

### END_INT2EXT
$IPTABLES -N END_INT2EXT
$IPTABLES -A END_INT2EXT -j LOG --log-prefix "FIREWALL: End_Int2Ext! "
$IPTABLES -A END_INT2EXT -j DROP

### END_EXT2INT
$IPTABLES -N END_EXT2INT
$IPTABLES -A END_EXT2INT -j LOG --log-prefix "FIREWALL: End_Ext2Int! "
$IPTABLES -A END_EXT2INT -j DROP


### TROJANS
# Alguns trojans, os mais comuns
# Nào é necessário checar por trojans se você adota a política de
# tudo fechado, abrem-se as excessões. Mas, você pode querer verificar
# mesmo assim, para poder registrar um log mais específico (nosso caso).
$IPTABLES -N TROJAN_CHECK
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 555 # phAse zero
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 555 # phAse zero
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 1243 # Sub-7, SubSeven
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 1243 # Sub-7, SubSeven
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 3129 # Masters Paradise
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 3129 # Masters Paradise
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 6670 # DeepThroat
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 6670 # DeepThroat
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 6711 # Sub-7, SubSeven
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 6711 # Sub-7, SubSeven
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 6969 # GateCrasher
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 6969 # GateCrasher
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 12345 # NetBus
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 12345 # NetBus
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 21544 # GirlFriend
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 21544 # GirlFriend
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 23456 # EvilFtp
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 23456 # EvilFtp
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 27374 # Sub-7, SubSeven
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 27374 # Sub-7, SubSeven
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 30100 # NetSphere
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 30100 # NetSphere
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 31789 # Hack'a'Tack
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 31789 # Hack'a'Tack
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 31337 # BackOrifice, and many others
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 31337 # BackOrifice, and many others
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p tcp --dport 50505 # Sockets de Troie
$IPTABLES -A TROJAN_CHECK -j END_TROJAN -p udp --dport 50505 # Sockets de Troie

}

[gatoseco]

Muita coisa desnecessaria !!!