ajuda no script do mestre sr.pelo
1. ajuda no script do mestre sr.pelo
apileofshit
(usa Slackware)
Enviado em 11/03/2009 - 22:44h
siguente, o script me atendeu mto, bem, minha ideia era trava todas portas td td td e ir liberando aos poucos, pois bem, ele fez, libero e tal unico problema q tive e to tendo e libera outlook ja fiz inumeras tentativas e nao libera, nem pinga pra fora so pra dentro, ja liberei as portas 25 e 110 de td quante jeito, ate que envia, envia as vezes, mais recebe nao vem mesmo!uso squid, ja fiz com ele e parei ele nao deu, se bem q ele trabalha da 80 e 3128 nao tem nd ve com 25 e 110, mais fiz e nada agora quando eu paro o firewall vai normal segue abaixo o firewall do pelo andre ajuda ai!
#!/bin/bash
#
# /etc/rc.d/rc.firewall
#
# Start/stop/restart Firewall
#
# To make Firewall start automatically at boot, make this
# file executable: chmod 755 /etc/rc.d/rc.firewall
#
# Variáveris #
LanExt=10.1.10.2
LanInt=10.1.1.3
Rede=10.1.1.0/24
# Modulos #
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state
/sbin/modprobe ipt_REDIRECT
/sbin/modprobe ipt_owner
/sbin/modprobe ipt_REJECT
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
####################
### Função START ###
####################
firewall_start() {
echo "Iniciando o Firewall"
# Limpa as regras #
iptables -X
iptables -Z
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F -t nat
iptables -F -t mangle
# Politicas padrao #
iptables -t filter -P INPUT DROP
iptables -t filter -P OUTPUT ACCEPT
iptables -t filter -P FORWARD DROP
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
# Manter conexoes jah estabelecidas para nao parar
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Aceita todo o trafego vindo do loopback e indo pro loopback
iptables -t filter -A INPUT -i lo -j ACCEPT
#######################
### LOG DO FIREWALL ###
#######################
#iptables -A INPUT -d $LanExt -p tcp --dport 22 -j LOG --log-level 6 --log-prefix "FIREWALL: SSH EXT 22"
#iptables -A INPUT -d $LanExt -p tcp --dport 21 -j LOG --log-level 6 --log-prefix "FIREWALL: FTP EXT 21"
#iptables -A INPUT -d $LanInt -p tcp --dport 22 -j LOG --log-level 6 --log-prefix "FIREWALL: SSH INT 22"
#iptables -A INPUT -d $LanInt -p tcp --dport 21 -j LOG --log-level 6 --log-prefix "FIREWALL: FTP INT 21"
###############################
# Proteções #
###############################
# Protege contra os "Ping of Death"
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 20/m -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 20/m -j ACCEPT
# Protege contra port scanners avançados (Ex.: nmap)
iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 20/m -j ACCEPT
# Bloqueando tracertroute
iptables -A INPUT -p udp -s 0/0 -i eth0 --dport 33435:33525 -j REJECT
# Protecoes contra ataques
iptables -A INPUT -m state --state INVALID -j REJECT
###############################
# TABELA Input #
###############################
### Destino Externo ###
# Liberando Porta 22 (SSH)
#iptables -A INPUT -d $LanExt -p tcp --dport 22 -j LOG --log-level 6 --log-prefix "FIREWALL: SSH EXT 2222"
iptables -A INPUT -d $LanExt -p tcp --dport 2222 -j ACCEPT
# Liberando Porta 25 (email)
iptables -A INPUT -d $LanExt -p tcp --dport 25 -j ACCEPT
iptables -A OUTPUT -d $LanExt -p tcp --sport 25 -j ACCEPT
iptables -A FORWARD -d $LanExt -p tcp --sport 25 -j ACCEPT
iptables -A FORWARD -d $LanExt -p tcp --dport 25 -j ACCEPT
# Liberando Porta 110 (Email)
iptables -A INPUT -d $LanExt -p tcp --dport 110 -j ACCEPT
iptables -A OUTPUT -d $LanExt -p tcp --sport 110 -j ACCEPT
iptables -A FORWARD -d $LanExt -p tcp --sport 110 -j ACCEPT
iptables -A FORWARD -d $LanExt -p tcp --dport 110 -j ACCEPT
