Firewall deixando internet lenta

andre_ramos
(usa openSUSE)

Enviado em 29/12/2011 - 15:12h

Configurei um firewal mas percebi que todos os dias ao chegar na empresa minha conexão com a internet fica bem lenta, so melhora após reiniciar o serviço do firewall.

alguém tem alguma sugestão!


Script do firewall

#!/bin/bash

# Autor: Andre Chagas Ramos
# Data Criacao: 25/09/2009
# Data Modificacao:13 /12/2011

IPTABLES=/usr/sbin/iptables
NETWORK=eth1
WEB=eth0
iniciar () {

# Limpando as regras
$IPTABLES -F
$IPTABLES -Z
$IPTABLES -t nat -F
$IPTABLES -t mangle -F

# Compatilhamento da conexao
echo 1 > /proc/sys/net/ipv4/ip_forward

echo "Ativando compatilhamento!"

# Politicas de acesso geral
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP

# Compartilhamento da internet para a rede interna
$IPTABLES -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Manter conexoes ja estabelecidas para nao parar
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -m state --state INVALID -j DROP

# Bloqueia pacotes intencionamente mal-formados
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

# Evitando SYN_Flood
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# Carregamento de Modulos
modprobe ip_nat_ftp
modprobe iptable_nat
modprobe ip_tables
modprobe ip_conntrack
modprobe ipt_MASQUERADE
modprobe ip_conntrack_ftp
modprobe ip_gre
modprobe ip_nat_pptp

# Aceita todo o trafego vindo do loopback e indo pro loopback
$IPTABLES -t filter -A INPUT -i lo -j ACCEPT

# Protecoes contra ataques #
$IPTABLES -A INPUT -m state --state INVALID -j DROP

# Redirecionando o trafego para a porta 3128
$IPTABLES -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3128
$IPTABLES -t nat -A PREROUTING -p tcp --dport 8080 -j REDIRECT --to-port 3128
#$IPTABLES -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 3128
$IPTABLES -A INPUT -i eth1 -j ACCEPT

############################################################
## Redirecionamento de porta 37777 e 80 para o DVR Cameras #

$IPTABLES -I FORWARD -p tcp --dport 37777 -j ACCEPT
$IPTABLES -t nat -I PREROUTING -p tcp -i eth0 --dport 37777 -j DNAT --to-destination 192.168.0.200:37777
$IPTABLES -I FORWARD -p tcp --dport 80 -j ACCEPT
$IPTABLES -t nat -I PREROUTING -p tcp -i eth0 --dport 80 -j DNAT --to-destination 192.168.0.200:80

############################################################
## Redirecionamento de porta 3389 para o Server-TS ########

$IPTABLES -I FORWARD -p tcp --dport 3389 -j ACCEPT
$IPTABLES -t nat -I PREROUTING -p tcp -i eth0 --dport 3389 -j DNAT --to-destination 192.168.0.202:3389
##############################################################

# Bloquear IPS de sites proibidos
#$IPTABLES -I FORWARD -s 192.168.0.0/24 -d 74.208.12.174 -j DROP # koolim.com
#$IPTABLES -I FORWARD -s 192.168.0.0/24 -d 210.17.215.19 -j DROP #imunitive.com
#$IPTABLES -I FORWARD -s 192.168.0.0/24 -d 64.13.161.58 -j DROP # imo.im
#$IPTABLES -I FORWARD -s 192.168.0.0/24 -d 64.13.161.61 -j DROP # imo.im

# Regras para liberar o outlook
$IPTABLES -A FORWARD -p udp -s 192.168.0.0/24 -d 200.175.182.139 --dport 53 -j ACCEPT
$IPTABLES -A FORWARD -p udp -s 200.175.182.139 --sport 53 -d 192.168.0.0/24 -j ACCEPT
$IPTABLES -A FORWARD -p udp -s 192.168.0.0/24 -d 200.175.5.139 --dport 53 -j ACCEPT
$IPTABLES -A FORWARD -p udp -s 200.175.5.139 --sport 53 -d 192.168.0.0/24 -j ACCEPT
$IPTABLES -A FORWARD -p tcp -s 192.168.0.0/24 --dport 25 -j ACCEPT # SMTP
$IPTABLES -A FORWARD -p tcp -s 192.168.0.0/24 --dport 587 -j ACCEPT # SMTP
$IPTABLES -A FORWARD -p tcp -s 192.168.0.0/24 --dport 110 -j ACCEPT # POP3

# Regras para liberar o FTP
$IPTABLES -A INPUT -i $NETWORK -p tcp -s 192.168.0.0/24 --dport 20 -j ACCEPT # FTP
$IPTABLES -A INPUT -i $NETWORK -p tcp -s 192.168.0.0/24 --dport 21 -j ACCEPT # FTP

# INPUT # Pacotes que entram na rede
$IPTABLES -A INPUT -i $NETWORK -p tcp --dport 22 -j ACCEPT # SSH
$IPTABLES -A INPUT -i $NETWORK -p tcp --dport 80 -j ACCEPT # HTTP
$IPTABLES -A INPUT -i $NETWORK -p tcp --dport 443 -j ACCEPT # HTTPS
$IPTABLES -A INPUT -i $NETWORK -p tcp --dport 3389 -j ACCEPT # Conexão Remota

# FORWARD # Pacotes que circulam na rede
$IPTABLES -A FORWARD -i $NETWORK -p tcp --dport 22 -j ACCEPT # SSH
$IPTABLES -A FORWARD -i $NETWORK -p tcp --dport 8333 -j ACCEPT # HTTP
$IPTABLES -A FORWARD -i $NETWORK -p tcp --dport 443 -j ACCEPT # HTTPS
$IPTABLES -A FORWARD -i $NETWORK -p tcp --dport 3389 -j ACCEPT # Conexão Remota
$IPTABLES -A FORWARD -i $NETWORK -s 192.168.0.0/24 -j ACCEPT

#--------------------------------------------------------------------------------------

echo "Firewall Ativado"
}

parar(){

echo "Regras de firewall e compartilhamento desativados"
iptables -F
iptables -t nat -F
iptables -t mangle -F
}

case "$1" in
"start") iniciar ;;
"stop") parar ;;
"restart") parar; iniciar;;
*)echo "Use os paramentros start ou stop"
esac

danniel-lara
(usa Fedora)

Enviado em 29/12/2011 - 15:56h

já verificou os logs ?