firewall!

cecesar
(usa Gentoo)

Enviado em 05/12/2007 - 12:01h

Olá, acho q houve um certo erro da minha parte em relação a minha duvida, então vou refaze-la.
Preciso saber oq cada linha de um respectivo firewall significa, ou como ele funciona.
Vou lhes mostrar o farewall:

#!/bin/sh

net='eth0'
lan='192.168.0.0/24'
conect='200.0.0.0/24'

iptables -F
iptables -X
iptables -t nat -F

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s $lan -o $net -j MASQUERADE

# Conectividade Social

iptables -t nat -I PREROUTING -p tcp -d 200.201.0.0/16 -j ACCEPT
iptables -t nat -I PREROUTING -p tcp -d 200.223.0.0 -j ACCEPT
iptables -I FORWARD -p tcp -d 200.201.0.0/16 -j ACCEPT
iptables -I FORWARD -p tcp -d 200.223.0.0 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -s $lan --dport 80 -d $conect -j ACCEPT

# Bloqueio do MSN

iptables -A FORWARD -s $lan -p tcp --dport 1863 -j REJECT
iptables -A FORWARD -s $lan -d loginnet.passport.com -j REJECT

# MSN liberado
iptables -A FORWARD -s 192.168.0.9/24 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.0.9/24 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.0.14/24 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.0.14/24 -d loginnet.passport.com -j ACCEPT


# Liberando portas

iptables -A INPUT -p tcp --destination-port 80 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 4000 -j ACCEPT
iptables -A INPUT -p udp --destination-port 4000 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 21 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 22 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 8181 -j ACCEPT
iptables -A INPUT -p udp --destination-port 8181 -j ACCEPT
iptables -A INPUT -p udp --destination-port 3389 -j ACCEPT

# Acesso externo

# Servidores
iptables -t nat -A PREROUTING -s 0/0 -m tcp -p tcp -i eth0 --dport 123 -j DNAT --to 192.168.0.2:3389
#iptables -t nat -A PREROUTING -s 0/0 -m tcp -p tcp -i eth0 --dport 207 -j DNAT --to 192.6.1.207:3389

# Acesso ext. Ingrid
iptables -t nat -A PREROUTING -s 0/0 -m tcp -p tcp -i eth0 --dport 1234 -j DNAT --to 192.168.0.9:3389

# Acesso cpu-bauru
iptables -t nat -A PREROUTING -s 0/0 -m tcp -p tcp -i eth0 --dport 1111 -j DNAT --to 192.168.0.11:3389

# Proxy transparente
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128