deuz
(usa Debian)
Enviado em 31/01/2012 - 20:11h
opa agora: squid e firewall
Squid.conf
http_port 3128 transparent
visible_hostname router
# Configuraçs de cache, dono, logs, errors
cache_effective_user squid
cache_effective_group squid
cache_mem 700 MB
cache_dir diskd /etc/squid/cache/1 1999 128 512 Q1=64 Q2=72
cache_access_log /var/log/squid/access.log
cache_log /etc/squid/logs/cache.log
cache_store_log /etc/squid/logs/store.log
error_directory /usr/share/squid/errors/Portuguese
# Atualizaç do cache
hierarchy_stoplist cgi-bin ?
acl QUERY urlpath_regex cgi-bin \?
no_cache deny QUERY
auth_param basic children 5
auth_param basic realm Internet Security Pisa
auth_param basic credentialsttl 1 hours
auth_param basic casesensitive off
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 21 80 443 563 70 210 280 488 59 777 901 1025-65535
acl purge method PURGE
acl CONNECT method CONNECT
# ---- Cache do Windows Update ----
refresh_pattern windowsupdate.com/.*\.(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern download.microsoft.com/.*\.(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern
www.microsoft.com/.*\.(cab|exe|dll|msi) 10080 100% 43200 reload-into-ims
refresh_pattern au.download.windowsupdate.com/.*\.(cab|exe|dll|msi) 4320 100% 43200 reload-into-ims
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
acl redelocal src 192.168.1.0/24
acl nodown url_regex -i "/etc/squid/nodown"
http_access deny nodown
#Libera msn para os IP's inseridos no arquivo msn
acl IPLIBERAR src 192.168.1.248 192.168.1.253 192.168.1.49 192.168.1.33 192.168.1.97 192.168.1.96 192.168.1.22 192.168.1.2 192.168.1.199
http_access allow IPLIBERAR
acl libera url_regex "/etc/squid/libera"
http_access allow libera all
acl proibidos url_regex -i "/etc/squid/proibidos"
http_access deny proibidos all
acl site dstdomain
www.santander.com.br https://wwwss.bradesco.com.br/scripts/ib2k1.dll/LOGIN
always_direct allow site
http_access allow localhost
http_access allow redelocal
http_access deny all
script de firewall
#/bin/sh
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/etc/init.
echo -n "LIMPANDO TUDO........................."
INTERNET="eth0"
REDE_INTERNA="eth1"
## PORTA PARA INPUT E OUTPUT DE SERVIÃS ( liberadas )
TCP_PORT="443,80,3128,20,21,1863,33434,25,110,6088,2631,5900,4899,1449"
UDP_PORT="80,443,53,25,110,60712"
VNC="5900"
RADMIN="4899"
EMULE_TCP="6088"
EMULE_UDP="60712"
#CAIXA_PORT="2631"
#VPN="1723"
## CONECTIVIDADE SOCIAL
#BANCO_BRASIL=200.200.200.200
#BANCO_CENTRAL=200.200.200.201
CAIXA_01="200.201.174.204"
CAIXA_02="200.201.174.207"
# fazer NAT de forma que haja compartilhamento na conexao
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
### utlizado nas opçs que geram log.
modprobe ipt_LOG
modprobe ipt_REJECT
modprobe ipt_MASQUERADE
### Zerar regras
iptables -F
iptables -X
iptables -F -t nat
iptables -X -t nat
iptables -F -t mangle
iptables -X -t mangle
iptables -t filter -P INPUT DROP
iptables -t filter -P OUTPUT DROP
iptables -t filter -P FORWARD DROP
echo "[OK]"
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
# ACESSO REMOTO VIA WTS
iptables -t nat -A PREROUTING -p tcp -s 0/0 --dport 3389 -i eth0 -j DNAT --to 192.168.1.253
iptables -t nat -A PREROUTING -p udp -s 0/0 --dport 3389 -i eth1 -j DNAT --to 192.168.1.253
echo "ACESSO VIA WTS LIBERADO [OK]"
echo -n
#### Filtros - DROP nos pacotes TCP indesejáis
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j LOG --log-level 6 --log-prefix "FIREWALL: NEW sem syn: "
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
#### ACCEPT (libera) pacotes de retorno da internet
iptables -A INPUT -i ! $INTERNET -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
### Permitir conexãvinda da minha rede interna:" que vem de dentro e quer sair" via vnc, ssh (putty), vpn
iptables -A INPUT -p tcp -s 0/0 -m multiport --dport $TCP_PORT -j ACCEPT
iptables -A OUTPUT -p tcp -d 0/0 -m multiport --sport $TCP_PORT -j ACCEPT
iptables -A INPUT -p udp -s 0/0 -m multiport --dport $UDP_PORT -j ACCEPT
iptables -A OUTPUT -p udp -d 0/0 -m multiport --sport $UDP_PORT -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A FORWARD -p icmp -j ACCEPT
echo "[OK]"
echo -n "NAT INTERNO..........................."
echo -n "CONECTIVIDADE SOCIAL.................."
iptables -t nat -A PREROUTING -i $REDE_INTERNA -p tcp -m multiport --dport 80,443 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -d 0.0.0.0/0 -j ACCEPT
### NAT para a rede interna " liberar internet para rede interna"
iptables -t nat -A POSTROUTING -o $INTERNET -j MASQUERADE
### Ativando o Roteamento
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "[OK]"
echo "FIREWALL CARREGADO"
