Firewall Linux Iptables [Shell Script]

Firewall Linux Iptables

Publicado por Jonathan Ribeiro (última atualização em 17/06/2016)

[ Hits: 5.975 ]

Homepage: www.locapack.com.br

Download 6420.firewall.sh

1 0

Denuncie Favoritos Indicar

Script firewall iptables Linux.

Liberações básicas de internet.

Já possui script para liberar rede local para internet.

Ajuste as variáveis de acordo com seu ambiente de rede.

Apenas descomentar as linhas:

# Mascaramento
$IPT -t nat -A POSTROUTING -s $NETWORK -o $IWAN -j MASQUERADE
$IPT -A FORWARD -s $NETWORK -i $ILAN -j ACCEPT
$IPT -A FORWARD -s $NETWORK -j ACCEPT

Esconder código-fonte

#!/bin/bash
#
# Shell Script - Firewall
# =======================
# chkconfig: 2345 80 20
# description: Firewall Linux
#
### BEGIN INIT INFO
#=========================================================================================
# Script para Firewall Linux
# Desenvolvido por Jonathan Ribeiro
# http://www.locapack.com.br jonathan@locapack.com.br
#
#=========================================================================================
# Provides: Firewall
# Required-Start:
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Description: Firewall Linux
# ########################################################################################
#      Nome do arquivo firewall.sh
#      Criar arquivo no /etc/firewall/
#      ln -s /etc/firewall/firewall.sh /etc/init.d
#      cd /etc/init.d
#      chkconfig firewall.sh on
#      Colocando script na inicializacao
#      Tonar executavel chmod +x /etc/firewall/firewall.sh
##########################################################################################



### END INIT INFO
#!/bin/bash
#
# Shell Script - Firewall
# =======================
#
#Firewall Linux LAN IP
INET=192.198.10.1

# Rede Local
NETWORK=192.168.10.0/24

# Interface da Rede Local - LAN
ILAN=eth1

# Interface da Rede Externa - Internet
IWAN=eth0

IPT=/sbin/iptables

/sbin/modprobe iptable_filter
/sbin/modprobe iptable_nat
/sbin/modprobe iptable_mangle
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_REDIRECT
/sbin/modprobe ipt_MASQUERADE

INTERNET () {
# Mascaramento
#$IPT  -t nat -A POSTROUTING -s $NETWORK -o $IWAN -j MASQUERADE
$IPT -A FORWARD -s $NETWORK -i $ILAN -j ACCEPT
#$IPT -A FORWARD -s $NETWORK -j ACCEPT

# Ativando o redirecionamento de pacotes
#$IPT -A POSTROUTING -t nat -s 192.168.10.2 -o $IWAN -j MASQUERADE
#$IPT -A FORWARD -s 192.168.10.2 -j ACCEPT

echo 1 > /proc/sys/net/ipv4/ip_forward
}

LIMPAR () {
# Removendo regras
$IPT -F
$IPT -t nat -F
$IPT -t mangle -F

# Apagando chains
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X

# Zerando contadores
$IPT -Z
$IPT -t nat -Z
$IPT -t mangle -Z
}

PARAR () {
# Limpando regras
LIMPAR

# PolÃtica PadrÃ£o
$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT

# Compartilhando a Internet
INTERNET
}

INICIAR () {
echo "#=========================================================================#"
echo "# Script para Firewall Linux                    #"
echo "# Desenvolvido por Jonathan Ribeiro                 #"
echo "# http://www.locapack.com.br jonathan@locapack.com.br           #"
echo "#                                    #"
echo "#=========================================================================#"


# Limpando regras
LIMPAR

# PolÃtica PadrÃ£o
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD DROP

# Compartilhando a Internet
INTERNET

########################## ATRIBUINDO SEGURANÃ‡A ##########################

# ProteÃ§Ã£o para SYN Flood
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# Rejeitar requisiÃ§Ã£o de ICMP Echo destinado a Broadcasts e Multicasts
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Ignorar Mensagens Falsas de icmp_error_responses
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

for i in /proc/sys/net/ipv4/conf/*; do
# NÃ£o Redirecionar Mensagens ICMP
echo 0 > $i/accept_redirects

