problemas firewall [ajuda]

[tandradesc]

Boa tarde pessoal,

estou com problemas com este script firewall abaixo, a minha navegação não funciona, uso proxy transparente..

alguém poderia me dar uma luz?? o script também está meia-boca, se alguém puder dar umas dicas eu agradeço

minha interface wan é a eth0 e a lan é a eth1

Qualquer coisa em estou no email [email protected]

#!/bin/bash
ipt="/sbin/iptables"
lan="192.168.1.0/255.255.255.0"
wan=`nslookup minhaempresa.no-ip.com | tail -2 | head -1 | cut -d: -f 2`
srv="192.168.1.240"
srvwin="192.168.1.1"
ext="10.1.1.3"
all="0.0.0.0/0.0.0.0"
matecnet=`nslookup minhaempresa.no-ip.com | tail -2 | head -1 | cut -d: -f 2`
thiago="192.168.1.76"

########################################################################
echo " Iniciando Firewall"
sleep 2
echo
echo " Limpa Regras"
sleep 1
sh /root/fw/limpa.sh

########################################################################
echo " Carregando Modulos"
sleep 1
modprobe iptable_nat
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward

########################################################################
echo " Aplicando regras Padroes"
sleep 1

$ipt -P INPUT DROP
$ipt -P FORWARD DROP
$ipt -P OUTPUT ACCEPT
$ipt -F
$ipt -t nat -F
$ipt -X
$ipt -Z

$ipt -A INPUT -s 127.0.0.1 -j ACCEPT
$ipt -A INPUT -s $srv -j ACCEPT
$ipt -A INPUT -s $ext -j ACCEPT

########################################################################
echo " Carregando NAT"
sleep 1
$ipt -t nat -A POSTROUTING -o eth0 -j MASQUERADE
$ipt -A FORWARD -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

$ipt -t nat -A POSTROUTING -o eth1 -j MASQUERADE
$ipt -A FORWARD -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

$ipt -t nat -A PREROUTING -i eth1 -p tcp -s ! 192.168.1.240 --dport 80 -j REDIRECT --to-port 3128
#$ipt -t nat -A PREROUTING -i eth1 -p tcp -s ! 192.168.1.240 --dport 8080 -j REDIRECT --to-port 3128
#$ipt -t nat -A PREROUTING -i eth1 -p tcp -s ! 192.168.1.240 --dport 443 -j REDIRECT --to-port 3128
#$ipt -t nat -A PREROUTING -i eth1 -p tcp -s ! 192.168.1.240 --dport 80 -j REDIRECT --to-port 3128

#########################################################################
echo " Regras Externa"
sleep 1
$ipt -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to $srv:8080
$ipt -t nat -A PREROUTING -i eth0 -p tcp --dport 3000 -j DNAT --to $srv:3000

ifs="$ext $empresa"
for i in $ifs
do
sleep 1
$ipt -A OUTPUT -p tcp -s $all -d $i --dport 8080 -j ACCEPT
$ipt -A OUTPUT -p tcp -s $i -d $all --sport 8080 -j ACCEPT
$ipt -A INPUT -p tcp -s $i -d $all --dport 8080 -j ACCEPT
$ipt -A INPUT -p tcp -s $all -d $i --sport 8080 -j ACCEPT
sleep 1
$ipt -A OUTPUT -p tcp -s $all -d $i --dport 3000 -j ACCEPT
$ipt -A OUTPUT -p tcp -s $i -d $all --sport 3000 -j ACCEPT
$ipt -A INPUT -p tcp -s $i -d $all --dport 3000 -j ACCEPT
$ipt -A INPUT -p tcp -s $all -d $i --sport 3000 -j ACCEPT
done

sleep 1
$ipt -A INPUT -p tcp -s $all -d $ext --dport 6231 -j ACCEPT
$ipt -A INPUT -p tcp -s $ext -d $all --sport 6231 -j ACCEPT

##########################################################################
echo " Regras Servidor -> WAN"
sleep 1
portas="80 8080 443 1863 8245 53 25 110"
for i in $portas
do
$ipt -A INPUT -p tcp -s $srv -d $all --dport $i -j ACCEPT
$ipt -A INPUT -p tcp -s $all -d $srv --sport $i -j ACCEPT

