Ping no Servidor Firewall [RESOLVIDO]
1. Ping no Servidor Firewall [RESOLVIDO]
welington27
(usa Debian)
Enviado em 03/05/2013 - 17:38h
Olá pessoal sou novo nesse ramo do firewall gostaria muito que me ajudassem a entender, eu criei um script no meu Iptables e também criei um Squid os dois estão logo abaixo primeiro o squid depois o Iptables não entendo o seguinte qual das regras que lancei impedi que eu possa pingar o meu servidor firewall vocês poderiam me ajudar por favor??? E eu consigo acessar ele via SSH... Só para constar tem duas regras no IPTABLES que se chamam protegendo contra o ping da morte e ignora ping eu tirei as duas mesmo assim não pingou...SQUID
visible_hostname server
http_port 3128 transparent
cache_mem 512 MB
cache_swap_low 90
cache_swap_high 95
maximum_object_size 4096 KB
cache_dir ufs /var/spool/squid 1024 16 256
cache_access_log /var/log/squid/access.log
error_directory /usr/share/squid/errors/pt-br
#-----------------------------------------------------------------------------------------------------
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443 563
acl Safe_ports port 80
acl Safe_ports port 21
acl Safe_ports port 443 563
acl Safe_ports port 70
acl Safe_ports port 210
acl Safe_ports port 1025-65535
acl Safe_ports port 280
acl Safe_ports port 488
acl Safe_ports port 591
acl Safe_ports port 777
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
#------------------------------------------------------------------------------------------------------
acl all src 0.0.0.0/0.0.0.0
acl redelocal src 192.168.1.0/24
#-----------------------------------------------------------------------------------------------------
acl ips_liberados src "/etc/squid/ips_liberados.txt"
http_access allow ips_liberados
#------------------------------------------------------------------------------------------------------
acl bloqueados url_regex -i "/etc/squid/bloqueados.txt"
http_access deny bloqueados
#------------------------------------------------------------------------------------------------------
acl sitesbloqueados dstdomain -i "/etc/squid/sitesbloqueados.txt"
http_access deny sitesbloqueados
#------------------------------------------------------------------------------------------------------
acl gtalk dstdomain chatenabled.mail.google.com
http_access deny gtalk
#--------------------------------------------------------------------------------------------------------
acl ips_bloqueados src "/etc/squid/ips_bloqueados.txt"
http_access deny ips_bloqueados
#------------------------------------------------------------------------------------------------------
http_access allow redelocal
http_access deny all
#####################################################################################################################
FIREWALL IPTABLES
#!/bin/bash
limpar(){
iptables -F
iptables -t nat -F
iptables -P FORWARD ACCEPT
echo 0 > /proc/sys/net/ipv4/ip_forward
}
IFEXT=eth0
IFINT=eth1
case $1 in
stop)
limpar
;;
start)
limpar
iptables -P FORWARD DROP
echo 1 > /proc/sys/net/ipv4/ip_forward
#--------------------------------------------------------------
echo " Bloqueando BackOriffice!!!"
iptables -A OUTPUT -p tcp --dport 1243 -j REJECT
iptables -A OUTPUT -p udp --dport 1243 -j REJECT
iptables -A OUTPUT -p tcp --dport 5800 -j REJECT
iptables -A OUTPUT -p tcp --dport 5801 -j REJECT
iptables -A OUTPUT -p tcp --dport 5900 -j REJECT
iptables -A OUTPUT -p tcp --dport 5901 -j REJECT
iptables -A OUTPUT -p tcp --dport 31337 -j REJECT
iptables -A OUTPUT -p tcp --dport 31338 -j REJECT
iptables -A OUTPUT -p tcp --dport 6000 -j REJECT
iptables -A OUTPUT -p tcp --dport 64320 -j REJECT
iptables -A OUTPUT -p udp --dport 64320 -j REJECT
iptables -A OUTPUT -p tcp --dport 26000 -j REJECT
iptables -A OUTPUT -p tcp --dport 8010 -j REJECT
iptables -A OUTPUT -p tcp --dport 6000 -j REJECT
iptables -A OUTPUT -p tcp --dport 6001 -j REJECT
iptables -A OUTPUT -p udp --dport 6001 -j REJECT
iptables -A OUTPUT -p tcp --dport 3306 -j REJECT
iptables -A OUTPUT -p udp --dport 161 -j REJECT
iptables -A OUTPUT -p udp --dport 111 -j REJECT
iptables -A OUTPUT -p tcp --dport 111 -j REJECT
iptables -A OUTPUT -p udp --dport 162 -j REJECT
iptables -A OUTPUT -p udp --dport 23 -j REJECT
iptables -A OUTPUT -p tcp --dport 111 -j REJECT
iptables -A OUTPUT -p tcp --dport 143 -j REJECT
echo "OH !!"
