intersowa
(usa Debian)
Enviado em 22/05/2012 - 10:24h
Obrigado pela dica, o problema que sáo muitos ips (mais de 10 mil ips diferente), isso deixa a internet muito lento, desconfio que meu firewall tem alguma falha, porem montei ele apartir de varios artigos que vi aqui no vol, da uma olhada
#!/bin/bash
echo "#################"
echo "Iniciando Firewal"
echo "#################"
#Variaveis
IF_EXTERNA=eth0
#para funcionar if forward
echo 1 > /proc/sys/net/ipv4/ip_forward
#Protecao contra ip spoofing
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
#carregamos modulos
modprobe iptable_nat
modprobe ip_tables
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe iptable_filter
modprobe iptable_mangle
modprobe ip_nat_ftp
modprobe ip_queue
modprobe ipt_LOG
modprobe ipt_MARK
modprobe ipt_limit
modprobe ipt_tcpmss
modprobe ipt_MASQUERADE
modprobe ipt_REDIRECT
modprobe ipt_REJECT
modprobe ipt_limit
modprobe ipt_mac
modprobe ipt_multiport
#Limpamos regras
iptables -F
iptables -X
iptables -t filter -F
iptables -t filter -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
#Bloqueios - Politicas
iptables -P INPUT DROP # entradas
iptables -P OUTPUT DROP # Aceita saidas
iptables -P FORWARD DROP # redirecionamento
iptables -t filter -A INPUT -i lo -j ACCEPT
#####################################################
#Politica para segurar conexao
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
#Compartilhamento de internet
iptables -t nat -A POSTROUTING -j MASQUERADE
iptables -t filter -A INPUT -p icmp -i eth1 -j ACCEPT
#Aceitar conexoes de portas
iptables -t filter -A INPUT -p tcp -i eth1 --dport 1863 -s 10.0.0.0/8 -j ACCEPT
iptables -t filter -A INPUT -p tcp -i eth1 --dport 3128 -s 10.0.0.0/8 -j ACCEPT
iptables -t filter -A INPUT -p tcp -i eth0 --dport 3128 -s 0/0 -j DROP
iptables -t filter -A INPUT -p tcp -i eth1 --dport 443 -s 10.0.0.0/8 -j ACCEPT
#iptables -t filter -A INPUT -p tcp -i eth1 --dport 20 -s 10.0.0.0/8 -j ACCEPT
iptables -t filter -A INPUT -p tcp -i eth1 --dport 21 -s 10.0.0.0/8 -j ACCEPT
#Liberacaoo e Redirecionamento para Terminal Service
iptables -t nat -A PREROUTING -s 0/0 -m tcp -p tcp -i eth0 --dport 3389 -j DNAT --to-destination 10.0.0.50
#acceso SSH
iptables -t filter -A INPUT -p tcp -i eth1 --dport 22 -s 10.0.0.0/8 -j ACCEPT
##Politicas de Segurança
#Bloquear Back Orifice:
iptables -A INPUT -p tcp --dport 31337 -j DROP
iptables -A INPUT -p udp --dport 31337 -j DROP
#Bloquear NetBus
iptables -A INPUT -p tcp --dport 12345:12346 -j DROP
iptables -A INPUT -p udp --dport 12345:12346 -j DROP
#################################################
# POLITICAS DE SEGURANCA AVANCADA
#################################################
# Dropa pacotes TCP indesejaveis
# -------------------------------------------------------
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j LOG --log-level 6 --log-prefix "FW: syn: "
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
# Dropa pacotes mal formados
# -------------------------------------------------------
#iptables -A INPUT -i $IF_EXTERNA -m unclean -j LOG --log-level 6 --log-prefix "FW: pact mal formado: "
#iptables -A INPUT -i $IF_EXTERNA -m unclean -j DROP
# contra trinoo
# -------------------------------------------------------
iptables -N TRINOO
iptables -A TRINOO -m limit --limit 15/m -j LOG --log-level 6 --log-prefix "FW: trinoo: "
iptables -A TRINOO -j DROP
iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 27444 -j TRINOO
iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 27665 -j TRINOO
iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 31335 -j TRINOO
iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 34555 -j TRINOO
iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 35555 -j TRINOO
# contra tronjans
# -------------------------------------------------------
iptables -N TROJAN
iptables -A TROJAN -m limit --limit 15/m -j LOG --log-level 6 --log-prefix "FW: trojan: "
iptables -A TROJAN -j DROP
iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 666 -j TROJAN
iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 666 -j TROJAN
iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 4000 -j TROJAN
iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 6000 -j TROJAN
iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 6006 -j TROJAN
iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 16660 -j TROJAN
# contra worms
# -------------------------------------------------------
iptables -A FORWARD -p tcp --dport 135 -i eth1 -j REJECT
# contra syn-flood
# -------------------------------------------------------
iptables -A FORWARD -p tcp --syn -m limit --limit 2/s -j ACCEPT
# contra ping da morte
# -------------------------------------------------------
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
# contra port scanners
# -------------------------------------------------------
iptables -N SCANNER
iptables -A SCANNER -m limit --limit 15/m -j LOG --log-level 6 --log-prefix "FW: port scanner: "
iptables -A SCANNER -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -i $IF_EXTERNA -j SCANNER
iptables -A INPUT -p tcp --tcp-flags ALL NONE -i $IF_EXTERNA -j SCANNER
iptables -A INPUT -p tcp --tcp-flags ALL ALL -i $IF_EXTERNA -j SCANNER
iptables -A INPUT -p tcp --tcp-flags ALL FIN,SYN -i $IF_EXTERNA -j SCANNER
iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -i $IF_EXTERNA -j SCANNER
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -i $IF_EXTERNA -j SCANNER
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -i $IF_EXTERNA -j SCANNER
# Libera acesso externo a determinadas portas
# -------------------------------------------------------
#iptables -A INPUT -p tcp --dport 22 -i $IF_EXTERNA -j ACCEPT
##Redireciona para squid
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -s 10.0.0.0/8 -j REDIRECT --to-port 3128
#iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 443 -s 10.0.0.0/8 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 8080 -s 10.0.0.0/8 -j REDIRECT --to-port 3128
echo "#############"
echo "FIM DO SCRIPT "
echo "############# "