# Liberando porta 53 (DNS)
iptables -A FORWARD -p udp -s 10.1.1.0/24 -d 10.1.1.3 --dport 53 -j ACCEPT
iptables -A FORWARD -p udp -s 10.1.1.3 --sport 53 -d 10.1.1.0/24 -j ACCEPT
iptables -A FORWARD -p udp -s 10.1.10.0/24 -d 10.1.1.3 --dport 53 -j ACCEPT
iptables -A FORWARD -p udp -s 10.1.1.3 --sport 53 -d 10.1.10.0/24 -j ACCEPT
### Destino Interno ###
# Liberando Porta 22 (SSH)
iptables -A INPUT -d $LanInt -p tcp --dport 2222 -j ACCEPT
# Liberando porta 3128 (Squid)
iptables -A INPUT -d $LanInt -p tcp --dport 3128 -j ACCEPT
# Liberando Porta 80 (http)
iptables -A INPUT -d $LanInt -p tcp --dport 80 -j ACCEPT
# Liberando porta 53
iptables -A INPUT -d $LanInt -p tcp --dport 53 -j ACCEPT
# Liberando Porta 25 (email)
#iptables -A INPUT -d $LanInt -p tcp --dport 21 -j LOG --log-level 6 --log-prefix "FIREWALL: FTP INT 21"
iptables -A INPUT -d $LanInt -p tcp --dport 25 -j ACCEPT
iptables -A OUTPUT -d $LanInt -p tcp --sport 25 -j ACCEPT
iptables -A FORWARD -p tcp --sport 25 -j ACCEPT
iptables -A FORWARD -p tcp --dport 25 -j ACCEPT
# Liberando Porta 110 (email)
iptables -A INPUT -d $LanInt -p tcp --dport 110 -j ACCEPT
iptables -A OUTPUT -d $LanInt -p tcp --sport 110 -j ACCEPT
iptables -A FORWARD -p tcp --sport 110 -j ACCEPT
iptables -A FORWARD -p tcp --dport 110 -j ACCEPT
# Liberando porta 3000 (NTOP)
iptables -A INPUT -d $LanInt -p tcp --dport 3000 -j ACCEPT
###############################
# TABELA Forward #
###############################
# Libera computador das regras do firewall
iptables -A FORWARD -s 10.1.1.112 -p tcp -j ACCEPT
iptables -A FORWARD -s 10.1.1.112 -p udp -j ACCEPT
iptables -A INPUT -p tcp -d 10.1.1.112 -s 0/0 -j ACCEPT
iptables -A OUTPUT -p tcp -s 0/0 -d 10.1.1.112 -j ACCEPT
### MSN ###
# Libera msn para o IP #
# nome
#iptables -A FORWARD -s 192.168.4.11 -p tcp --dport 1863 -j ACCEPT
# Bloqueio de MSN #
iptables -A FORWARD -s 10.1.1.0 -p tcp --dport 1863 -j DROP
#iptables -A FORWARD -s 10.1.1.0 -d loginnet.passport.com -j DROP
iptables -A FORWARD -s 10.1.1.0/24 -p tcp --dport 1863 -j DROP
#iptables -A FORWARD -s 10.1.1.0/24 -d loginnet.passport.com -j DROP
#iptables -A FORWARD -s 10.1.1.0/24 -d messenger.hotmail.com -j DROP
#iptables -A FORWARD -s 10.1.1.0/24 -d webmessenger.msn.com -j DROP
#iptables -A FORWARD -p tcp --dport 1080 -j DROP
#iptables -A FORWARD -s 10.1.1.0/24 -p tcp --dport 1080 -j DROP
iptables -A FORWARD -p tcp --dport 1863 -j DROP
#iptables -A FORWARD -d 10.1.1.0/24 -j DROP
# Liberando Porta 2222 (SSH)
iptables -A FORWARD -s $Rede -p tcp --dport 2222 -j ACCEPT
# Liberando Porta 110 (pop-3)
iptables -A FORWARD -s $Rede -p tcp --dport 110 -j ACCEPT
iptables -A INPUT -d $Rede -p tcp --dport 110 -j ACCEPT
iptables -A OUTPUT -d $Rede -p tcp --sport 110 -j ACCEPT
# Liberando Porta 995 (spop-3)
iptables -A FORWARD -s $Rede -p tcp --dport 995 -j ACCEPT
# Liberando Porta 25 (smtp)
iptables -A FORWARD -s $Rede -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -d $Rede -p tcp --dport 25 -j ACCEPT
iptables -A OUTPUT -d $Rede -p tcp --sport 25 -j ACCEPT
# Liberando Porta 465 (smtp-s)
iptables -A FORWARD -s $Rede -p tcp --dport 465 -j ACCEPT
iptables -A INPUT -d $Rede -p tcp --dport 465 -j ACCEPT
iptables -A OUTPUT -d $Rede -p tcp --sport 465 -j ACCEPT
# Liberando Porta 2121 (ftp)
#iptables -A FORWARD -s $Rede -p tcp --dport 2121 -j ACCEPT
# Liberando Porta 21 (ftp)
#iptables -A FORWARD -s $Rede -p udp --dport 21 -j ACCEPT
#iptables -A FORWARD -s $Rede -p udp --dport 20 -j ACCEPT
# Liberando porta 53 (DNS)
iptables -A FORWARD -s $Rede -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -s $Rede -p udp --dport 53 -j ACCEPT
# Liberando porta 37 (Time)
iptables -A FORWARD -s $Rede -p tcp --dport 37 -j ACCEPT
