Meu iptables.conf nao startar nem a pau

blaiser
(usa Debian)

Enviado em 03/05/2009 - 00:14h

/bin/sh: /etc/init.d/iptables.conf: Permission denied

Essa é a mensagem, e estou como usuário root.
o que fazer?

pogo
(usa Fedora)

Enviado em 03/05/2009 - 02:48h

você não configurou permissão de execução no seu script.

chmod 777 iptables.conf

mas antes, estude um pouco sobre permissões. talvez este texto possa te ajudar:

http://focalinux.cipsga.org.br/guia/inic_interm/ch-perm.html

[]'s

pogo

blaiser
(usa Debian)

Enviado em 03/05/2009 - 10:50h

Não funcionou, Não deu certo, vi uma dica para fazer esse comando com o putty, mas nao fraguei ainda.
Mas grato mesmo pela dica meu nobre.

blaiser
(usa Debian)

Enviado em 03/05/2009 - 11:00h

Quando carrega meu linux surge essa linha

/etc/init.d/rc: line 78: /etc/rc2.d/S99iptables.conf : Permission denied

e veja minha configuração do iptables.conf:


#!/bin/bash
# Biosnetti Provedor de Internet
# Script de Firewall IPTables
# Cliente: Escola
# Data Criacao: 06/04/2009
# Data Ultima Atualizacao: 06/04/2009
# by Paulo Ronaldo (suporte.pr@biosnett.com.br)

############################################################################################
################################## Definicao de Variaveis ##################################
############################################################################################

# Localizacao do IPTABLES
IPT="/sbin/iptables"
# Interfaces
IF_LOO="lo"
IF_EXT="eth0"
IF_INT="eth1"
# Redes
REDE_INT="10.120.1.0/27"
# Enderecos IP (Gateways)
#IP_EXT="201.72.244.130"
IP_INT="10.120.1.1"


# Hosts Internos
SERVIDOR="192.168.0.2"
# IPs Liberados sem Proxy (caso use proxy transparente)
IPSLIBERADOS="192.168.0.21"
IPSLIBERADOS="10.120.1.2"
IPSLIBERADOS="10.120.1.3"
fw_start()
{

############################################################################################
################################## Inicializacao do Firewall ###############################
############################################################################################

# Carregando os modulos do iptables
modprobe ip_tables
modprobe iptable_filter
modprobe iptable_mangle
modprobe iptable_nat
modprobe ipt_MASQUERADE
modprobe ip_nat_ftp
echo "Carregando Modulos .......... [ OK ]"
# Definindo a Politica Default das Cadeias
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD DROP
echo "Definindo Politica Default .. [ OK ]"

# Desabilitando o trafego IP entre as placas de rede
echo "0" > /proc/sys/net/ipv4/ip_forward
# Configurando a Protecao anti-spoofing
for spoofing in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo "1" > $spoofing
done
echo "Setting anti-spoofing ....... [ OK ]"

############################################################################################
################################## Cadeia de Entrada (INPUT) ###############################
############################################################################################

# Quais sockets sao validos em uma conexao
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#### IF_LOO
$IPT -A INPUT -i $IF_LOO -j ACCEPT
#### IF_EXT
# Libera ping de fora para o firewall
$IPT -A INPUT -i $IF_EXT -p icmp --icmp-type "echo-request" -j ACCEPT
# Servicos Locais Publicados
$IPT -A INPUT -i $IF_EXT -p tcp --dport 22 -j ACCEPT # SSH

#### IF_INT
$IPT -A INPUT -i $IF_INT -j ACCEPT
echo "Cadeia de INPUT ............. [ OK ]"

############################################################################################
############################# Cadeia de Reenvio (FORWARD) ##################################
############################################################################################
###############################################################
#### CONTROLE DE BANDA - CBQ ##################################
###############################################################


#Cyber IP: 10.120.2.0

iptables -t mangle -A POSTROUTING -s 10.120.2.0 -o eth0 -j MARK --set-mark 1

iptables -t mangle -A FORWARD -s 10.120.2.0 -o eth0 -j MARK --set-mark 1


# IP Full IP: 10.120.1.2
iptables -t mangle -A POSTROUTING -s 10.120.1.2 -o eth0 -j MARK --set-mark 2

iptables -t mangle -A FORWARD -s 10.120.1.2 -o eth0 -j MARK --set-mark 2

# IP Full IP: 10.120.1.3
iptables -t mangle -A POSTROUTING -s 10.120.1.3 -o eth0 -j MARK --set-mark 3

iptables -t mangle -A FORWARD -s 10.120.1.3 -o eth0 -j MARK --set-mark 3



###############################################################
###############################################################
###############################################################

###### LOGS de FORWARD

##### BLOQUEIOS
# Bloqueia smtp para fora (spam zombies)
#$IPT -A FORWARD -p tcp -d ! smtp.empresa.com.br --dport 25 -j DROP

# Bloqueio por MAC
#$IPT -t filter -A FORWARD -m mac --mac-source 00:0A:E6:4E:3A:F0 -j DROP

# Permitir pacotes com estado "ESTABELECIDO/REINCIDENTE"
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

#########################################################################
########################## IF_EXT >> IF_INT #############################
#########################################################################

$IPT -A FORWARD -i $IF_EXT -o $IF_INT -p tcp --dport 3389 -m state --state NEW -j ACCEPT # Terminal Service
$IPT -A FORWARD -i $IF_EXT -o $IF_INT -p tcp --dport 5631 -m state --state NEW -j ACCEPT # PcAnywhere
$IPT -A FORWARD -i $IF_EXT -o $IF_INT -p udp --dport 5632 -m state --state NEW -j ACCEPT # PcAnywhere
$IPT -A FORWARD -i $IF_EXT -o $IF_INT -p tcp --dport 51433 -m state --state NEW -j ACCEPT # SQL Server

