alexkaim
(usa Debian)
Enviado em 29/01/2011 - 13:36h
servidor:/home/alex# cat /etc/init.d/escudo
# Firewall:alex
# Data: 12/09/2010
# Iniciar/Reiniciar
case $1 in
start|restart)
echo "Iniciando escudo"
# Limpar regras
iptables -F
iptables -t nat -F
# Bloquear tudo
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -t filter -A INPUT -i eth0 -p icmp -j DROP
# Ativar roteamento
echo 1 > /proc/sys/net/ipv4/ip_forward
# Liberar internet para a própria máquina
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
# Liberar a rede local
iptables -A INPUT -s 192.168.10.0/24 -j ACCEPT
#iptables -A FORWARD -s 192.168.10.203 -p tcp --dport 1863 -j ACCEPT
#iptables -A FORWARD -s 192.168.10.203 -d 65.54.179.192 -j ACCEPT
#iptables -A FORWARD -p tcp --dport 1863 -j DROP
#iptables -A FORWARD -d 65.54.179.192 -j DROP
# Liberar portas
iptables -A INPUT -p tcp --dport 143 -j ACCEPT
iptables -A INPUT -p tcp --dport 110 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 5900 -j ACCEPT
iptables -A INPUT -p tcp --dport 20 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -s 0/0 -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s 0/0 -i eth0 -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -s 0/0 -o eth0 -p udp --dport 53 -j ACCEPT
# iptables -A FORWARD -p tcp --dport 53 -j ACCEPT
### DNS
#iptables -A INPUT -s 0/0 -d 200.146.104.140 -p udp --dport 53 -j ACCEPT
#iptables -A OUTPUT -s 0/0 -d 200.146.104.140 -p udp --dport 53 -j ACCEPT
#iptables -A FORWARD -s 0/0 -d 200.146.104.140 -p udp --dport 53 -j ACCEPT
# iptables -A INPUT -p udp --dport 137 -j ACCEPT
# iptables -A INPUT -p udp --dport 138 -j ACCEPT
# iptables -A INPUT -p tcp --dport 139 -j ACCEPT
# iptables -t nat -A PREROUTING -p udp --dport 1863 -j REDIRECT --to-port 1863
#liberar msn
#iptables -A FORWARD -p tcp --dport 1080 -j ACCEPT
#iptables -A FORWARD -p tcp --dport 1863 -j ACCEPT
#iptables -I FORWARD -s 192.168.10.1/255.255.255.0 -p tcp --dport 1863 -j ACCEPT
#iptables -I FORWARD -s 192.168.10.1/255.255.255.0 -d loginnet.password.com -j ACCEPT
#iptables -I FORWARD -s 192.168.10.1/255.255.255.0 -d hotmail.com -j ACCEPT
#iptables -I FORWARD -s 192.168.10.1/255.255.255.0 -d hotmail.com.br -j ACCEPT
#iptables -A FORWARD -i eth0 -p tcp --dport 1863 -j ACCEPT
#iptables -A FORWARD -i eth0 -d loginnet.passport.com -j ACCEPT
#iptables -A FORWARD -i eth0 -d 64.4.13.0/24 -j ACCEPT
#iptables -A FORWARD -i eth0 -d login.live.com -j ACCEPT
#iptables -A FORWARD -i eth0 -d login.passport.com -j ACCEPT
#iptables -A FORWARD -i eth0 -d gateway.messenger.hotmail.com -j ACCEPT
#
# Ativar NAT e redirecionar a porta 80 para 3128 no squid
### IP FIXO
#iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 192.168.1.2
### IP DINÂMICO
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
#iptables -t nat -A PREROUTING -i iflan -p tcp -s 192.168.1.2 -m multiport --dport 80 -j REDIRECT --to-port 3128 -d ! 192.168.10.233/24
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
#Bloque acesso a modem
;;
# Parar firewall
stop)
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -F
iptables -t nat -F
echo "Escudo parado"
;;
# Indicar ação
*)
echo "Digite start, restart ou stop"
;;
esac
servidor:/home/alex#
Essa eo firewall que esta rodadndo,gostaria de adiciona uma regra para uma certa maquina da rede nao passa se pelo proxy autenticado entra se direto na net
