Iptables com dois links

junior_hartmann
(usa CentOS)

Enviado em 18/07/2010 - 00:50h

Pessoal, boa noite, sou MUITO novo no mundo linux... e recentemente onde trabalho recebi um segundo link adsl no firewall que atualmente é também o servidor proxy (squid) e servidor VPN (openvpn) onde já tenho um link ativo.
eth0=192.168.0.5 (link dedicado)
eth1=192.168.1.5 (adsl)
eth2=10.10.0.5 (rede local)
Gatwey default=192.168.0.1
meu problema é o seguinte: não estou conseguindo configurar o iptables de tal forma que todo o trafego originado pelo squid seja direcionado para o link adsl (eth1) e todo o restante permaneça no link dedicado (eth0), minha configuração do iptables hoje esta assim:

#!/bin/bash
PATH=$PATH:/sbin

# Carrega modulos
modprobe ip_tables
modprobe ip_conntrack
modprobe ip_conntrack_ftp

echo Modulos carregados
REDELOCAL="10.10.0.0/24"
REDCOORP="10.0.0.0/8"
REDEMATRIZ="10.10.10.0/24"
REDEDMZ="200.150.64.48/29"
UNPRIVPORTS="1024:65535"
IFEXTERN="192.168.0.5"
IFEXTERN2="192.168.1.5"
IFEXTERNM="192.168.0.5/32"
IFINTERN="10.10.0.5/32"
IPROUTER="192.168.1.1/32"
IPTUNEL="192.168.11.0/24"
REDEDISC="192.168.10.0/24"
ADSLMATRIZ="200.103.237.67"

ifext=eth0
ifext2=eth1
ifint=eth2

# Remove as configuracoes existentes
iptables -F
iptables -t nat -F
iptables -X
iptables -Z

# Configura a politica de descarte de pacotes
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

echo Definida politica padrao – descarte

/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
/bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
for interface in /proc/sys/net/ipv4/conf/*/accept_redirects; do
/bin/echo "0" > ${interface}
done
for interface in /proc/sys/net/ipv4/conf/*/send_redirects; do
/bin/echo 0 > ${interface}
done
# Habilita protecao contra mensagem de erro "bad error message protection"
/bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
# Log spoofed packets, source routed packets, redirect packets.
/bin/echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
# Enable TCP SYN Cookie Protection
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

echo Configurado Kernel
#Recusa spoofed packets
# Recusa pacotes da rede local recebidos pela interface externa
iptables -A INPUT -s $REDECOORP -i $ifext -j LOG --log-level info --log-prefix "SPOOFING:"
iptables -A INPUT -s $REDECOORP -i $ifext -j DROP
iptables -A INPUT -s $REDECOORP -i $ifext2 -j LOG --log-level info --log-prefix "SPOOFING:"
iptables -A INPUT -s $REDECOORP -i $ifext2 -j DROP
# Recusa pacotes de redes que nao sejam a local recebidos pela iface interna
iptables -A INPUT ! -s $REDELOCAL -i $ifint -j LOG --log-level info --log-prefix "SPOOFING:"
iptables -A INPUT ! -s $REDELOCAL -i $ifint -j DROP
# Recusa pacotes da Rede privativa Classe B
iptables -A INPUT -s 172.16.0.0/255.240.0.0 -j LOG --log-level info --log-prefix "SPOOFING:"
iptables -A INPUT -s 172.16.0.0/255.240.0.0 -j DROP
# Recusa pacotes da Rede de multicast Classe D
iptables -A INPUT -s 224.0.0.0/240.0.0.0 -j LOG --log-level info --log-prefix "SPOOFING:"
iptables -A INPUT -s 224.0.0.0/240.0.0.0 -j DROP
# Recusa pacotes da Rede de Teste-Reservada Classe E
iptables -A INPUT -s 240.0.0.0/248.0.0.0 -j LOG --log-level info --log-prefix "SPOOFING:"
iptables -A INPUT -s 240.0.0.0/248.0.0.0 -j DROP
# Recusa pacotes da Loopback nao recebidos pela interface Loopback
iptables -A INPUT -s 127.0.0.0/255.0.0.0 ! -i lo -j LOG --log-level info --log-prefix "SPOOFING:"
iptables -A INPUT -s 127.0.0.0/255.0.0.0 ! -i lo -j DROP
# Protecao contra ataque de sobrecarga de SYN
iptables -N syn-flood
iptables -A INPUT -i $ifext -p tcp --syn -j syn-flood
iptables -A syn-flood -m limit --limit 1/s --limit-burst 5 -j RETURN
iptables -A syn-flood -j LOG --log-level info --log-prefix "SYN-FLOOD:"
iptables -A syn-flood -j DROP
iptables -A INPUT -i $ifext2 -p tcp --syn -j syn-flood
iptables -A syn-flood -m limit --limit 1/s --limit-burst 5 -j RETURN
iptables -A syn-flood -j LOG --log-level info --log-prefix "SYN-FLOOD:"
iptables -A syn-flood -j DROP