iptables -A OUTPUT -p tcp -o $IFEXT --dport 137 -j DROP
iptables -A OUTPUT -p udp -o $IFEXT --dport 137 -j DROP
iptables -A OUTPUT -p tcp -o $IFEXT --dport 138 -j DROP
iptables -A OUTPUT -p udp -o $IFEXT --dport 138 -j DROP
iptables -A OUTPUT -p udp -o $IFEXT --dport 139 -j DROP
iptables -A OUTPUT -p tcp -o $IFEXT --dport 139 -j DROP
iptables -A OUTPUT -p tcp -o $IFEXT --dport 445 -j DROP
iptables -A OUTPUT -p udp -o $IFEXT --dport 445 -j DROP
iptables -A OUTPUT -p tcp -o $IFEXT --dport 1512 -j DROP
iptables -A OUTPUT -p udp -o $IFEXT --dport 1512 -j DROP
iptables -A INPUT -p tcp -i $IFEXT --dport 6000 -j DROP
iptables -A INPUT -p udp -i $IFEXT --dport 6000 -j DROP
iptables -A INPUT -p tcp -i $IFEXT --dport 137 -j DROP
iptables -A INPUT -p udp -i $IFEXT --dport 137 -j DROP
iptables -A INPUT -p tcp -i $IFEXT --dport 138 -j DROP
iptables -A INPUT -p udp -i $IFEXT --dport 138 -j DROP
iptables -A INPUT -p udp -i $IFEXT --dport 139 -j DROP
iptables -A INPUT -p tcp -i $IFEXT --dport 139 -j DROP
iptables -A INPUT -p tcp -i $IFEXT --dport 445 -j DROP
iptables -A INPUT -p udp -i $IFEXT --dport 445 -j DROP
iptables -A INPUT -p tcp -i $IFEXT --dport 1512 -j DROP
iptables -A INPUT -p udp -i $IFEXT --dport 1512 -j DROP
echo "OK :-) "
#--------------------------------------------------------------
echo "Bloqueando Pacotes TCP Mal Formados"
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state INVALID -j DROP
echo "OK :-) "
#--------------------------------------------------------------
echo "Verifica Pacotes fragmentados na Rede"
iptables -A VALID_CHECK -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags ALL SYN,ACK,FIN,URG -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags ALL ALL -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags ALL FIN -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags ALL NONE -j DROP
echo "OK :-) "
#-----------------------------------------------------------------
echo "Protegendo contra Ping da Morte"
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
iptables -A INPUT -p icmp -j DROP
echo "OK :-) "
#----------------------------------------------------------------
echo "Protecao Contra ataque DOS"
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -p tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
echo "OK :-) "
#--------------------------------------------------------------
echo "Liberando SMTP !!! "
iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport 25 -j ACCEPT
echo "OK :-)"
#----------------------------------------------------------------
echo "Proxy 3128"
iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport 3128 -j ACCEPT
echo "OK :-)"
#----------------------------------------------------------------
echo "Liberando DNS !!! "
iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -s 0/0 -d 0/0 --dport 53 -j ACCEPT
echo "OK :-)"
#---------------------------------------------------------------
echo "Bloqueando Bate papo Gmail!!! "
iptables -I INPUT -s chatenabled.mail.google.com -j DROP
iptables -A OUTPUT -d chatenabled.mail.google.com -j DROP
iptables -I FORWARD -s 0/0 -d chatenabled.mail.google.com -j DROP
echo "OK :-) "
#-----------------------------------------------------------------
echo "Liberando HTTPD !!! "
iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport 8000 -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport 8080 -j ACCEPT
echo "OK :-)"
#-----------------------------------------------------------------
echo "Liberando POP3 !!! "
iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport 110 -j ACCEPT
echo "OK :-)"
#------------------------------------------------------------------
echo "Liberando WEB MAIL !!! "
iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport 143 -j ACCEPT
iptables -A INPUT -p udp -s 0/0 -d 0/0 --dport 143 -j ACCEPT
echo "OK :-)"
#-----------------------------------------------------------------
echo "Bloqueando SUNRPC !!! "
iptables -A INPUT -p tcp -s 0/0 -d 0/0 --dport 111 -j REJECT
echo "OK :-)"
#-------------------------------------------------------------------
#Libera a interface de loopback(localhost)
iptables -A INPUT -i lo -j ACCEPT
#Protege contra IP spoofing:
echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter
#Bloqueia as portas UDP de 0 a 1023:
iptables -A INPUT -p udp --dport 0:1023 -j DROP
#Ignora pings:
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
# Libera porta SSH
iptables -A INPUT -p tcp --destination-port 22 -j ACCEPT
#Libera IPs da diretoria para nao passar pelo Squid
#Suporte
iptables -t nat -I PREROUTING -s 192.168.1.108 -j ACCEPT
iptables -t nat -I POSTROUTING -s 192.168.1.108 -o eth0 -j MASQUERADE
iptables -I FORWARD -s 192.168.1.108 -j ACCEPT
#Libera Squid
iptables -A INPUT -i eth0 -p tcp --dport 3128 -j ACCEPT
#--------------------------------------------------------------------
echo "firewall executado as: $(date +%R:%F)" >> /root/nat.log
;;
*)
echo " Use: $(basename $0) {start|stop}"
;;
esac