Squid - IpTables

#************** LIMPA E ZERA AS REGRAS **********
/usr/sbin/iptables -F
/usr/sbin/iptables -Z
/usr/sbin/iptables -t nat -F

#***** NEGA TODA ENTRADA E A PASSAGEM DE PACOTES ****
/usr/sbin/iptables -t filter -P INPUT DROP
/usr/sbin/iptables -t filter -P FORWARD DROP

#***** ACEITA TODA A ENTRADA E SAIDA DE PACOTES PARA O LOOPBACK ******
/usr/sbin/iptables -t filter -A INPUT -i lo -j ACCEPT
/usr/sbin/iptables -t filter -A OUTPUT -o lo -j ACCEPT

#***** PING OF DEATH*******************************************************************
/usr/sbin/iptables -t filter -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
/usr/sbin/iptables -t filter -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

#***** SYN-FLOAD ***********************************************************************
/usr/sbin/iptables -t filter -A INPUT -p tcp -m limit --limit 1/s -j ACCEPT
/usr/sbin/iptables -t filter -A FORWARD -p tcp -m limit --limit 1/s -j ACCEPT

#***** NMAP *******************************************************************************
/usr/sbin/iptables -t filter -A INPUT -p tcp --tcp-flags ALL SYN,ACK,FIN,RST -m limit --limit 1/s -j ACCEPT
/usr/sbin/iptables -t filter -A FORWARD -p tcp --tcp-flags ALL SYN,ACK,FIN,RST -m limit --limit 1/s -j ACCEPT

#***** CONEXOES JA ESTABELECIDAS *******************************
/usr/sbin/iptables -t filter -A INPUT -m state --state NEW -j ACCEPT
/usr/sbin/iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

/usr/sbin/iptables -t filter -A FORWARD -m state --state NEW -j ACCEPT
/usr/sbin/iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

#***** ACEITA A PASSAGEM ****************************************
/usr/sbin/iptables -t filter -A FORWARD -d 0/0 -s 192.168.1.0/24 -o eth0 -j ACCEPT
/usr/sbin/iptables -t filter -A FORWARD -d 192.168.1.0/24 -s 0/0 -i eth0 -j ACCEPT

#***** TODA SAIDA SERA MASCARADA ********************************************
/usr/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
/usr/sbin/iptables -t filter -A INPUT -s 192.168.1.0/24 -d 0/0 -j ACCEPT
/usr/sbin/iptables -t filter -A OUTPUT -s 192.168.1.0/24 -d 0/0 -j ACCEPT

#***** PING DA MAKINA FIREWALL PARA QUALQUER LUGAR SERA ACEITA ****
/usr/sbin/iptables -t filter -A OUTPUT -p icmp -s 192.168.1.0/24 -d 0/0 -j ACCEPT

#* TODA ENTRADA PORTA 80 SERA DIRECIONADA PARA A PORTA DO SQUID (312
/usr/sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

#***** REGRAS DO ICQ *******************************************************************************
#/usr/sbin/iptables -t filter -A INPUT -p udp --source-port 4000 -d 192.168.1.0/24 -i ppp0 -j ACCEPT
#/usr/sbin/iptables -t filter -A INPUT -p udp -s 192.168.1.0/24 --dport 4000 -j ACCEPT
#/usr/sbin/iptables -t filter -A INPUT -p udp --source-port 5190 -d 192.168.1.0/24 -i ppp0 -j ACCEPT
#/usr/sbin/iptables -t filter -A INPUT -p udp -s 192.168.1.0/24 --dport 5190 -j ACCEPT
;;

stop)
gprintf "Parando o serviço %s: " "IPtables"
echo
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 0 > /proc/sys/net/ipv4/ip_forward

/usr/sbin/iptables -t nat -F
/usr/sbin/iptables -Z
/usr/sbin/iptables -F
;;
*)
gprintf "Uso: iptables (start|stop)"
echo

;;

esac

exit 0

Galera estou com esse script de firewall, mas nao consigo mandar nem receber email, nem no server nem nas estacoes


Valeu...... Aguardo Respostas Pessoal

kra só faltou uma coisinha no seu script, vc adicionar esse dois comandinhos aqui:

#iptables -A FORWARD -p tcp --dport 110 -j ACCEPT
#iptables -A FORWARD -p tcp --dport 25 -j ACCEPT

Blz manu

Ja adicionel essas regras q vc me passou mas mesmo assim nao funcionou.

reiniciei o iptables e squid e nem funcionou

Que devo fazer . . . .

Ajudem - me please

[AndrewAmorimdaSilva]

Faz um teste....

ipatbles -P FORWARD ACCEPT

Falai Andrew nem funcionou kara . . .

e diz akelas regras q se me passou no outro topico sobre o ReceitaNet

o mais alguma sugestao nesse caso do email, num sei pq nao esta funcionado . . .

Agurado respostas

valeu

[Webtech]

iptables -t nat -A PREROUTING -s (sua rede) -p tcp --dport 110 -j ACCEPT
iptables -t nat -A PREROUTING -s (sua rede) -p tcp --dport 25 -j ACCEPT

Nem funcionou desse jeito tbm

O Andrew manda akela regra la pra q vc mandou no outro topico pra mim do Receita Net

Valew <IMG SRC="images/forum/icons/icon_biggrin.gif">

[AndrewAmorimdaSilva]

Fala blz??

Para e-mail.

# iptables - A FORWARD -i eth0 -p tcp --dport 25 -j ACCEPT
# iptables - A FORWARD -i eth0 -p tcp --dport 110 -j ACCEPT


Para o receita net:

-Verifique a porta que o programa usa, ligue para o suporte e pergunte qual a porta ele usa, depois...

# iptables -A FORWARD -p tcp --dport 0000 -j ACCEPT
# iptables -A FORWARD -p udp --dport 0000 -j ACCEPT
# iptables -A FORWARD -p sport --dport 0000 -j ACCEPT
# iptables -A FORWARD -p sport --dport 0000 -j ACCEPT

Onde 0000 é o nº da porta que vc obteve.


Um abraço!!! <IMG SRC="images/forum/icons/icon_wink.gif"> <IMG SRC="images/forum/icons/icon_wink.gif"> <IMG SRC="images/forum/icons/icon_wink.gif">