echo Recusa mais de cinco pacotes SYN por segundo - protecao contra SYN Flood
iptables -A INPUT -i $ifint -p tcp ! --syn -m state --state NEW -j LOG --log-level info --log-prefix "SYN-FALSE:"
iptables -A INPUT -i $ifint -p tcp ! --syn -m state --state NEW -j DROP
echo Recusa falsas conexoes de sincronia

## LOOPBACK
# Habilita trafego sem restricoes para Loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A INPUT -i $ifint -j ACCEPT
iptables -A OUTPUT -o $ifint -j ACCEPT

echo Liberadas Interfaces Internas - Loopback e $ifint

#conexao da VPN
iptables -A OUTPUT -o $ifext -d $REDEDMZ -p udp --dport 5001:5099 -j ACCEPT
iptables -A INPUT -i $ifext -s $REDEDMZ -p udp --sport 5001:5099 -j ACCEPT
iptables -A OUTPUT -o $ifext -d $ADSLMATRIZ -p udp --dport 5001:5099 -j ACCEPT
iptables -A INPUT -i $ifext -s $ADSLMATRIZ -p udp --sport 5001:5099 -j ACCEPT
iptables -A OUTPUT -o $ifext -d $REDEDMZ -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i $ifext -s $REDEDMZ -p udp --sport 1194 -j ACCEPT
iptables -A OUTPUT -o $ifext -d $ADSLMATRIZ -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i $ifext -s $ADSLMATRIZ -p udp --sport 1194 -j ACCEPT
iptables -A OUTPUT -o $ifext -d $REDEDMZ -p udp --dport 53 -j ACCEPT
iptables -A INPUT -i $ifext -s $REDEDMZ -p udp --sport 53 -j ACCEPT
iptables -A OUTPUT -o $ifext -d $ADSLMATRIZ -p udp --dport 53 -j ACCEPT
iptables -A INPUT -i $ifext -s $ADSLMATRIZ -p udp --sport 53 -j ACCEPT

#SSH - via internet
iptables -A OUTPUT -o $ifext -d $REDEDMZ -p tcp --sport 22 -j ACCEPT
iptables -A INPUT -i $ifext -s $REDEDMZ -p tcp --dport 22 -j ACCEPT

#WEB ##ACREDITO QUE AQUI ESTA MEU PROBLEMA ####
iptables -A OUTPUT -o $ifext2 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i $ifext2 -p tcp --sport 80 -j ACCEPT
iptables -A OUTPUT -o $ifext2 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i $ifext2 -p tcp --sport 443 -j ACCEPT

#DNS
iptables -A OUTPUT -o $ifext -p udp --dport 53 -j ACCEPT
iptables -A INPUT -i $ifext -p udp --sport 53 -j ACCEPT

#ping
iptables -A OUTPUT -o $ifext -p icmp -j ACCEPT
iptables -A INPUT -i $ifext -p icmp --icmp-type 0 -j ACCEPT
iptables -A INPUT -i $ifext -s $REDEDMZ -p icmp -j ACCEPT
iptables -A INPUT -i $ifext -s $ADSLMATRIZ -p icmp -j ACCEPT

