Liberar Porta VOIP [RESOLVIDO]
1. Liberar Porta VOIP [RESOLVIDO]
an_lumesil
(usa Ubuntu)
Enviado em 08/01/2014 - 14:27h
Pessoal preciso de ajuda com urgência pois não estou conseguindo liberar o acesso externo para VOIP dentro do meu firewall. no teste de porta aparece "Aberta. Mais com bloqueio".#!/bin/bash
# FIREWALL Alterado POR: Andre Mendes
#========================================
# CARREGA OS MODULOS
firewall_start(){
modprobe nf_nat_pptp
modprobe nf_conntrack_pptp
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp
modprobe ip_conntrack
modprobe ip_gre
modprobe ppdev
modprobe ppp_generic
modprobe pppoatm
modprobe ppp_async
modprobe ppp_deflate
#=======================================
# ABRE PORTAS DA TABELA INPUT PARA ACESSO EXTERNO.
iptables -A INPUT -p tcp --dport 1022 -j ACCEPT
iptables -A INPUT -p tcp --dport 143 -j ACCEPT
iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 587 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 110 -j ACCEPT
iptables -A INPUT -p tcp --dport 3389 -j ACCEPT
iptables -A INPUT -p tcp --dport 1746 -j ACCEPT
iptables -A INPUT -p tcp --dport 20 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 47 -j ACCEPT
iptables -A INPUT -p tcp --dport 995 -j ACCEPT
iptables -A INPUT -p tcp --dport 993 -j ACCEPT
iptables -A INPUT -p tcp --dport 465 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 5440 -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j ACCEPT
iptables -A INPUT -p tcp --dport 1684 -j ACCEPT
iptables -A INPUT -p tcp --dport 1624 -j ACCEPT
iptables -A INPUT -p udp --dport 5060 -j ACCET
#=======================================
# COMPARTILHA A INTERNET
modprobe iptable_nat
echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp -i eth2 --dport 80 -j REDIRECT --to-port 3128
#========================================
# ABRE PORTAS INPUT REDE INTERNA.
iptables -A INPUT -p tcp -s 192.168.2.0/255.255.255.0 -j ACCEPT
iptables -A INPUT -p tcp -s 1624 -j ACCEPT
#========================================
# LIBERA LOOPBACK.
iptables -A INPUT -p tcp --syn -s 127.0.0.1/255.0.0.0 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
#========================================
#RDP
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 3389 -j DNAT --to 192.168.2.2
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5445 -j DNAT --to 192.168.2.103
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 9000 -j DNAT --to 192.168.2.103
#=====================================================================
#Libera Voip
iptables -t nat -A PREROUTING -p udp -i eth0 --dport 5060 -j DNAT --to 192.168.2.6
#========================================
# CONECTIVIDADE SOCIAL PARA TODA A REDE
iptables -t nat -A PREROUTING -d 200.201.160.0/20 -j RETURN
iptables -t nat -A POSTROUTING -d 200.201.160.0/20 -j MASQUERADE
iptables -t filter -A FORWARD -d 200.201.160.0/20 -j ACCEPT
CAIXA="200.252.47.0/24 200.201.160.0/20 200.201.174.207"
for ip in $CAIXA
do
iptables -t nat -A PREROUTING -p tcp -d $ip -j ACCEPT
iptables -A FORWARD -p tcp -d $ip -j ACCEPT
done
#========================================
# IGNORA PINGS.
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
#========================================
# PROTEGE CONTRA SYNFLOOD.
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
#========================================
# PROTEGE CONTRA ICMP BROADCASTING.
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#========================================
# BLOQUEIA TRACEROUTE.
iptables -A INPUT -p udp --dport 33435:33525 -j DROP
#========================================
# FECHA TODAS AS PORTAS TABELA INPUT PARA REDE EXTERNA, EXETO AS LIBERADAS ACIMA.
iptables -A INPUT -p tcp --syn -j DROP
#========================================
echo "CARREGANDO REGRAS DO FIREWALL..."
sleep 1
echo "OK"
sleep 1
}
firewall_stop(){
iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
}
case "$1" in
"start")
firewall_start
;;
"stop")
firewall_stop
echo "LIMPANDO REGRAS DO FIREWALL..."
sleep 2
echo "OK"
;;
"restart")
echo "LIMPANDO REGRAS DO FIREWALL..."
sleep 1
echo "OK"
firewall_stop; firewall_start
;;
*)
iptables -L -n
esac
exit 0