iptables bugado ou eu?
1. iptables bugado ou eu?
Soul_Keeper
(usa Ubuntu)
Enviado em 20/10/2010 - 11:47h
Estou com um probleminha.Não consigo abrir o site www.detran.mt.gov.br
www.bb.com.br
e www1.bunge.com.br!
Meu squid não está bloqueando nada.
Script Iptables:
#!/bin/bash
# Carrega os modulos
modprobe ip_tables
modprobe iptable_nat
iptables -F
iptables -F -t nat
#Compartilhando WAN
echo 1 > /proc/sys/net/ipv4/ip_forward
#--------------------------------------------------------------------#
####### NAT PREROUTING ########
#--------------------------------------------------------------------#
###CONECTIVIDADE SOCIAL CAIXA###
#Server 1
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d 200.201.174.207 -p tcp --dport 80 -j ACCEPT
#Server 2
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d 200.201.174.204 -p tcp --dport 80 -j ACCEPT
###BUNGE###
#Default
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www1.bunge.com.br -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d 200.185.60.59 -p tcp --dport 80 -j ACCEPT
###WINDOWS UPDATE###
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d update.microsoft.com -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.windowsupdate.com -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d download.microsoft.com -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.microsoft.com -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.microsfot.com.br">www.microsfot.com.br -p tcp --dport 80 -j ACCEPT
###SINTEGRA###
#Site
iptables -t nat -A PREROUTING -i tcp -s 192.168.1.0/24 -d www.sintegra.gov.br -p tcp --dport 80 -j ACCEPT
#GO
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.sefaz.go.gov.br -p tcp --dport 80 -j ACCEPT
#MT
iptables -t nat -A PREROUTING -i eht0 -s 192.168.1.0/24 -d www.sefaz.mt.gov.br -p tcp --dport 80 -j ACCEPT
#MS
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www1.sefaz.ms.gov.br -p tcp --dport 80 -j ACCEPT
#TO
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d sintegra.sefaz.to.gov.br -p tcp --dport 80 -j ACCEPT
#DF
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.fazenda.df.gov.br -p tcp --dport 80 -j ACCEPT
#AM
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d online.sefaz.am.gov.br -p tcp --dport 80 -j ACCEPT
#AC
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d sefaznet.ac.gov.br -p tcp --dport 80 -j ACCEPT
#RO
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d portal.intranet.sefin.ro.gov.br -p tcp --dport 80 -j ACCEPT
#PI
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d web.sintegra.sefaz.pi.gov.br -p tcp --dport 80 -j ACCEPT
#RR
iptables -t nat -A PREROUTING -i eht0 -s 192.168.1.0/24 -d www.sefaz.rr.gov.br -p tcp --dport 80 -j ACCEPT
#AP
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d 200.182.29.141 -p tcp --dport 80 -j ACCEPT
#PA
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d app.sefa.pa.gov.br -p tcp --dport 80 -j ACCEPT
#MA
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.sefaz.ma.gov.br -p tcp --dport 80 -j ACCEPT
#CE
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.sefaz.ce.gov.br -p tcp --dport 80 -j ACCEPT
#RN
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.set.rn.gov.br -p tcp --dport 80 -j ACCEPT
#PB
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d saplic.receita.pb.gov.br -p tcp --dport 80 -j ACCEPT
#PE
iptables -t nat -A PREROUTING -i eht0 -s 192.168.1.0/24 -d www.sintegra.sefaz.pe.gov.br -p tcp --dport 80 -j ACCEPT
#AL
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d sintegra.sefaz.al.gov.br -p tcp --dport 80 -j ACCEPT
#SE
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.sefaz.se.gov.br -p tcp --dport 80 -j ACCEPT
#BA
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.sefaz.ba.gov.br -p tcp --dport 80 -j ACCEPT
#MG
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.sintegra.fazenda.mg.gov.br -p tcp --dport 80 -j ACCEPT
#RJ
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.fazenda.rj.gov.br -p tcp --dport 80 -j ACCEPT
#ES
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.sintegra.es.gov.br -p tcp --dport 80 -j ACCEPT
#SP
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d pfeserv1.fazenda.sp.gov.br -p tcp --dport 80 -j ACCEPT
#PR
