kazz
(usa Linux Mint)
Enviado em 29/01/2014 - 15:38h
#Interface de internet
#ifinternet "eth0"
#Configuração de rede WAN
#IP: 192.168.25.12
#Mascara: 255.255.255.0
#Gateway: 192.168.25.1
#DNS: 8.8.8.8; 8.8.4.4
#Interface local
#iflocal "eth1"
#IP: 10.0.0.1
#Mascara: 255.255.255.0
#regras locais samba
iptables -A INPUT -p TCP -s 10.0.0.0/24 -d 0/0 --dport 137:139 -j ACCEPT
iptables -A INPUT -p TCP -s 10.0.0.0/24 -d 0/0 --dport 445 -j ACCEPT
iptables -A INPUT -p UDP -s 10.0.0.0/24 -d 0/0 --dport 137:139 -j ACCEPT
#ssh
iptables -A INPUT -p TCP -s 10.0.0.0/24 -d 0/0 --dport 22 -j ACCEPT
#apache
iptables -A INPUT -p TCP -s 10.0.0.0/24 -d 0/0 --dport 80 -j ACCEPT
#--------
#Roteamento
echo 1 > /proc/sys/net/ipv4/ip_forward
#Habilitar internet
iptables -A POSTROUTING -t nat -s 10.0.0.0/24 -d 0/0 -j MASQUERADE
#Limpar tabelas
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
#Politica padrao de drop
iptables -P INPUT DROP
#iptables -P OUTPUT ACCEPT
#iptables -P FORWARD DROP
# Liberando o Tráfego na Interface loopback
iptables -A INPUT -s 127.0.0.1 -d 0/0 -j ACCEPT
#Liberação de entrada para MACs conhecidos (Estou em duvidas sobre as configurações)
iptables -A INPUT -m mac --mac-source D4:BE:D9:4F:00:13 -j ACCEPT
#LIBERA CONEXOES RELATIVAS
iptables -t filter -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -t filter -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
#Controle de PING com limite de 10 p/s
iptables -A INPUT -s 10.0.0.0/24 -p icmp --icmp-type echo-request -m limit --limit 10/s -j ACCEPT
iptables -A INPUT -s 10.0.0.0/24 -p icmp --icmp-type echo-request -m limit --limit 10/s -j RETURN
#NAT para serviços
#email
iptables -A FORWARD -s 10.0.0.0/24 -p tcp -d 0/0 --dport 25 -j ACCEPT
iptables -A FORWARD -s 10.0.0.0/24 -p tcp -d 0/0 --dport 587 -j ACCEPT
iptables -A FORWARD -s 10.0.0.0/24 -p tcp -d 0/0 --dport 110 -j ACCEPT
iptables -A FORWARD -s 10.0.0.0/24 -p tcp -d 0/0 --dport 143 -j ACCEPT
#ftp
iptables -A FORWARD -s 10.0.0.0/24 -p tcp -d 0/0 --dport 21 -j ACCEPT
#https http
iptables -A FORWARD -s 10.0.0.0/24 -p tcp -d 0/0 --dport 443 -j ACCEPT
iptables -A FORWARD -s 10.0.0.0/24 -p tcp -d 0/0 --dport 80 -j ACCEPT
#telnet
iptables -A FORWARD -s 10.0.0.0/24 -p tcp -d 0/0 --dport 23 -j ACCEPT
#ssh
iptables -A FORWARD -s 10.0.0.0/24 -p tcp -d 0/0 --dport 22 -j ACCEPT