#FTP nao-passivo
iptables -A OUTPUT -o $ifext -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -i $ifext -p tcp --sport 21 -j ACCEPT
iptables -A OUTPUT -o $ifext -p tcp --dport 20 -j ACCEPT
iptables -A INPUT -i $ifext -p tcp --sport 20 -j ACCEPT


###### VPN ########
iptables -A INPUT -i tun+ -d $IPTUNEL -j ACCEPT
iptables -A OUTPUT -o tun+ -s $IPTUNEL -j ACCEPT
iptables -A INPUT -i tun+ -d $REDELOCAL -j ACCEPT
iptables -A OUTPUT -o tun+ -s $REDELOCAL -j ACCEPT
iptables -A FORWARD -i tun+ -o $ifint -d $REDELOCAL -j ACCEPT
iptables -A FORWARD -o tun+ -i $ifint -s $REDELOCAL -j ACCEPT

ifconfig | grep -A 2 "ppp0" | grep -q "192.168.10.1"
if [ $? -eq 0 ]; then
iptables -A INPUT -i ppp0 -s $REDECOORP -j ACCEPT
iptables -A OUTPUT -o ppp0 -d $REDECOORP -j ACCEPT
iptables -A FORWARD -i ppp0 -o $ifext -d $REDELOCAL -j ACCEPT
iptables -A FORWARD -o ppp0 -i $ifext -s $REDELOCAL -j ACCEPT

iptables -A FORWARD -i ppp0 -o $ifint -d $REDELOCAL -j ACCEPT
iptables -A FORWARD -o ppp0 -i $ifint -s $REDELOCAL -j ACCEPT
iptables -A INPUT -i ppp0 -s $REDEDISC -d $REDEDISC -j ACCEPT
iptables -A OUTPUT -o ppp0 -s $REDEDISC -d $REDEDISC -j ACCEPT
iptables -A INPUT -i ppp0 -s $REDEDISC -d $REDELOCAL -j ACCEPT
iptables -A OUTPUT -o ppp0 -s $REDELOCAL -d $REDEDISC -j ACCEPT

echo " "
else
ifconfig | grep -q "ppp0"
if [ $? -eq 0 ]; then
iptables -A INPUT -i ppp0 -s $REDECOORP -j ACCEPT
iptables -A OUTPUT -o ppp0 -d $REDECOORP -j ACCEPT
iptables -A INPUT -i ppp0 -s $REDEDMZ -j ACCEPT
iptables -A OUTPUT -o ppp0 -d $REDEDMZ -j ACCEPT
iptables -A FORWARD -i ppp0 -o $ifint -d $REDELOCAL -j ACCEPT
iptables -A FORWARD -o ppp0 -i $ifint -s $REDELOCAL -j ACCEPT
#WEB
iptables -A OUTPUT -o ppp0 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp --sport 80 -j ACCEPT
iptables -A OUTPUT -o ppp0 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp --sport 443 -j ACCEPT

#DNS
iptables -A OUTPUT -o ppp0 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -i ppp0 -p udp --sport 53 -j ACCEPT

fi
fi
#
# Habilita Roteamento
#
/bin/echo "1" > /proc/sys/net/ipv4/ip_forward
echo Roteamento Habilitado

# Bloqueia restante do trafeco
iptables -A INPUT -s 0/0 -j LOG --log-level info --log-prefix "ENTRADA:"
iptables -A INPUT -s 0/0 -j DROP
iptables -A FORWARD -s 0/0 -d 0/0 -j LOG --log-level info --log-prefix "ROTEAMENTO:"
iptables -A FORWARD -s 0/0 -d 0/0 -j DROP
iptables -A OUTPUT -d 0/0 -j LOG --log-level info --log-prefix "SAIDA:"
iptables -A OUTPUT -d 0/0 -j DROP



# Agradeceria muito se pudessem me dar uma ajuda nesse caso....