$ipt -A OUTPUT -p tcp -s $srv -d $all --dport $i -j ACCEPT
$ipt -A OUTPUT -p tcp -s $all -d $srv --sport $i -j ACCEPT

$ipt -A INPUT -p tcp -s $srv -d $ext --dport $i -j ACCEPT
$ipt -A INPUT -p tcp -s $ext -d $srv --sport $i -j ACCEPT

$ipt -A OUTPUT -p tcp -s $srv -d $ext --dport $i -j ACCEPT
$ipt -A OUTPUT -p tcp -s $ext -d $srv --sport $i -j ACCEPT
done


#$ipt -A OUTPUT -p tcp -s $srv -d $all --dport 53 -j ACCEPT
#$ipt -A INPUT -p tcp -s $all -d $srv --sport 53 -j ACCEPT
#$ipt -A OUTPUT -p tcp -s $srv -d $all --dport 8245 -j ACCEPT
#$ipt -A INPUT -p tcp -s $all -d $srv --sport 8245 -j ACCEPT

###$ipt -A INPUT -s 192.168.1.1 -d 200.20.186.75 -j ACCEPT
###$ipt -A INPUT -s 200.20.186.75 -d 192.168.1.1 -j ACCEPT

#########################################################################
echo " Regra SNMP Modem"
sleep 1
$ipt -A INPUT -p tcp -s $srv -d 10.1.1.1 --dport 161 -j ACCEPT
$ipt -A INPUT -p tcp -s 10.1.1.1 -d $srv --sport 161 -j ACCEPT
$ipt -A INPUT -p udp -s $srv -d 10.1.1.1 --dport 161 -j ACCEPT
$ipt -A INPUT -p udp -s 10.1.1.1 -d $srv --sport 161 -j ACCEPT

#########################################################################
echo " Regra LAN -> Servidor"
sleep 1
portas="137 138 139 80 8080 443 3128 53 25 110 1863 5280 5222 21"
for i in $portas
do
$ipt -A INPUT -p tcp -s $lan -d $srv --dport $i -j ACCEPT
$ipt -A INPUT -p tcp -s $srv -d $lan --sport $i -j ACCEPT

$ipt -A OUTPUT -p tcp -s $lan -d $srv --dport $i -j ACCEPT
$ipt -A OUTPUT -p tcp -s $srv -d $lan --sport $i -j ACCEPT

$ipt -A FORWARD -p tcp -s $lan -d $srv --dport $i -j ACCEPT
$ipt -A FORWARD -p tcp -s $srv -d $lan --sport $i -j ACCEPT

$ipt -A INPUT -p tcp -s $lan -d $ext --dport $i -j ACCEPT
$ipt -A INPUT -p tcp -s $ext -d $lan --sport $i -j ACCEPT

$ipt -A OUTPUT -p tcp -s $lan -d $ext --dport $i -j ACCEPT
$ipt -A OUTPUT -p tcp -s $ext -d $lan --sport $i -j ACCEPT

$ipt -A FORWARD -p tcp -s $lan -d $ext --dport $i -j ACCEPT
$ipt -A FORWARD -p tcp -s $ext -d $lan --sport $i -j ACCEPT

done


echo " -> Lan - Servidor Win"
sleep 1
$ipt -A INPUT -p tcp -s $lan -d $srvwin --dport 53 -j ACCEPT
$ipt -A INPUT -p tcp -s $srvwin -d $lan --sport 53 -j ACCEPT


########################################################################
echo " Conectividade Social - Caixa Economica"
sleep 1

CAIXA="200.252.47.0/24 200.201.160.0/20"
for ip in $CAIXA
do
$ipt -t nat -A PREROUTING -i eth1 -p tcp -s ! $ip --dport 80 -j REDIRECT --to-port 3128
done

########################################################################
echo " Regras Especiais"
sleep 1
$ipt -A INPUT -p tcp -s $thiago -d $srv --dport 6231 -j ACCEPT
$ipt -A INPUT -p tcp -s $srv -d $thiago --sport 6231 -j ACCEPT
$ipt -A INPUT -p tcp -s $thiago -d $ext --dport 6231 -j ACCEPT
$ipt -A INPUT -p tcp -s $ext -d $thiago --sport 6231 -j ACCEPT
$ipt -A INPUT -s $thiago -d $all -j ACCEPT
$ipt -A INPUT -s $all -d $thiago -j ACCEPT

