R.S.P Andre
(usa Debian)
Enviado em 29/04/2010 - 20:18h
Ola!!
tipo eu fiz alguma alteraçoes no seu firewall e ele funfou aqui na minha rede.
tenta acrescentrar ele como esta ai e ve se vai;
#!/bin/bash
### Passo 1: Limpando as regras ###
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
echo "=================================================="
echo "Cleaning all rules .........................[ OK ]"
# Definindo a Politica Default das Cadeias
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
echo "Setting default rules ......................[ OK ]"
### Passo 2: Desabilitar o trafego IP entre as placas de rede ###
echo "0" > /proc/sys/net/ipv4/ip_forward
echo "Setting ip_forward: OFF ....................[ OK ]"
# Configurando a Protecao anti-spoofing
for spoofing in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo "1" > $spoofing
done
echo "Setting anti-spoofing protection ...........[ OK ]"
# Impedimos que um atacante possa maliciosamente alterar alguma rota
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "Setting anti-redirects .....................[ OK ]"
# Utilizado em diversos ataques, isso possibilita que o atacante determine o "caminho" que seu
# pacote vai percorrer (roteadores) ate seu destino. Junto com spoof, isso se torna muito perigoso.
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "Setting anti-source_route ..................[ OK ]"
# Protecao contra responses bogus
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo "Setting anti-bugus_response ................[ OK ]"
# Protecao contra ataques de syn flood (inicio da conexao TCP). Tenta conter ataques de DoS.
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo "Setting anti-synflood protection ...........[ OK ]"
### Passo 3: Carregando os modulos do iptables ###
modprobe ip_tables
modprobe iptable_filter
modprobe iptable_mangle
modprobe iptable_nat
modprobe ipt_MASQUERADE
echo "Loading iptables's modules .................[ OK ]"
### Passo 4: Agora, vamos definir o que pode passar e o que nao ###
##
##
#Liberando para rede interna
iptables -A INPUT -p tcp --syn -s xxx.xxx.x.x/16 -j ACCEPT
### LIBERANDO PORTA 80 PARA O APACHE
iptables -A INPUT -p tcp --dport 80 --syn -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 --syn -j ACCEPT
#iptables -A INPUT -p tcp -i eth0 --dport 80 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
##Fecha o resto
iptables -A INPUT -p tcp --syn -j DROP
# Cadeia de Entrada
# LOCALHOST - ACEITA TODOS OS PACOTES
iptables -A INPUT -i lo -j ACCEPT
# PORTA 80 - ACEITA PARA A REDE LOCAL
iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
# PORTA 22 - ACEITA PARA A REDE LOCAL
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
# No iptables, temos de dizer quais sockets sao validos em uma conexao
iptables -A INPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
echo "Setting rules for INPUT ....................[ OK ]"
################################
# Cadeia de Reenvio (FORWARD).
# Primeiro, ativar o mascaramento (nat).
iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
echo "Activating IP Mask .........................[ OK ]"
# Agora dizemos quem e o que podem acessar externamente
# No iptables, o controle do acesso a rede externa e feito na cadeia "FORWARD"
# PORTA 3128 - ACEITA PARA A REDE LOCAL
iptables -A FORWARD -i eth0 -p tcp --dport 3128 -j ACCEPT
##########################################################################
####### Aqui tu tenta retirar as cameras do proxy ########################
##########################################################################
iptables -A FORWARD -s ip.das.cameras -j ACCEPT ##
iptables -t nat -A PREROUTING -p tcp --dport 80 -s ip.das.cameras -j RETURN ##
##########################################################################
##########################################################################
# Redireciona porta 80 para 3128 (squid)
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -A FORWARD -s ip.das.cameras -j ACCEPT ##
iptables -t nat -A PREROUTING -p tcp --dport 80 -s ip.das.cameras -j RETURN ##
##########################################################################
##########################################################################
# Redireciona porta 80 para 3128 (squid)
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
#########################################################################
################# Agora tu define as regras para as cameras #############
#########################################################################
iptables -t nat -A PREROUTING -p tcp --dport X -j DNAT --to xx.x.x.x:XX
iptables -t nat -A PREROUTING -p tcp --dport X -j DNAT --to xx.x.x.x:XX
iptables -t nat -A PREROUTING -p tcp --dport X -j DNAT --to xx.x.x.x:XX
iptables -t nat -A PREROUTING -p tcp --dport X -j DNAT --to xx.x.x.x:XX
################## E por ai vai ##################################
#PORTA 80 ACESSO EXTERNO (APACHE)
iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to xx.xxx.x.x:80
Bem, eu usei somente essa parte aqui e funfou numa boa.
Tente usar essa parte e dpois tu vai acrescentando o restante e testando pra ver se ta funfando ainda.
Tu já fez um pequeno teste no
http://meuip.datahouse.com.br/ pra ver se as portas que tu vai usar para as cameras estão aceitando conexão?
ABS!