iptables -A FORWARD -s $Rede -p udp --dport 37 -j ACCEPT
# Liberando porta 113 (auth)
iptables -A FORWARD -s $Rede -p tcp --dport 113 -j ACCEPT
iptables -A FORWARD -s $Rede -p udp --dport 113 -j ACCEPT
# Liberando porta 139 (netbios)
iptables -A FORWARD -s $Rede -p tcp --dport 139 -j ACCEPT
iptables -A FORWARD -s $Rede -p udp --dport 139 -j ACCEPT
# Liberando porta 143 (imap)
iptables -A FORWARD -s $Rede -p tcp --dport 143 -j ACCEPT
iptables -A FORWARD -s $Rede -p udp --dport 143 -j ACCEPT
# Liberando porta 445(microsoft-ds)
iptables -A FORWARD -s $Rede -p tcp --dport 445 -j ACCEPT
iptables -A FORWARD -s $Rede -p udp --dport 445 -j ACCEPT
# Liberando porta 631 (cups)
iptables -A FORWARD -s $Rede -p tcp --dport 631 -j ACCEPT
iptables -A FORWARD -s $Rede -p udp --dport 631 -j ACCEPT
# Liberando porta 3128 (squid)
iptables -A FORWARD -s $Rede -p tcp --dport 3128 -j ACCEPT
iptables -A FORWARD -s $Rede -p udp --dport 3128 -j ACCEPT
# Liberando porta 80
iptables -A FORWARD -s $Rede -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s $Rede -p udp --dport 80 -j ACCEPT
iptables -A OUTPUT -s $Rede -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -s $Rede -p tcp --dport 80 -j ACCEPT
# Liberando samba
iptables -A FORWARD -p tcp --dport 137:139 -s 10.1.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 137:139 -s 10.1.1.0/24 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 137:139 -s 10.1.1.0/24 -j ACCEPT
# Regras forward para o funcionamento de redirecionamento de portas (NAT)
# Redirecionando porta 2222 (ssh)
#iptables -A FORWARD -p tcp --dport 5900 -j 2222
#ptables -A FORWARD -p tcp --dport 5800 -j ACCEPT
###############################
######### TABELA NAT ## #######
###############################
# Redireconamento de portas
# (nat para ssh)
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 2222 -j DNAT --to 10.1.1.3:2222
# Mascaramento de rede para acesso externo #
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# Proxy Transparente
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
# Liberando ping int e bloqueando externo
iptables -A INPUT -p icmp -d 10.1.1.0 -s 0/0 -j ACCEPT
iptables -A INPUT -p icmp -i eth0 -s 10.1.1.0 -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
# Liberando outlook
iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 25 -j DNAT --to-destination 10.1.10.2
iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 110 -j DNAT --to-destination 10.1.10.2
iptables -A INPUT -p tcp -s 10.1.1.0/24 --sport 110 -d 0/0 -j ACCEPT
iptables -A FORWARD -p tcp -s 10.1.1.0/24 --sport 110 -d 0/0 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --sport 110 -d 0/0 --dport 110 -j ACCEPT
iptables -A FORWARD -p tcp --sport 110 -d 0/0 --dport 110 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --sport 110 -d 0/0 --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -s 10.1.1.0/24 --sport 110 -d 0/0 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -s 10.1.1.0/24 --sport 25 -d 0/0 -j ACCEPT
iptables -A FORWARD -p tcp -s 10.1.1.0/24 --sport 25 -d 0/0 --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --sport 25 -d 0/0 --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp --sport 25 -d 0/0 --dport 25 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --sport 25 -d 0/0 --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -s 10.1.1.0/24 --sport 25 -d 0/0 --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -d pop.terra.com.br -s 10.1.1.0/24 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -d smtp.terra.com.br -s 10.1.1.0/24 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i eth0 -d 10.1.1.0/24 --dport 25 -j ACCEPT
#Bloqueia todo o resto