# ProteÃ§Ã£o a Ataques IP Spoofing
echo 0 > $i/accept_source_route

# Permitir que Pacotes Forjados sejam logados pelo prÃ³prio kernel
echo 1 > $i/log_martians

# Verificar EndereÃ§o de Origem do Pacote (ProteÃ§Ã£o a Ataques IP Spoofing)
echo 1 > $i/rp_filter
done

#################### ADICIONANDO REGRAS P/ SERVIDORES ####################

# Apache - Servidor Web
#$IPT -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT

# Apache TomCat - Servidor Web
#$IPT -A INPUT -p tcp --dport 8080 -j ACCEPT

# Bind9 - Servidor DNS
#$IPT -A INPUT -p udp --dport 53 -j ACCEPT

# DanGuardian - Servidor Proxy
#$IPT -A INPUT -i $ILAN -p tcp --dport 8080 -j ACCEPT

# DHCP - Servidor DHCP
#$IPT -A INPUT -i $ILAN -p udp --sport 68 --dport 67 -j ACCEPT

# IPP - Protocolo de ImpressÃ£o na Internet
#$IPT -A INPUT -i $ILAN -p tcp --dport 631 -j ACCEPT
#$IPT -A INPUT -i $ILAN -p udp -m multiport --dports 138,631 -j ACCEPT

# NFS - Servidor NFS
#$IPT -A INPUT -p tcp -m multiport --dports 111,2049,51049 -j ACCEPT
#$IPT -A INPUT -p udp -m multiport --dports 111,49176 -j ACCEPT

# ProFTP - Servidor FTP
#$IPT -A INPUT -i $ILAN -p tcp --dport 21 -j ACCEPT
#$IPT -A INPUT -i $ILAN -p tcp -m multiport --dports 49152:49162 -j ACCEPT

# Postfix - Servidor de E-mail
#$IPT -A INPUT -i $ILAN -p tcp -m multiport --dports 25,110 -j ACCEPT
#$IPT -A INPUT -i $ILAN -p tcp -m multiport --dports 465,995 -j ACCEPT

# PostgreSQL - Servidor Postgresql
#$IPT -A INPUT -i $ILAN -p tcp --dport 5432 -j ACCEPT

# Samba - ServiÃ§os de DiretÃ³rio da Microsoft
#$IPT -A INPUT -i $ILAN -p tcp -m multiport --dports 445,139 -j ACCEPT
#$IPT -A INPUT -i $ILAN -p udp -m multiport --dports 137,138 -j ACCEPT

# Squid - Servidor Proxy
#$IPT -A INPUT -i $ILAN -p tcp --dport 3128 -j ACCEPT

# SSH - Servidor SSH
$IPT -A INPUT -i $ILAN -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 300 --hitcount 10 -j DROP
$IPT -A INPUT -i $ILAN -p tcp --dport 22 -m state --state NEW -m recent --set
$IPT -A INPUT -i $ILAN -p tcp --dport 22 -j ACCEPT

# SSH EXTERNO
$IPT -A INPUT -i $IWAN -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 300 --hitcount 10 -j DROP
$IPT -A INPUT -i $IWAN -p tcp --dport 22 -m state --state NEW -m recent --set
$IPT -A INPUT -i $IWAN -p tcp --dport 22 -j ACCEPT


# VNC - Servidor de Acesso Remoto
#$IPT -A INPUT -p tcp --dport 5900 -j ACCEPT

# Webmin - Gerenciador Web de Servidor
#$IPT -A INPUT -i $ILAN -p tcp --dport 10000 -j ACCEPT

##################### ADICIONANDO REGRAS P/ SERVIÃ‡OS #####################

# DNS - ServiÃ§o de Nomes de Dominios
#$IPT -A FORWARD -o $INET -p udp -m multiport --dports 53,5353 -j ACCEPT

# FTP - Protocolo de TransferÃªncia de Arquivo
#$IPT -A FORWARD -o $INET -p tcp --dport 21 -j ACCEPT

# HTTP - Protocolo de TransferÃªncia de Hypertext
#$IPT -A FORWARD -o $INET -p tcp -m multiport --dports 80,8080 -j ACCEPT

