Dificuldades para liberação de portas e https
1. Dificuldades para liberação de portas e https
vaini
(usa Debian)
Enviado em 07/03/2011 - 14:26h
Ola de novo galera.Recentemente reformulei meu script de firewall com a ajuda de nossos amigos MAGNO e DIEDE aqui do VOL. O script ficou jóia, porém estou com dificuldades para liberação de portas e navegação https. No caso das portas, eu ja liberei por exemplo a porta 4899 do radmin para acesso...porém não consigo o acesso externo. E ja no caso do https, a pagina principal até abre, mas por exemplo, as figuras nao aparecem, e também nao consigo fazer os downloads via https. Meu FORWARD é DROP para melhorar a segurança da rede, porém estou precisando da ajuda de voces para resolver esses probleminhas. Abaixo vai o script:
Obrigado pela ajuda!
#!/bin/sh
#::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
#| Script de Firewall - IPTABLES
#| Criado por: Fernando Cesar Vaini
#| Email de contato: vaini@hotmail.com
#| Fontes: Comunidade Viva o Linux
#| Ajuda Especial: Magno e Diede
#| Uso: /etc/init.d/firewall start|stop|restart
#::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
#Variaveis
PATH=/sbin:/bin:/usr/sbin:/usr/bin
IPTABLES="/sbin/iptables"
PROGRAMA="/etc/init.d/firewall"
TCP_Ports_Internal=80,5522,3128,10000
TCP_Ports_External=5522,2550,3550,3389,4899
UDP_Ports_Internal=53
WAN=ppp0
LAN=eth1
REDE="192.168.0.0/24"
#Carregando modulos do iptables
modprobe ip_tables
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_conntrack_irc
modprobe ip_nat_ftp
modprobe ip_nat_irc
modprobe ipt_LOG
modprobe ipt_REJECT
modprobe ipt_MASQUERADE
modprobe ipt_state
modprobe ipt_multiport
modprobe iptable_mangle
modprobe ipt_tos
modprobe ipt_limit
modprobe ipt_mark
modprobe ipt_MARK
case "$1" in
start)
#cabecalho do firewall exibido na tela
echo "==============================================================================="
echo "| CARREGANDO AS REGRAS DO FIREWALL IPTABLES |"
echo "==============================================================================="
echo
#limpando regras de todas as tabelas
$IPTABLES -t filter -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
#deletando chains de todas as tabelas
$IPTABLES -t filter -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X
#politica padrao
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
#ativando roteamento de pacote
echo "1" > /proc/sys/net/ipv4/ip_forward
echo -e "Ativando o roteamento de pacotes ....................................... [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
###############################################################################
# BLOQUEIO DE ATAQUES #
###############################################################################
#bloqueio a syn-flood e ip spoofing respectivamente
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo -e "Bloqueando ataques ..................................................... [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
###############################################################################
# TABELA NAT #
###############################################################################
#ativando o mascaramento
$IPTABLES -t nat -A POSTROUTING -o $WAN -j MASQUERADE
echo -e "Ativando mascaramento .................................................. [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
#redireciona o trafego da porta 80 para o proxy transparente (squid)
$IPTABLES -t nat -A PREROUTING -p tcp -i $LAN --dport 80 -j REDIRECT --to 3128
echo -e "Ativando Proxy Transparente ............................................ [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
#ativando redirecionamento do MSN-Proxy
#$IPTABLES -t nat -I PREROUTING -i $LAN -p tcp --dport 1863 -j REDIRECT --to-port 1863
#echo -e "Ativando redirecionamento do MSN-Proxy ................................. [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
#liberando dreamule para pegar ID alta
$IPTABLES -t nat -A PREROUTING -p tcp --dport 36416 -j DNAT --to 192.168.0.200
$IPTABLES -t nat -A PREROUTING -p udp --dport 55973 -j DNAT --to 192.168.0.200
echo -e "Liberando ID alta para Dreamule ........................................ [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
#ativando redirecionamento de portas (NAT)
$IPTABLES -t nat -A PREROUTING -i $WAN -p tcp --dport 2550 -j DNAT --to 192.168.0.200:2550 #cameras
$IPTABLES -t nat -A PREROUTING -i $WAN -p tcp --dport 3550 -j DNAT --to 192.168.0.200:3550 #cameras
$IPTABLES -t nat -A PREROUTING -i $WAN -p tcp --dport 3389 -j DNAT --to 192.168.0.2:3389 #ts
$IPTABLES -t nat -A PREROUTING -i $WAN -p tcp --dport 4899 -j DNAT --to 192.168.0.200:4899 #radmin
echo -e "Ativando redirecionamento de portas (NAT) .............................. [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
###############################################################################
# TABELA FILTER #
###############################################################################
########################################
# INPUT/OUTPUT #
########################################
#permite que conexoes ja criadas pela LAN retornem sem criar novas regras
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
#habilitando o fluxo interno entre os processos
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT
