Rotear internet Eth1 p/ Eth0

rubens_web
(usa Debian)

Enviado em 27/07/2012 - 15:10h

Salve galera do VOL!

Help...
Configurações já realizadas:
eth0 = local
eth1 = internet
- Servidor já conectando (teste PING EXTERNO) OK
- DHCP operando na rede interna (teste PC na rede, recebe IP do servidor) OK
- PC na rede recebe IP mas não navega

Segue firewall.sh


# description: Start or stop the Webmin server
#
### BEGIN INIT INFO
# Provides: webmin
# Required-Start: $network $syslog
# Required-Stop: $network
# Default-Start: 2 3 5
# Default-Stop: 0 1 6
# Description: Start or stop the Webmin server
### END INIT INFO

#! /bin/bash

#Variaveis
ifaceExt="eth1"; #acesso internet (offboard)
ifaceInt="eth0"; #acesso local (rede interna) (onboard)
LAN="192.168.1.0/24"; #rede local

#Carrega modulos
/sbin/modprobe ip_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_queue
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_nat
/sbin/modprobe iptable_mangle
/sbin/modprobe ipt_state
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_multiport
/sbin/modprobe ipt_mac
/sbin/modprobe ipt_string
/sbin/modprobe ipt_MASQUERADE

start(){
echo "Firewall iniciado ...................... [OK]";
#limpa as regras
iptables -F
iptables -X
iptables -Z
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z

#Politica padrao INPUT=DROP | OUTUPT=ACCEPT | FORWARD=DROP
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

#########################
#Bloquei ping externo para o servidor (ICMP)
iptables -A INPUT -i $ifaceExt -p icmp --icmp-type 8 -j DROP


#########################
#LIBERANDO PORTAS
#
#Libera porta ssh
iptables -A INPUT -p tcp --dport 22 -i $ifaceInt -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -i $ifaceExt -j ACCEPT

#Libera porta ftp
iptables -A INPUT -p tcp --dport 21 -i $ifaceInt -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -i $ifaceExt -j ACCEPT

#Libera porta (HTTP)
iptables -A INPUT -s $LAN -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -s $LAN -p udp --dport 80 -j ACCEPT

#Libera porta (DNS)
iptables -A INPUT -s $LAN -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s $LAN -p udp --dport 53 -j ACCEPT

#Libera porta (SQUID)
iptables -A INPUT -s $LAN -p tcp --dport 3128 -j ACCEPT

#Libera portas (SAMBA)
iptables -A INPUT -s $LAN -p tcp --dport 139 -j ACCEPT
iptables -A INPUT -s $LAN -p udp --dport 139 -j ACCEPT

######################
#Permite pacotes transmitidos atraves da interface de loopback (localhost)
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i $ifaceInt -j ACCEPT
iptables -A INPUT -i $ifaceExt -j ACCEPT

######################
#Compartilha a conexao disponivel na interface de internet
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s $LAN -o $ifaceExt -j MASQUERADE
echo "Compartilhamento de rede ativo";

#######################
#Permitindo e filtrando conexao estabelecidas
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -s $LAN -o $ifaceExt -j ACCEPT

#######################
#Direciona trafego para squid
iptables -t nat -A PREROUTING -i $ifaceInt -p tcp --dport 80 -j REDIRECT --to-port 3128
echo "Trafego direcionado para SQUID";

echo "Firewall ativado! ...................... [OK]";
}

stop(){
#limpa as regras
iptables -F
iptables -X
iptables -Z
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z

#Politica padrao
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

#Compartilha a conexao disponivel na interface de internet
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s $LAN -o $ifaceExt -j MASQUERADE
echo "Compartilhamento de rede ativo";

#Permitindo e filtrando conexao estabelecidas
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -s $LAN -o $ifaceExt -j ACCEPT

#Proxy squid
iptables -t nat -A PREROUTING -i $ifaceInt -p tcp --dport 80 -j REDIRECT --to-port 3128

echo "Firewall desativado! ................... [OK]";
}

case "$1" in
"start") start ;;
"stop") stop ;;
"reload") stop; start ;;
*)
echo "Use parametros start|stop|reload" ;;

esac