#iptables -A INPUT -p tcp -j LOG --log-level 6 --log-prefix "FIREWALL: GERAL "
#iptables -A INPUT -p tcp --syn -j DROP
#iptables -A INPUT -p tcp -j DROP
#iptables -A INPUT -p udp -j DROP
}
##################
### Função STOP ##
##################
firewall_stop() {
echo "Parando firewall e funcionando apenas com mascaramento"
# Limpa as regras #
iptables -X
iptables -Z
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F -t nat
iptables -F -t mangle
# Politicas padrao #
iptables -t filter -P INPUT ACCEPT
iptables -t filter -P OUTPUT ACCEPT
iptables -t filter -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
# Manter conexoes jah estabelecidas para nao parar
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Aceita todo o trafego vindo do loopback e indo pro loopback
iptables -t filter -A INPUT -i lo -j ACCEPT
###############################
# TABELA Forward #
###############################
### MSN ###
# Libera msn para o IP #
# nome
#iptables -A FORWARD -s 192.168.0.34 -p tcp --dport 1863 -j ACCEPT
# nome
#iptables -A FORWARD -s 192.168.0.5 -p tcp --dport 1863 -j ACCEPT
# Bloqueio de MSN #
#iptables -A FORWARD -s 192.168.1.0 -p tcp --dport 1863 -j DROP
#iptables -A FORWARD -s 192.168.1.0 -d loginnet.passport.com -j DROP
#iptables -A FORWARD -s 198.164.1.0/24 -p tcp --dport 1863 -j DROP
#iptables -A FORWARD -s 198.164.1.0/24 -d loginnet.passport.com -j DROP
#iptables -A FORWARD -s 198.164.1.0/24 -d messenger.hotmail.com -j DROP
#iptables -A FORWARD -s 198.164.1.0/24 -d webmessenger.msn.com -j DROP
#iptables -A FORWARD -p tcp --dport 1080 -j DROP
#iptables -A FORWARD -s 198.164.1.0/24 -p tcp --dport 1080 -j DROP
#iptables -A FORWARD -p tcp --dport 1863 -j DROP
#iptables -A FORWARD -d 64.4.13.0/24 -j DROP
###############################
######### TABELA NAT ## #######
###############################
# Mascaramento de rede para acesso externo #
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
echo "Regras Limpas e Firewall desabilitado"
}
firewall_restart() {
echo "Reiniciando Firewall"
firewall_stop
sleep 3
firewall_start
echo "Firewall Reiniciado"
}
case "$1" in
'start')
firewall_start
echo "Firewall Iniciado"
;;
'stop')
firewall_stop
;;
'restart')
firewall_restart
;;
*)
echo "Opções possíveis:"
echo "rc.firewall start"
echo "rc.firewall stop"
echo "rc.firewall restart"
esac
Patrocínio
Site hospedado pelo provedor RedeHost.
Destaques
Artigos
Enviar mensagem ao usuário trabalhando com as opções do php.ini
Meu Fork do Plugin de Integração do CVS para o KDevelop
Compartilhando a tela do Computador no Celular via Deskreen
Como Configurar um Túnel SSH Reverso para Acessar Sua Máquina Local a Partir de uma Máquina Remota
Configuração para desligamento automatizado de Computadores em um Ambiente Comercial
Dicas
Criando uma VPC na AWS via CLI
Multifuncional HP imprime mas não digitaliza
Dica básica para escrever um Artigo.
Como Exibir Imagens Aleatórias no Neofetch para Personalizar seu Terminal
Tópicos
Debian 12 (net inst) instalado Pendrive erro ao inicializar (3)
Agora temos uma assistente virtual no fórum!!! (246)
Top 10 do mês
-
Xerxes
1° lugar - 65.210 pts -
Fábio Berbert de Paula
2° lugar - 50.437 pts -
Buckminster
3° lugar - 18.551 pts -
Mauricio Ferrari
4° lugar - 15.338 pts -
Alberto Federman Neto.
5° lugar - 14.494 pts -
Daniel Lara Souza
6° lugar - 13.464 pts -
Diego Mendes Rodrigues
7° lugar - 13.128 pts -
edps
8° lugar - 11.222 pts -
Alessandro de Oliveira Faria (A.K.A. CABELO)
9° lugar - 10.983 pts -
Andre (pinduvoz)
10° lugar - 10.779 pts
Scripts
A maior comunidade GNU/Linux da América Latina! Artigos, dicas, tutoriais, fórum, scripts e muito mais. Ideal para quem busca auto-ajuda.
Site hospedado por:
