Redirecionamento de Portas IPTABLES/SQUID

jorgenaut
(usa Outra)

Enviado em 26/07/2012 - 01:37h

Ola Pessoal,

Estou tendo dificuldades em realizar o redirecionamento de portas com o iptables para liberar acesso remoto a cameras DVR, segue meu cenário:

Servidor Proxy Fedora
DLINK 500B
Windows Server 2003
DVR INTELBRAS
DynDNS

Ja fiz a liberacao das portas que quero (37777 E 8080) no modem e configurei o Virtual Server pro IP Externo do meu servidor 192.168.254.x

Tambem habilitei a configuracao no meu DVR para usar as portas mencionadas e configurei o DynDNS nele

Ja consigo acesso externo ao meu DLINK, agora só falta o iptables redirecionar pra porta do DVR, mas tá difícil. Se alguém puder me auxiliar serei grato

IP do DVR na rede interna: 10.0.0.45
IP EXTERNO do servidor 192.168.254.x

tentei fazer a seguinte regra pra redirecionar as portas:

iptables -t nat -A PREROUTING -p tcp --dport 8080 -i eth2 -j DNAT --to 10.0.0.45:8080
iptables -A FORWARD -p tcp --dport 8080 -i eth2 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp --dport 37777 -i eth2 -j DNAT --to 10.0.0.45:37777
iptables -A FORWARD -p tcp --dport 37777 -i eth2 -j ACCEPT

eth2 = conexão do router com o servidor

só que quando reinicio o iptables ele dá erro nessas linhas, o que pode estar errado?
será que alguém pode me ajudar??

Segue meu iptables:

# Generated by iptables-save v1.4.9 on Tue Feb 15 17:14:53 2011
*nat

:PREROUTING ACCEPT [101:5974]
:OUTPUT ACCEPT [11:660]OC
:POSTROUTING ACCEPT [0:0]

#iptables
#-t nat -A PREROUTING -d 186.202.11.83 -j RETURN
#-t nat -I PREROUTING -s 186.202.11.83 -p tcp --dport 80 -j RETURN

#-A FORWARD -p udp -s 10.0.0.0/24 -d 10.0.0.101 --dport 53 -j ACCEPT
#-A FOTWARD -p udp -s 10.0.0.101 --sport 53 -d 10.0.0.0/24 -j ACCEPT
#-A FORWARD -p tcp -s 10.0.0.0/24 --dport 25 -j ACCEPT
#-A FORWARD -p tcp --sport 25 -j ACCEPT
#-A FORWARD -p tcp --sport 110 -j ACCEPT
#-t nat -A POSTROUTING -j MASQUERADE

#cameras

-t nat -A PREROUTING -p tcp --dport 8080 -i eth2 -j DNAT --to 10.0.0.45:8080
-A FORWARD -p tcp --dport 8080 -i eth2 -j ACCEPT
-t nat -A PREROUTING -p tcp --dport 37777 -i eth2 -j DNAT --to 10.0.0.45:37777
-A FORWARD -p tcp --dport 37777 -i eth2 -j ACCEPT

#servidores
-A PREROUTING -i eth3 -p tcp --dport 3389 -s 10.0.0.101 -j ACCEPT
-A PREROUTING -i eth3 -p tcp --dport 2020 -s 10.0.0.106 -j ACCEPT


#maquinas
-A PREROUTING -i eth3 -p tcp -s 10.0.0.0/24 -d 200.199.34.0/24 -j ACCEPT
-A PREROUTING -i eth3 -p tcp -s 10.0.0.0/24 -d 200.186.251.0/24 -j ACCEPT
-A PREROUTING -i eth3 -p tcp -s 10.0.0.0/24 -d 200.178.87.0/24 -j ACCEPT
-A PREROUTING -i eth3 -p tcp -s 10.0.0.0/24 -d 200.182.57.0/24 -j ACCEPT
-A PREROUTING -i eth3 -p tcp -m tcp --dport 80 -m mark --mark 0x64 -j DNAT --to-destination :3128
-A PREROUTING -i eth3 -p tcp -m tcp --dport 443 -m mark --mark 0x65 -j DNAT --to-destination :3128
-A POSTROUTING -o eth2 -j MASQUERADE
COMMIT

# Completed on Tue Feb 15 17:14:53 2011
# Generated by iptables-save v1.4.9 on Tue Feb 15 17:14:53 2011
*mangle

:PREROUTING ACCEPT [952:111571]
:INPUT ACCEPT [929:107677]
:FORWARD ACCEPT [11:3047]
:OUTPUT ACCEPT [1068:277074]
:POSTROUTING ACCEPT [1091:280968]
-A PREROUTING -i eth3 -p tcp -m tcp --dport 80 -j MARK --set-xmark 0x64/0xffffffff
-A PREROUTING -i eth3 -p tcp -m tcp --dport 443 -j MARK --set-xmark 0x65/0xffffffff
-A FORWARD -d 3.0.0.15/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -d 10.0.0.117 -p tcp -m tcp --dport 80 -j ACCEPT
COMMIT

# Completed on Tue Feb 15 17:14:53 2011
# Generated by iptables-save v1.4.9 on Tue Feb 15 17:14:53 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [106:42351]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth3 -j ACCEPT
-A INPUT -i eth2 -j ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -p tcp --dport 25 -j ACCEPT
-A FORWARD -p tcp --dport 110 -j ACCEPT
-A FORWARD -p tcp --dport 53 -j ACCEPT
-A FORWARD -p udp --dport 53 -j ACCEPT

#-A FORWARD -s 10.0.0.0/24 -d www.fipe.com.br -j ACCEPT
-A INPUT -i eth3 -p tcp -m state --state NEW -m tcp --dport 3128 -m mark --mark 0x64 -j ACCEPT
-A INPUT -i eth3 -p tcp -m state --state NEW -m tcp --dport 3128 -m mark --mark 0x65 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 137 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 138 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 137 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 138 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 139 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 445 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 465 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -p tcp -m tcp --dport 53 -j ACCEPT
-A FORWARD -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -d 200.186.251.0/24 -j ACCEPT
-A FORWARD -d 200.178.87.0/24 -j ACCEPT
-A FORWARD -d 200.199.34.0/24 -j ACCEPT
-A FORWARD -d 200.170.143.0/24 -j ACCEPT
-A FORWARD -d www.caixa.gov.br -j ACCEPT
-A FORWARD -d 200.201.174.0/24 -j ACCEPT
-A FORWARD -d 200.201.173.0/24 -j ACCEPT
-A FORWARD -d 200.182.57.0/24 -j ACCEPT
-A FORWARD -d 141.189.251.43 -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -d www.fipe.com.br -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -i eth3 -j ACCEPT
-A FORWARD -i eth2 -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A FORWARD -s 10.0.0.12 -j ACCEPT
-A FORWARD -o eth2 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Tue Feb 15 17:14:53 2011