Liberar url firewall
1. Liberar url firewall
Beatrix_Kiddo
(usa Outra)
Enviado em 26/02/2014 - 14:47h
Olá!Estou utilizando as regras abaixo e preciso que uma url específica não passe pelo squid. quando adiciono a regra iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o $EXT -j MASQUERADEiptables -I FORWARD -p tcp -s 10.0.0.0/24 -d exemplo.com.br --dport 433 -j ACCEPT ele bloqueia o acesso a rede interna.
Aonde ficaria esta regra?
Ela está conflitando com alguma outra?
#!/bin/sh
EXT=eth1
INT=eth0
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F
iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
####REGRA QUE TENHO DÚVIDA####
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o $EXT -j MASQUERADEiptables -I FORWARD -p tcp -s 10.0.0.0/24 -d exemplo.com.br --dport 433 -j ACCEPT
#####
iptables -t nat -A PREROUTING -i $INT -s 10.0.0.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -i $INT -s 10.0.0.0/24 -p tcp --dport 443 -j REDIRECT --to-port 3128
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 4550 -j ACCEPT
iptables -A INPUT -p tcp --dport 5550 -j ACCEPT
iptables -A INPUT -p tcp --dport 6550 -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -i $INT -p tcp --dport 3128 -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp -m multiport --dports 4550,5550,6550,25,53,110,3128,587,465,143 -j ACCEPT
iptables -A FORWARD -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -p icmp -j ACCEPT