Iptables (rc.firewall)
Firewall pronto para ser usado com proxy transparente, bloqueando acessos da internet para a sua rede, inclusive ao ssh do firewall.
Obs.: Caso vc não tenha o squid rodando, basta comentar a seguinte linha:
#iptables -t nat -A PREROUTING -s $Rede_Interna -p tcp --dport 80 -j REDIRECT --to-port 3128
Obs.: O script tem uma função que verifica o status do último comando executado, retornando "ok" ou "erro"
Obs.: Caso vc não tenha o squid rodando, basta comentar a seguinte linha:
#iptables -t nat -A PREROUTING -s $Rede_Interna -p tcp --dport 80 -j REDIRECT --to-port 3128
Obs.: O script tem uma função que verifica o status do último comando executado, retornando "ok" ou "erro"
#/bin/bash
#Deleloped by Andrei/André
Internet=eth0
#configure a variavel Rede_Interna de acordo com a sua rede
Rede_Interna=10.1.1.0/24
NORMAL="\33[0m"
GOOD="\33[32;1m"
BAD="\33[31;1m"
ok_or_error() {
if [ "$?" = "0" ]; then
tput hpa 60
echo -ne "$GOOD[OK]"
else
tput hpa 60
echo -ne "$BAD[ERR]"
fi
echo -ne "$NORMAL\n"
}
fire_start() {
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
/sbin/modprobe iptable_nat
echo
echo "================================================================"
echo " | :: Setando as regras do Firewall :: | "
echo "================================================================"
#Regras Padrão das Chains --------------------------------------------
echo -n "Setting default rules"
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
ok_or_error
#---------------------------------------------------------------------
# Desativando o IP Forward -------------------------------------------
echo -n "Setting ip_forward: OFF"
echo "0" > /proc/sys/net/ipv4/ip_forward
ok_or_error
#---------------------------------------------------------------------
# Anti Spoofing ------------------------------------------------------
echo -n "Setting anti-spoofing protection"
for spoofing in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo "0" > $spoofing
done
ok_or_error
#----------------------------------------------------------------------
# Anti-Redirects ------------------------------------------------------
echo -n "Setting anti-redirects"
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
ok_or_error
#----------------------------------------------------------------------
# Anti source route -- ------------------------------------------------
echo -n "Setting anti-source_route"
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
ok_or_error
#----------------------------------------------------------------------
# Anti bugus response -------------------------------------------------
echo -n "Setting anti-bugus_response"
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
ok_or_error
#----------------------------------------------------------------------
# Anti Synflood protection --------------------------------------------
echo -n "Setting anti-synflood protection"
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
ok_or_error
# Ping ignore ---------------------------------------------------------
echo -n "Ping Ignore"
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
ok_or_error
#----------------------------------------------------------------------
# Chain INPUT --------------------------------------------------------
echo -n "Setting rules for INPUT"
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
ok_or_error
#----------------------------------------------------------------------
# Chain FORWARD -------------------------------------------------------
echo -n "Setting rules for FORWARD"
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
ok_or_error
#----------------------------------------------------------------------
# IP Masquerading (NAT) -----------------------------------------------
echo -n "Activating IP Mask"
iptables -t nat -A POSTROUTING -o $Internet -j MASQUERADE
ok_or_error
#----------------------------------------------------------------------
# INPUT--------------------------------------------------------------------------------
echo -n "Input manual rules"
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -s $Rede_Interna --dport 22 -j ACCEPT
iptables -A INPUT -p udp -s $Rede_Interna --dport 53 -j ACCEPT
iptables -A INPUT -p tcp -s $Rede_Interna --dport 3128 -j ACCEPT
ok_or_error
#--------------------------------------------------------------------------------------
# FORWARD------------------------------------------------------------------------------
echo -n "Forward manual rules"
iptables -A FORWARD -p tcp -s $Rede_Interna -j ACCEPT
ok_or_error
#--------------------------------------------------------------------------------------
# REDIRECIONAMENTO DE HOSTS------------------------------------------------------------
echo -n "Hosts Redirects manual rules"
#aqui vc pode colocar seus redirecionamentos DNAT e SNAT
ok_or_error
#----------------------------------------------------------------------------------------------------------
# REDIRECIONAMENTO DE PORTAS-------------------------------------------------------------------------------
echo -n "Ports Redirects manual rules"
iptables -t nat -A PREROUTING -s $Rede_Interna -p tcp --dport 80 -j REDIRECT --to-port 3128
ok_or_error
#----------------------------------------------------------------------------------------------------------
# IP Forward ON -------------------------------------------------------------------------------------------
echo -n "Setting ip_forward: ON"
echo "1" > /proc/sys/net/ipv4/ip_forward
ok_or_error
#----------------------------------------------------------------------------------------------------------
echo "================================================================"
echo " <<<--->>> Firewall Ativo! <<<--->>> "
echo "================================================================"
}
fire_stop() {
echo "Stopping Firewall..."
/usr/sbin/iptables -F
/usr/sbin/iptables -t nat -F
/usr/sbin/iptables -t mangle -F
/usr/sbin/iptables -X
/usr/sbin/iptables -X -t nat
/usr/sbin/iptables -Z
/usr/sbin/iptables -F INPUT
/usr/sbin/iptables -F OUTPUT
/usr/sbin/iptables -F POSTROUTING -t nat
/usr/sbin/iptables -F PREROUTING -t nat
/usr/sbin/iptables -P INPUT ACCEPT
/usr/sbin/iptables -P FORWARD ACCEPT
/usr/sbin/iptables -P OUTPUT ACCEPT
ok_or_error
}
fire_restart() {
fire_stop
sleep 1
fire_start
}
case "$1" in
'start')
fire_start
;;
'stop')
fire_stop
;;
'restart')
fire_restart
;;
*)
echo "usage $0 start|stop|restart"
esac