echo -e "Habilitando o fluxo interno entre os processos ......................... [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
#liberandos portas para acesso interno
$IPTABLES -t filter -A INPUT -i $LAN -p tcp -m multiport --dports $TCP_Ports_Internal -j ACCEPT
$IPTABLES -t filter -A INPUT -i $LAN -p udp -m multiport --dports $UDP_Ports_Internal -j ACCEPT
#liberando portas para acesso externo
$IPTABLES -t filter -A INPUT -i $WAN -p tcp -m multiport --dports $TCP_Ports_External -j ACCEPT
echo -e "Liberando portas para acesso interno/externo ........................... [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
########################################
# FORWARD #
########################################
#liberando passagem de pacotes entre interfaces
#$IPTABLES -A FORWARD -i $LAN -o $WAN -j ACCEPT
#echo -e "Liberando transito de pacotes entre interfaces ......................... [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
#permite que conexoes ja criadas pela LAN retornem sem criar novas regras
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
echo -e "Habilitando o retorno de conexoes ja criadas ........................... [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
#liberando DNS para LAN
$IPTABLES -t filter -A FORWARD -i $LAN -p udp --dport 53 -j ACCEPT
echo -e "Liberando DNS para a rede interna ...................................... [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
#permitindo a navegacao segura (HTTPS)
$IPTABLES -t filter -I FORWARD -p tcp -i $LAN --dport 443 -j ACCEPT
echo -e "Liberando a navegacao segura (HTTPS) ................................... [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
#liberando SMTP/POP para a LAN
$IPTABLES -t filter -A FORWARD -i $LAN -p tcp --dport 25 -j ACCEPT
$IPTABLES -t filter -A FORWARD -i $LAN -p tcp --dport 110 -j ACCEPT
echo -e "Liberando POP/SMTP para a rede interna ................................. [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
#liberando entrada/retorno do uTorrent
$IPTABLES -t filter -A FORWARD -p tcp -i $LAN -d 192.168.0.200 --dport 44288 -j ACCEPT
$IPTABLES -t filter -A FORWARD -p tcp -i $LAN -s 192.168.0.200 --sport 44288 -j ACCEPT
$IPTABLES -t filter -A FORWARD -p udp -i $LAN -d 192.168.0.200 --dport 44288 -j ACCEPT
$IPTABLES -t filter -A FORWARD -p udp -i $LAN -s 192.168.0.200 --sport 44288 -j ACCEPT
echo -e "Liberando acesso do programa uTorrent .................................. [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
#liberando entrada/retorno do Putty (externo)
$IPTABLES -t filter -A FORWARD -p tcp -i $LAN --sport 5522 -j ACCEPT
echo -e "Liberando acesso ao programa Putty ..................................... [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
#liberando entrada/retorno do servidor das cams
$IPTABLES -t filter -A FORWARD -i $LAN -p tcp -d 192.168.0.200 --dport 2550 -j ACCEPT
$IPTABLES -t filter -A FORWARD -i $LAN -p tcp -s 192.168.0.200 --sport 2550 -j ACCEPT
$IPTABLES -t filter -A FORWARD -i $LAN -p tcp -d 192.168.0.200 --dport 3550 -j ACCEPT
$IPTABLES -t filter -A FORWARD -i $LAN -p tcp -s 192.168.0.200 --sport 3550 -j ACCEPT
echo -e "Liberando acesso ao servidor de cameras ................................ [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
#liberando entrada/retorno do servidor W2K3 TS
$IPTABLES -t filter -A FORWARD -i $LAN -p tcp -d 192.168.0.2 --dport 3389 -j ACCEPT
$IPTABLES -t filter -A FORWARD -i $LAN -p tcp -s 192.168.0.2 --sport 3389 -j ACCEPT
echo -e "Liberando acesso ao servidor Terminal Server (TS) ...................... [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
#liberando entrada/retorno do radmin
$IPTABLES -t filter -A FORWARD -i $LAN -p tcp -d 192.168.0.200 --dport 4899 -j ACCEPT
$IPTABLES -t filter -A FORWARD -i $LAN -p tcp -s 192.168.0.200 --sport 4899 -j ACCEPT
echo -e "Liberando acesso via radmin ............................................ [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
###############################################################################
# TABELA MANGLE #
###############################################################################
#cabecalho do firewall exibido na tela
echo
echo "==============================================================================="
echo "| REGRAS DO FIREWALL CARREGADAS COM SUCESSO |"
echo "==============================================================================="
echo
;;
stop)
echo -e "Desligando o Firewall \c"
for passo in $(seq 50); do echo -e ".\c"; sleep 0.02; done; echo -e " [ {TTEXTO}33[01;32mOK{TTEXTO}33[00;37m ]"
$IPTABLES -F
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -t mangle -F
$IPTABLES -t nat -F
$IPTABLES -t nat -F
$IPTABLES -X
$IPTABLES -Z
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
echo
echo "==============================================================================="
echo "| FIREWALL DESLIGADO |"
echo "==============================================================================="
echo
;;
restart)
$PROGRAMA stop
$PROGRAMA start
;;
*)
echo -e "{TTEXTO}33[01;31mATENCAO \c";tput sgr0
echo -e "Argumento Invalido!!!"
echo "Uso Correto: firewall {start|stop|restart}" >&2
echo
echo "Restartando o Firewall..."
echo
$PROGRAMA restart
exit 1
esac
exit 0