leoandreotti
(usa Debian)
Enviado em 19/08/2009 - 13:05h
Pessoal, esse é o firewall que tenho implementado(que herdei da antiga administração)e como ainda estou iniciando o uso de iptables estou com essa dúvida.
#Limpar as regras existentes nas CHAINS
iptables -F
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -X
iptables -P FORWARD DROP
#Carrega os modulos
modprobe ip_tables
modprobe ip_gre
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
#Libera loopback
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i ! lo -s 127.0.0.0/8 -j DROP
#Bloqueia acesso direto da rede interna ao modem
#iptables -A FORWARD -s 150.0.1.0/24 -d 192.168.1.5/30 -j DROP
#=========================================================
# Determinando permissoes de trafego
#=========================================================
#Liberar Hotmail no MS Outlook / Outlook Express
iptables -A FORWARD -d services.msn.com -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d services.msn.com -p tcp --sport 80 -j ACCEPT
iptables -A FORWARD -d services.msn.com -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d services.msn.com -p tcp --sport 443 -j ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -p tcp --dport 44405 -j ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -p udp --dport 55557 -j ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -p tcp --dport 55970 -j ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -p tcp --dport 55971 -j ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -p tcp --dport 55960 -j ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -p tcp --dport 55961 -j ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -p tcp --dport 55962 -j ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -p tcp --dport 55557 -j ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -p tcp --dport 55901 -j ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -p tcp --dport 8090 -j ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -p tcp --dport 8083 -j ACCEPT
# VPN
#iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
#iptables -A INPUT -p gre -j ACCEPT
#iptables -A OUTPUT -p tcp --dport 1723 -j ACCEPT
#iptables -A OUTPUT -p gre -j ACCEPT
# FTP
#Primeiro vamos liberar a saída da nova conexão para o servidor de FTP na porta 21:
iptables -A FORWARD -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#Agora vamos liberar a resposta do servidor para o cliente:
iptables -A FORWARD -p tcp --sport 21 -m state --state ESTABLISHED,RELATED -j ACCEPT
#Para o FTP ATIVO temos que liberar a conexão que o servidor abre para o cliente,
#porém liberar novas conexões de entrada é considerado inseguro,
#então o Connection Tracking consegue identificar que essa conexão
#é relacionada a conexão na porta 21 que já foi feita anteriormente,
#então não precisamos liberar o estado NEW:
iptables -A FORWARD -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
#e a saída de retorno:
iptables -A FORWARD -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
#Para o FTP PASSIVO temos que liberar conexões de uma porta alta para outra porta alta,
#porém com o Connection Tracking também permitiremos que estas conexões sejam estabelecidas
#somente se forem relacionadas a outra conexão feita anteriormente:
iptables -A FORWARD -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
# Permissao de acesso SSH ao servidor
iptables -A INPUT -p tcp -s 150.0.1.0/24 --dport 22 -j ACCEPT
# Permissao de acesso ao prosoft
iptables -A INPUT -p tcp --dport 114 -j ACCEPT
# acesso cameras de segurança
#iptables -A FORWARD -p tcp --dport 1159 -j ACCEPT
#iptables -A FORWARD -p tcp --sport 1259 -j ACCEPT
#iptables -A FORWARD -p tcp --dport 10010 -j ACCEPT
#iptables -A FORWARD -p tcp --sport 10010 -j ACCEPT
# udp
#iptables -A FORWARD -p udp --dport 1159 -j ACCEPT
#iptables -A FORWARD -p tcp --sport 1259 -j ACCEPT
# Area Restrita da Elancers
iptables -A FORWARD -p tcp --dport 444 -d
www.elancers.net -j ACCEPT
iptables -A FORWARD -p tcp --sport 444 -s
www.elancers.net -j ACCEPT
# SMTP
iptables -A FORWARD -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp --sport 25 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp --dport 465 -j ACCEPT #gmail
