maumauns
(usa RedHat)
Enviado em 29/04/2010 - 11:43h
#!/bin/bash
#Interface da internet
ifinternet="eth1"
#Interface da rede local
iflocal="eth0"
iniciar(){
modprobe iptable_nat
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o $ifinternet -j MASQUERADE
# INICIO DE BLOQUE AO WEBMESSENGER
iptables -A FORWARD -d 64.13.161.61 -j DROP
iptables -A FORWARD -d 208.70.188.17 -j DROP
iptables -A FORWARD -d 72.167.53.158 -j DROP
iptables -A FORWARD -d imo.im -p all -j DROP
iptables -A INPUT -d imo.im -p all -j DROP
iptables -A OUTPUT -d imo.im -p all -j DROP
iptables -A FORWARD -d 72.232.196.154 -j DROP
iptables -A FORWARD -d 216.245.217.83 -j DROP
iptables -A FORWARD -d iloveim.com -p all -j DROP
iptables -A INPUT -d iloveim.com -p all -j DROP
iptables -A OUTPUT -d iloveim.com -p all -j DROP
# LIBERANDO PROGRAMAS DO GOVERNO NO FIREWALL
iptables -A FORWARD -i $iflocal -d 161.148.0.0/16 -p tcp --dport 3456 -j ACCEPT
iptables -A FORWARD -i $iflocal -d 200.198.239.0/32 -p tcp --dport 3456 -j ACCEPT
# LIBERANDO ENTRADA E SAIDE DE EMAIL'S NO OUTLOOK EXPRESS
iptables -A FORWARD -i $iflocal -p tcp --dport 25 -s 0.0.0.0 -j ACCEPT
iptables -A FORWARD -i $iflocal -p tcp --dport 110 -s 0.0.0.0 -j ACCEPT
iptables -A OUTPUT -p tcp -o $ifinternet -s 0.0.0.0 --dport 25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -o $ifinternet -s 0.0.0.0 --dport 110 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# DIRECIONANDO/LIBERANDO PORTA DE USO DO UTORRENT
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 50029 -j DNAT --to-destination 192.168.0.6
# BLOQUEANDO MESSENGER PARA OS IPS LISTADOS
iptables -A FORWARD -s 192.168.0.132 -p tcp --dport 1863 -j DROP
iptables -A FORWARD -s 192.168.0.132 -d loginnet.passport.com -j DROP
# LIBERANDO ACESSO AOS PROGRAMAS DO DATASUS DIRETAMENTE NO FIREWALL
iptables -t nat -A PREROUTING -i $iflocal -d 200.214.44.204 -p tcp --dport 80 -j RETURN
# LIBERANDO ACESSO DO SPARK PARA ACESSOS EXTERNOS
iptables -t nat -A PREROUTING -d novaserranaproxy.no-ip.org -p tcp --dport 5222 -j DNAT --to 192.168.0.10:5222 -m comment --comment "Servidor Jabber"
iptables -t nat -A PREROUTING -d novaserranaproxy.no-ip.org -p udp --dport 5222 -j DNAT --to 192.168.0.10:5222 -m comment --comment "Servidor Jabber"
iptables -t nat -A PREROUTING -d novaserranaproxy.no-ip.org -p tcp --dport 8085 -j DNAT --to 192.168.0.10:8085 -m comment --comment "Servidor JabberWeb"
iptables -t nat -A PREROUTING -d novaserranaproxy.no-ip.org -p udp --dport 8085 -j DNAT --to 192.168.0.10:8085 -m comment --comment "Servidor JabberWeb"
# REDIRECIONANDO TODAS AS OUTRAS REQUISIÃÃES PARA O PROXY SQUID
iptables -t nat -A PREROUTING -i $iflocal -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i $iflocal -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP
}
parar(){
iptables -F
iptables -t nat -F
}
case "$1" in
"start") iniciar ;;
"stop") parar ;;
"restart") parar; iniciar ;;
*) echo "Use os parametros start ou stop"
esac