#########################################################################
########################## IF_INT >> IF_EXT #############################
#########################################################################

# Libera PING
$IPT -A FORWARD -i $IF_INT -p icmp --icmp-type "echo-request" -j ACCEPT

# Saida HTTP Conectividade Social
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -d 200.201.174.207 -p tcp --dport 80 -j ACCEPT

# Saida dos IPs Liberados
for IPS in $IPSLIBERADOS; do
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -s $IPS -j ACCEPT
done

# Saida liberada para Estacoes
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p tcp --dport 25 -m state --state NEW -j ACCEPT # SMTP
#$IPT -A FORWARD -i $IF_INT -o $IF_EXT -d smtp.martinsautopecas.com.br -p tcp --dport 25 -m state --state NEW -j ACCEPT # SMTP
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p tcp --dport 53 -m state --state NEW -j ACCEPT # DNS tcp
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p udp --dport 53 -m state --state NEW -j ACCEPT # DNS udp
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p tcp --dport 110 -m state --state NEW -j ACCEPT # POP3
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p tcp --dport 407 -m state --state NEW -j ACCEPT # GRRF
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p tcp --dport 443 -m state --state NEW -j ACCEPT # HTTPS
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p tcp --dport 2631 -m state --state NEW -j ACCEPT # GRRF - Conectividade Social
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p tcp --dport 3001 -m state --state NEW -j ACCEPT # GRRF - Cnectividade Social
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p tcp --dport 3389 -m state --state NEW -j ACCEPT # Terminal Service
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p tcp --dport 3456 -m state --state NEW -j ACCEPT # ReceitaNet
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p tcp --dport 4900 -m state --state NEW -j ACCEPT # Telecard
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p tcp --dport 5017 -m state --state NEW -j ACCEPT # CAT - Previdencia Social
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p tcp --dport 5631 -m state --state NEW -j ACCEPT # PcAnywhere
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p udp --dport 5632 -m state --state NEW -j ACCEPT # PcAnywhere
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p udp --dport 8004 -m state --state NEW -j ACCEPT # Maquineta Bradesco
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p tcp --dport 8017 -m state --state NEW -j ACCEPT # DIEF - Contabilidade
$IPT -A FORWARD -i $IF_INT -o $IF_EXT -p tcp --dport 55000:55100 -m state --state NEW -j ACCEPT # RADCall


echo "Cadeia de FORWARD ........... [ OK ]"

############################################################################################
################################## Tabela NAT ##############################################
############################################################################################

# Faz NAT de tudo que sai pela rede
$IPT -t nat -A POSTROUTING -o $IF_EXT -j MASQUERADE

# Libera Conectividade Social sem passar pelo Proxy
$IPT -t nat -A PREROUTING -i $IF_INT -d 200.201.174.207 -p tcp --dport 80 -j ACCEPT

# Libera IPs para nao redirecionar para Proxy
for IPS in $IPSLIBERADOS; do
$IPT -t nat -A PREROUTING -i $IF_INT -s $IPS -p tcp --dport 80 -j ACCEPT
done

# Redireciona porta 80 para 3128 (squid)
$IPT -t nat -A PREROUTING -i $IF_INT -p tcp --dport 80 -j REDIRECT --to-port 3128

# Publicacao de Servicos na Internet
$IPT -t nat -A PREROUTING -i $IF_EXT -p tcp --dport 3389 -j DNAT --to $SERVIDOR # Terminal Service
$IPT -t nat -A PREROUTING -i $IF_EXT -p tcp --dport 5631 -j DNAT --to $SERVIDOR # PcAnywhere
$IPT -t nat -A PREROUTING -i $IF_EXT -p udp --dport 5632 -j DNAT --to $SERVIDOR # PcAnywhere
$IPT -t nat -A PREROUTING -i $IF_EXT -p tcp --dport 51433 -j DNAT --to $SERVIDOR # SQL Server

echo "Tabela NAT .................. [ OK ]"

############################################################################################
################################## Roteamento ##############################################
############################################################################################

# Rota para acesso a rede sem fio
#route del -net 192.168.3.0 netmask 255.255.255.0 gw 192.168.1.86
#route add -net 192.168.3.0 netmask 255.255.255.0 gw 192.168.1.86

# Habilitando o trafego IP, entre as interfaces
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "Firewall OK ................. [ OK ]"

}


fw_stop()
{

# Limpando as Regras
$IPT -F INPUT
$IPT -F OUTPUT
$IPT -F FORWARD
$IPT -t nat -F
echo "Limpando as Regras .......... [ OK ]"

# Libera tudo
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT

echo "Libera Tudo ................. [ OK ]"
}


fw_usage()
{
echo
echo "$0 (start | stop | restart | clear)"
echo
echo "start - Ativa o firewall"
echo "stop - Desativa o firewall"
echo "restart - Reativa o firewall"
echo "clear - Limpa os contatores"
}


fw_clear()
{
$IPT -t filter -Z
$IPT -t nat -Z
$IPT -t mangle -Z
}


case $1 in

start)
fw_start;
;;

stop)
fw_stop;
;;

restart)
fw_stop;
fw_start;
;;

clear)
fw_clear;
;;
*)
fw_usage;
exit;

;;

esac