iptables -A FORWARD -p tcp --sport 465 -j ACCEPT #gmail
iptables -A FORWARD -p tcp --dport 587 -j ACCEPT #gmail
iptables -A FORWARD -p tcp --sport 587 -j ACCEPT #gmail
#IMAP
iptables -A FORWARD -p tcp --dport 993 -j ACCEPT #gmail
iptables -A FORWARD -p tcp --sport 993 -j ACCEPT #gmail
iptables -A FORWARD -p udp --dport 993 -j ACCEPT #gmail
iptables -A FORWARD -p udp --sport 993 -j ACCEPT #gmail
# POP3
iptables -A FORWARD -p tcp --dport 110 -j ACCEPT
iptables -A FORWARD -p tcp --sport 110 -j ACCEPT
iptables -A FORWARD -p tcp --dport 995 -j ACCEPT #gmail
iptables -A FORWARD -p tcp --sport 995 -j ACCEPT #gmail
# DNS
#iptables -A OUTPUT -p tcp -d 150.0.1.0 --dport 53 -j ACCEPT
#iptables -A INPUT -p tcp -s 150.0.1.0 --dport 53 -j ACCEPT
#iptables -A OUTPUT -p udp -d 150.0.1.0 --dport 53 -j ACCEPT
#iptables -A INPUT -p udp -s 150.0.1.0 --dport 53 -j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp --sport 80 -j ACCEPT
iptables -A FORWARD -p tcp --dport 8083 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 8083 -j ACCEPT
iptables -A FORWARD -p tcp --sport 8083 -j ACCEPT
iptables -A FORWARD -p tcp --dport 1433 -j ACCEPT
iptables -A FORWARD -p tcp --sport 1433 -j ACCEPT
iptables -A FORWARD -p tcp --dport 443 -j ACCEPT # Https
iptables -A FORWARD -p tcp --sport 443 -j ACCEPT # Https
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 8083 -j ACCEPT
#iptables -A INPUT -p tcp --dport 81 -j ACCEPT # cameras de segurança
#iptables -A FORWARD -p tcp --dport 5017 -j ACCEPT #CAT Previdencia
#iptables -A FORWARD -p tcp --dport 2004 -j ACCEPT #SICOV - Financeiro
iptables -A FORWARD -p tcp --dport 2631 -j ACCEPT #con. social
iptables -A FORWARD -p tcp --sport 2631 -j ACCEPT #con. social
#iptables -A FORWARD -p tcp --dport 3007 -j ACCEPT #RAIS Caixa
iptables -A FORWARD -p tcp --dport 3456 -j ACCEPT #Receitanet
iptables -A FORWARD -p tcp --sport 3456 -j ACCEPT #Receitanet
iptables -A INPUT -p tcp -s 150.0.1.0/24 --dport 10000 -j ACCEPT #webmin
iptables -A INPUT -p tcp -s 150.0.1.0/24 --dport 9040 -j ACCEPT #acessonegado
iptables -A FORWARD -p tcp --dport 81 -j ACCEPT #Terra - manutencao de Logs
#iptables -A FORWARD -p tcp --dport 1702 -j ACCEPT #Cameras de segurança
iptables -A FORWARD -p tcp --dport 36257 -j ACCEPT #SPOT - Gyn
iptables -A FORWARD -p tcp --sport 36257 -j ACCEPT #SPOT - Gyn
iptables -A FORWARD -p udp --dport 500 -j ACCEPT #VPN - Ambev
iptables -A FORWARD -p udp --sport 500 -j ACCEPT #VPN - Ambev
iptables -A FORWARD -p udp --dport 4500 -j ACCEPT #VPN - Ambev
iptables -A FORWARD -p udp --sport 4500 -j ACCEPT #VPN - Ambev
iptables -A FORWARD -p udp --dport 10000 -j ACCEPT #VPN - Ambev
iptables -A FORWARD -p tcp --dport 10000 -j ACCEPT #VPN - Ambev
iptables -A FORWARD -p tcp --sport 10000 -j ACCEPT #VPN - Ambev
iptables -A FORWARD -p tcp --dport 143 -j ACCEPT #IMAP
iptables -A FORWARD -p tcp --sport 143 -j ACCEPT #IMAP
iptables -A FORWARD -p tcp --dport 22 -j ACCEPT #SSH - Backup
iptables -A FORWARD -p tcp --sport 22 -j ACCEPT #SSH - Backup
iptables -A FORWARD -p tcp --dport 114 -j ACCEPT #SSH - Backup
iptables -A FORWARD -p tcp --sport 114 -j ACCEPT #SSH - Backup
#Protecao contra Ping da morte
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -j DROP
#echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
#Protecao contra SYN-FLOODS
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
#Protecao contra Scanners
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
#Protecao contra pacotes danificados
iptables -A FORWARD -m unclean -j DROP
# Protecao contra acessos a enderecos nao permitidos na interface 1 - Anti Spoofing
iptables -A INPUT -s 10.0.0.0/8 -i eth1 -j DROP
iptables -A INPUT -s 72.16.0.0/16 -i eth1 -j DROP
iptables -A INPUT -s 192.168.0.0/24 -i eth1 -j DROP
iptables -A INPUT -s 150.0.1.0/24 -i eth1 -j DROP
# Bloqueia as demais portas
iptables -A FORWARD -p tcp --syn -j DROP
iptables -A INPUT -p tcp --syn -j DROP
iptables -A OUTPUT -p tcp --syn -j DROP
#Cria o compartilhamento da internet
iptables -t nat -A POSTROUTING -j MASQUERADE
# Bloqueio de sites e servicos nao autorizados
/usr/local/bin/blacklist
/usr/local/bin/msn2
