NegroZED
(usa Ubuntu)
Enviado em 13/02/2012 - 13:02h
Cara não funcionou!
Segue meu IPT
#!/bin/bash
# Shell Script - Firewall
#-------------------------
# Definicao das Variaveis
#-------------------------
IPT=/sbin/iptables
REDE=192.168.0.0/24
REXT=eth0
RINT=eth1
#------------------------
# Carregando modulos IPT
#------------------------
module[0]="iptable_filter"
module[1]="iptable_nat"
module[2]="iptable_mangle"
for ((n=0;$n<=2;n++)); do
if [ "`lsmod | grep ${module[$n]}`" = "" ]; then
/sbin/modprobe ${module[$n]}
echo "Modulo ${module[$n]} carregado."
fi
done
. /lib/lsb/init-functions
#------------------
# Removendo Regras
#------------------
$IPT -F
$IPT -t nat -F
$IPT -t mangle -F
#-----------------
# Apagando Chains
#-----------------
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X
#--------------------
# Zerando contadores
#--------------------
$IPT -Z
$IPT -t nat -Z
$IPT -t mangle -Z
#--------------
# Mascaramento
#--------------
$IPT -t nat -A POSTROUTING -o $REXT -j MASQUERADE
#-----------------------------------
# Ativa redirecionamento de pacotes
#-----------------------------------
echo 1 > /proc/sys/net/ipv4/ip_forward
do_start () {
#-----------------
# Politica Padrao
#-----------------
$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
# Protecoes
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /icmp_echo_ignore_broadcasts
echo 1 > /icmp_ignore_bogus_error_responses
echo 0 > /accept_redirects
echo 0 > /accept_source_route
echo 1 > /log_martians
echo 1 > /rp_filter
#------------------------------------------------
# Habilitando o fluxo interno entre os processos
#------------------------------------------------
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -i $RINT -p tcp -s $REDE --sport 80 -j ACCEPT
$IPT -A INPUT -i $RINT -p tcp -s $REDE --dport 80 -j ACCEPT
$IPT -A INPUT -i $RINT -p tcp -s $REDE --dport 3128 -j ACCEPT
$IPT -A INPUT -i $RINT -p tcp -s $REDE --sport 3128 -j ACCEPT
#-----------------
# Liberar Outlook
#-----------------
#// DNS-1 //#
$IPT -A FORWARD -p udp -s 192.168.0.0/24 -d 200.204.0.10 --dport 53 -j ACCEPT
$IPT -A FORWARD -p udp -s 200.204.0.10 --sport 53 -d 192.168.0.0/24 -j ACCEPT
#// DNS-2 //#
$IPT -A FORWARD -p udp -s 192.168.0.0/24 -d 200.204.0.138 --dport 53 -j ACCEPT
$IPT -A FORWARD -p udp -s 200.204.0.138 --sport 53 -d 192.168.0.0/24 -j ACCEPT
$IPT -A FORWARD -p TCP -s 192.168.0.0/24 --dport 25 -j ACCEPT
$IPT -A FORWARD -p TCP -s 192.168.0.0/24 --dport 110 -j ACCEPT
$IPT -A FORWARD -p TCP -s 192.168.0.0/24 --dport 587 -j ACCEPT
$IPT -A FORWARD -p tcp --sport 25 -j ACCEPT
$IPT -A FORWARD -p tcp --sport 110 -j ACCEPT
$IPT -A FORWARD -p tcp --sport 587 -j ACCEPT
#------------------------
# Bloqueia MSN e Hotmail
#------------------------
$IPT -A FORWARD -i $RINT -p tcp --dport 1863 -j REJECT
$IPT -A FORWARD -i $RINT -d loginnet.passport.com -j REJECT
$IPT -t filter -A INPUT -i $RINT -p icmp -j DROP
$IPT -t filter -A INPUT -i $REXT -p icmp -j DROP
#-------------------------------------
# Redirecionamento para o Squid Proxy
#-------------------------------------
$IPT -t nat -A PREROUTING -i $RINT -p tcp --dport 80 -j REDIRECT --to-port 3128
}
do_stop () {
# Política
$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
}
case "$1" in
start)
log_daemon_msg "Starting Firewall iptables"
do_start
log_end_msg $?
;;
stop)
log_daemon_msg "Stopping Firewall iptables"
do_stop
log_end_msg $?
;;
reload)
log_action_begin_msg "Reloading Firewall configuration..."
echo "Reloading Firewall configuration rules."
do_start
log_action_end_msg $?
;;
*)
log_success_msg "Reloading Firewall configuration"
exit 1
esac
exit 0