# HTTPS - Protocolo de TransferÃªncia de Hypertext Seguro
#$IPT -A FORWARD -o $INET -p tcp --dport 443 -j ACCEPT

# MSNMS - ServiÃ§o de Mensageiro de Rede da Microsoft
#$IPT -A FORWARD -o $INET -p tcp -m multiport --dports 1863,7001 -j ACCEPT
#$IPT -A FORWARD -o $INET -p udp --dport 7001 -j ACCEPT

# NTP - Protocolo para sincronizaÃ§Ã£o dos relÃ³gios
#$IPT -A FORWARD -o $INET -p udp --dport 123 -j ACCEPT

# Ping
#$IPT -A INPUT -i $ILAN -p icmp --icmp-type 8 -j ACCEPT
#$IPT -A FORWARD -o $INET -p icmp --icmp-type 8 -j ACCEPT

# POP3 - Protocolo de Correio
#$IPT -A FORWARD -o $INET -p tcp --dport 110 -j ACCEPT

# POP3S - Protocolo de Correio Seguro
#$IPT -A FORWARD -o $INET -p tcp --dport 995 -j ACCEPT

# PPTP - Protocolo de Encapsulamento Ponto a Ponto
#$IPT -A FORWARD -o $INET -p tcp --dport 1723 -j ACCEPT

# RDP - Protocolo de Ãrea de Trabalho Remota
#$IPT -A FORWARD -o $INET -p tcp --dport 3389 -j ACCEPT

# SSDP - Protocolo para Descoberta de ServiÃ§os Simples
#$IPT -A INPUT -i $ILAN -p udp --dport 1900 -j ACCEPT

# SSH - Shell Seguro
#$IPT -A FORWARD -o $INET -p tcp --dport 22 -j ACCEPT

# SMTP - Protocolo Simples para TransferÃªncia de Correio
#$IPT -A FORWARD -o $INET -p tcp --dport 25 -j ACCEPT

# SSMTP - Protocolo Simples para TransferÃªncia de Correio Seguro
#$IPT -A FORWARD -o $INET -p tcp --dport 465 -j ACCEPT

# TELNET
#$IPT -A FORWARD -o $ILAN -p tcp --dport 23 -j ACCEPT

# VNC - ComputaÃ§Ã£o em Rede Virtual
#$IPT -A FORWARD -o $ILAN -p tcp --dport 5900 -j ACCEPT

# XMPP - Protocolo de PresenÃ§a e Mensagens Extensiva
#$IPT -A FORWARD -o $INET -p tcp --dport 5222 -j ACCEPT

# Manter ConexÃµes Estabelecidas
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Liberando o TrÃ¡fego na Interface loopback
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A FORWARD -o eth0 -j ACCEPT
#Rede Local
$IPT -I INPUT  -s $NETWORK -d 192.168.10.1 -j ACCEPT
$IPT -I OUTPUT -s $NETWORK -d 192.168.10.1 -j ACCEPT

# Liberar Ping
$IPT -A OUTPUT -p icmp -j ACCEPT
$IPT -A INPUT -p icmp -j ACCEPT

################################## LOG ###################################

$IPT -A INPUT -p tcp -m multiport ! --dports 0:1056 -j DROP
$IPT -A INPUT -p udp -j DROP
$IPT -A INPUT -p icmp -j DROP
$IPT -A INPUT -m limit --limit 3/m --limit-burst 3 -j LOG --log-prefix "LOG-FW: "

}

case "$1" in
start)
echo " * Starting Firewall iptables"
INICIAR
;;
stop)
echo " * Stopping Firewall iptables"
PARAR
;;
restart|reload)
echo " * Reloading Firewall iptables"
PARAR
INICIAR
;;
*)
echo " * Usage: $0 {start|stop|restart|reload}"
exit 1
esac

exit 0

Scripts recomendados

Atualizar repositório no Linux desabilitando a hibernação do sistema

Bloqueando o acesso à internet

Iptables Port Knocking

consistir variável numérica ou alfa-numérica

Relatório Básico do Ping

Comentários

[1] Comentário enviado por Ignorante em 20/06/2016 - 19:48h

Esse Script me parece familiar.....

0 0