erro iptables [RESOLVIDO]

emerson.cosmo
(usa Debian)

Enviado em 02/08/2011 - 18:32h

Galera,
tenho um servidor com debian5 e está rodando normalmente, estou montando um novo com o debian 6, porém quando rodo o scritp do antigo firewall ele aparece esse erro "Using intrapositioned negation (`--option ! this`) is deprecated in favor of extrapositioned (`! --option this`)." localizei o problema, mais quando eu retiro a "!", os clientes não navegam.
Abaixo segue meu script e se tiverem mais dicas para melhorar, pode falar, desde já agradeço a todos

#!/bin/bash
#############
##variaveis##
#############
IPT=$(which iptables)
iptables=/sbin/iptables
externo=eth0
interno=eth1
eto=xxx.xxx.xxx.xxx #ip externo
NET="0/0"
PA=1024:65535
LO=127.0.0.1
####################
##Limpando tabelas##
####################
$iptables -F
$iptables -t nat -F
$iptables -t mangle -F

###################
##Ativando modulo##
###################
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_REJECT
/sbin/modprobe ipt_MASQUERADE

##############################
##Modulo FTP PASSIVO e ATIVO##
##############################
modprobe ip_conntrack_ftp
modprobe ip_conntrack
modprobe ip_nat_ftp
modprobe ip_tables
modprobe iptable_nat
############################
##Protecao contra spoofing##
############################
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

##################################
##Determinando a politica padrao##
##################################
$iptables -P INPUT DROP
$iptables -P OUTPUT DROP
$iptables -P FORWARD DROP

######################
##LIberando LOOPBACK##
######################
$iptables -A INPUT -i lo -d $LO -j ACCEPT
$iptables -A OUTPUT -o lo -d $LO -j ACCEPT

#####################
##Regras de filtros##
#####################
#Aceitar pacotes que realmente devem entrar
#------------------------------------------
$iptables -A INPUT -i ! $externo -j ACCEPT #linha que está dando erro
$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
$iptables -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT

#Protecao contra worms
#----------------------
$iptables -A FORWARD -p tcp --dport 135 -i $interno -j REJECT

#Protecao contra syn-flood
#-------------------------
$iptables -A FORWARD -p tcp --syn -m limit --limit 2/s -j ACCEPT

#Protecao contra port scanners
#------------------------------
$iptables -N SCANNER
$iptables -A SCANNER -j DROP
$iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -i $externo -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL NONE -i $externo -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL ALL -i $externo -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL FIN,SYN -i $externo -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -i $externo -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -i $externo -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -i $externo -j SCANNER

#Ping da Morte
$iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 22/s -j ACCEPT


##Liberando resolucao de nome
$iptables -A OUTPUT -p udp -s $eto --sport $PA -d $NET --dport 53 -j ACCEPT
$iptables -A INPUT -p udp -s $NET --sport 53 -d $eto --dport $PA -j ACCEPT

##Liberando navegacao http e https
$iptables -A OUTPUT -p tcp -s $eto --sport $PA -d $NET --dport 80 -j ACCEPT
$iptables -A INPUT -p tcp -s $NET --sport 80 -d $eto --dport $PA -j ACCEPT
$iptables -A OUTPUT -p tcp -s $eto --sport $PA -d $NET --dport 443 -j ACCEPT
$iptables -A INPUT -p tcp -s $NET --sport 443 -d $eto --dport $PA -j ACCEPT
$iptables -A OUTPUT -p tcp -s $eto --sport $PA -d $NET --dport 139 -j ACCEPT
$iptables -A INPUT -p tcp -s $NET --sport 139 -d $eto --dport $PA -j ACCEPT
$iptables -A OUTPUT -p tcp -s $eto --sport $PA -d $NET --dport 445 -j ACCEPT
$iptables -A INPUT -p tcp -s $NET --sport 445 -d $eto --dport $PA -j ACCEPT


#############
##Regra MSN##
#############
##BLOQUEIO
$iptables -I FORWARD -s 192.168.5.0/24 -p tcp --dport 1863 -j REJECT
$iptables -I FORWARD -s 192.168.5.0/24 -p tcp --dport 5190 -j REJECT
$iptables -I FORWARD -s 192.168.5.0/24 -d loginnet.password.com -j REJECT
$iptables -I FORWARD -s 192.168.5.0/24 -d hotmail.com -j REJECT
$iptables -I FORWARD -s 192.168.5.0/24 -d hotmail.com.br -j REJECT


###########################
## Regra POP, SMTP e IMAP##
###########################

$iptables -t nat -A POSTROUTING -s 192.168.5.0/24 -o $externo -m multiport -p tcp --dport 25,110,143,587,995 -j MASQUERADE

###################
##Mascarando REDE##
###################
$iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
$iptables -t nat -A POSTROUTING -s 192.168.5.0/24 -o eth0 -j MASQUERADE

danielmjmarques
(usa Suse)

Enviado em 02/08/2011 - 19:12h

Cara, não achei no seu script o echo 1 > /proc/sys/net/ipv4/ip_forward que habilita a passagem dos pacotes, vc ja deixou habilitado em outro lugar ou default ?

Será que não é isso?

Quando vc deixa dando o erro, ai os clientes navegam?

xeque-mate
(usa Debian)

Enviado em 02/08/2011 - 19:49h

Voçê deve especificar a rede na variavel 'externo' e utilizar -s e não -i.

emerson.cosmo
(usa Debian)

Enviado em 03/08/2011 - 09:27h

Renato Pacheco, Xeque-Mate e Danielmjmarques,
Meu meu muito obrigado, estava dois dias quebrando a cabeça e graças a vocês, consegui resolver o problema de sintax, novamente obrigado pela força que voçês e a comunidades do VOL.