########################################################################
echo " Liberacoes para conexoes em clientes"
echo " -> TS e SSH"
sleep 1

cli1="200.x.x.x"
cli2="201.x.x.x"

clientes="$cli1 $cli2"
for i in $clientes
do
$ipt -A INPUT -p tcp -s $lan -d $i --dport 3389 -j ACCEPT
$ipt -A INPUT -p tcp -s $i -d $lan --sport 3389 -j ACCEPT
$ipt -A INPUT -p tcp -s $lan -d $i --dport 6231 -j ACCEPT
$ipt -A INPUT -p tcp -s $i -d $lan --sport 6231 -j ACCEPT
done

########################################################################
echo " Regra para bloquear IP"
sleep 1
saidas="$srv $ext $all"
ips="192.168.10.7 65.19.173.132"
chains="INPUT OUTPUT FORWARD"
for i in $saidas
do
for y in $ips
do
for o in $chains
do
$ipt -A $o -s $y -d $i -j DROP
$ipt -A $o -s $i -d $y -j DROP
done
done
done

########################################################################
#echo " Bloqueio Anti-Spoofing e Scanners"
#sleep 1
#$ipt -A FORWARD -p TCP --syn -m limit --limit 1/s -j ACCEPT
#$ipt -A FORWARD -p TCP --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
#$ipt -N syn-flood
#$ipt -A INPUT -i eth0 -p TCP --syn -j syn-flood
#$ipt -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
#$ipt -A syn-flood -j DROP


#########################################################################
#echo " Protecao contra ping da Morte"
#sleep 1
#$ipt -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

#########################################################################
echo " Bloqueio contra Syn-flood, Scanner e Ping of Death"
sleep 1
$ipt -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
$ipt -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
$ipt -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

#echo " Anti-Spoofings"
#sleep 1
#$ipt -A INPUT -j DROP -s $REDEINTERNA -i eth0
#$ipt -A INPUT -j DROP -s $REDEEXTERNA -i eth0
#$ipt -A FORWARD -o eth1 -m state --state NEW,INVALID -j DROP


echo " FIM"

[1c3m4n]

proxy transparente nao depende soh do firewall, depende de configuracao do squid tb.
PS: Postou no forum, entao espere respostas no forum nao no email...

[lucianogf]

Boa tarde pessoal,

estou com problemas com este script firewall abaixo, a minha navegação não funciona, uso proxy transparente..

alguém poderia me dar uma luz?? o script também está meia-boca, se alguém puder dar umas dicas eu agradeço

cara...

vou te dar uma ótima dica...

talvez não seja o que você esperava, mas será a melhor que você terá, pois você irá aprender com ela...

1: certifique-se que você está navegando, elimine tudo, proxy, firewall, etc... deixe apenas o mascaramento das conexões.
funcionou?
se sim; então
vá para o passo 2
senão
resolva o problema e volte ao passo 1

2: teste o proxy, configure o navegador para usar proxy.
funcionou?
se sim; então
vá para o passo 3
senão
resolva o problema e volte ao passo 2

3: faça o redirecionamento para o proxy.
funcionou?
se sim; então
vá para o passo 4
senão
resolva o problema e volte ao passo 3

4: vá adicionando as regras ao script de firewall, desta forma vc poderá encontrar os erros.

uma boa maneira de prevenir erros, é deixar o proxy organizado por ordem de leitura.

mangle - prerouting, input, forward, output, postrouting
nat - prerouting, output, postrouting

sempre lembrando que no iptables a ordem dos fatores altera o valor do produto..

acredito que você seguindo estes passos conseguirá resolver seu problema...

obs.: se nos micros clientes o endereço de dns estiver configurado o endereço do servidor, neste deverá estar instalado um servidor dns, caso contrário não irá funcionar.

valeu
filter - input, forward, output

[vioflas]

Concordo com o amigo acima vc tem um script firewall enorme cheio de regras e etc. Vc precisa isolar os problemas ir por passos, primeiro rotear a internet, funciou blza, depois configurar o proxy, funcionou blza e depois adicionar as regras e dectar porque vc não consegue navegação sinceramente fica difícil analisar um script enorme rapidamente.

[4nderson]

Precisa configurar seu Squid como proxy transparente !
abraços