l0g1in
(usa FreeBSD)
Enviado em 11/02/2015 - 08:32h
Adicione as regras
# Lipa todas a Regaras
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -F
# Cria regra default para Chains
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
# Carrega modulos do iptables
modprobe ip_tables
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_conntrack_irc
modprobe iptable_nat
modprobe ip_nat_ftp
modprobe ipt_string
echo 0 > /proc/sys/net/ipv4/conf/all/log_martians
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/ip_dynaddr
# Libera Rede Interna
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0_IP_Da_WAN -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT
Bloqueia a porta 80 pra toda rede como no exemplo abaixo:
# Bloqueio da Porta 80 TCP
iptables -A FORWARD -p tcp --destination-port 80 -s 192.168.1.0/24 -j DROP
iptables -A FORWARD -p tcp --destination-port 443 -s 192.168.1.0/24 -j DROP
#iptables -A FORWARD -p tcp --destination-port 445 -s 192.168.1.0/24 -j DROP
#iptables -A FORWARD -p udp --destination-port 137 -s 192.168.1.0/24 -j DROP
#iptables -A FORWARD -p udp --destination-port 138 -s 192.168.1.0/24 -j DROP
#iptables -A FORWARD -p udp --destination-port 139 -s 192.168.1.0/24 -j DROP
Assim nenhuma maquina da rede conseguirá navegar na internet se não estiver com proxy devidamente configurado no navegador.
# Liberando Porta 80 Para Usuário sem Proxy
iptables -A FORWARD -p tcp --destination-port 80 -s 192.168.1.201 -j ACCEPT
iptables -A FORWARD -p tcp --destination-port 443 -s 192.168.1.201 -j ACCEPT