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.sintegra.fazenda.pr.gov.br -p tcp --dport 80 -j ACCEPT
#SC
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d sistemas3.sef.sc.gov.br -p tcp --dport 80 -j ACCEPT
#RS
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.sefaz.rs.gov.br -p tcp --dport 80 -j ACCEPT
###RECEITANET###
#Default
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.receita.fazenda.gov.br -p tcp --dport 80 -j ACCEPT
###RECEITA FEDERAL###
#Default
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.receita.fazenda.gov.br -p tcp --dport 80 -j ACCEPT
###SEFAZ###
#MT
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.sefaz.mt.gov.br -p tcp --dport 80 -j ACCEPT
###BANCO DO BRASIL
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.bb.com.br -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d aapj.bb.com.br -p tcp --dport 443 -j ACCEPT
###DETRAN###
#MT
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d 201.49.161.124 -p tcp --dport 80 -j ACCEPT
###VIVO GESTOR###
#Default
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d vivogestao.vivo-sp.com.br -p tcp --dport 7003 -j ACCEPT
###VERBANET###
#Default
iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.0/24 -d www.verbanet.com.br -p tcp --dport 80 -j ACCEPT
###MULTCAM###
#Escritório
iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 3550 -j DNAT --to-dest 192.168.1.5:3550
###TERMINAL SERVER###
#Default
iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 3389 -j DNAT --to-dest 192.168.1.3:3389
###OPENFIRE CONTROL PANEL###
#Default
iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 9090 -j DNAT --to-dest 192.168.1.5:9090
###ATMTEC###
#8080
# iptables -t nat -A PREROUTING -i tcp -s 192.168.1.0/24 -d www.atmtec.com.br -p tcp --dport 8080 -j ACCEPT
#3128
# iptables -t nat -A PREROUTING -i tcp -s 192.168.1.0/24 -d www.atmtec.com.br -p tcp --dport 3128 -j ACCEPT
###ECONET EDITORA###
iptables -t nat -A PREROUTING -i tcp -s 192.168.1.0/24 -d www.econeteditora.com.br -p tcp --dport 80 -j ACCEPT
###Banco do Brasil
iptables -t nat -A PREROUTING -i tcp -s 192.168.1.0/24 -d www.bb.com.br -p tcp --dport 80 -j ACCEPT
###PROXY TRANSPARENTE###
iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
#--------------------------------------------------------------------#
####### INPUT ########
#--------------------------------------------------------------------#
###LIBERAÇÃO LOCALHOST E REDE LOCAL###
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --syn -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.0/24 -d 22 -j ACCEPT
###ACEITA CONSULTA DNS DE QUALQUER###
iptables -A INPUT -p udp -i eth0 --sport 1024:65535 --dport domain -j ACCEPT
iptables -A INPUT -p udp -i eth0 --sport domain --dport domain -j ACCEPT
###LIBERA SAIDA SQUID###
iptables -A INPUT -p tcp -s 192.168.1.0/24 --sport 1024:65535 --dport 3128 -j ACCEPT
###FECHA O RESTO###
iptables -A INPUT -p tcp --syn -j DROP
#--------------------------------------------------------------------#
####### FORWARD ########
#--------------------------------------------------------------------#
#--------------------------------------------------------------------#
####### DIRECIONAMENTOS ########
#--------------------------------------------------------------------#
###LIBERA LOCAL HOST###
iptables -A FORWARD -i lo -j ACCEPT
###LIBERA PASSAGEM DA REDE INTERNA###
#iptables -A FORWARD -i eth0 -j ACCEPT
###ACEITA CONSULTA DNS DE QUALQUER###
iptables -A FORWARD -p udp -i eth0 --sport 1024:65535 --dport domain -j ACCEPT
iptables -A FORWARD -p udp -i eth0 --sport domain --dport domain -j ACCEPT
###CONEXÕES ESTABELECIDAS E RELACIONADAS, LIBERADA PARA REDE INTERNA###
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
###SERVIDORES COM SAIDA LIBERADA###
iptables -A FORWARD -s 192.168.1.3 -j ACCEPT
iptables -A FORWARD -s 192.168.1.5 -j ACCEPT
iptables -A FORWARD -s 10.0.0.2 -j ACCEPT
iptables -A FORWARD -s 192.168.1.61 -j ACCEPT
###DIRECIONA TS###
#Default
iptables -A FORWARD -p tcp -i eth1 --dport 3389 -d 192.168.1.3 -j ACCEPT
###DIRECIONA MULTCAM###
#Default
iptables -A FORWARD -p tcp -i eth1 --dport 3550 -d 192.168.1.5 -j ACCEPT
###DIRECIONA OPENFIRE CONTROL PANEL###
#Default
iptables -A FORWARD -p tcp -i eth1 --dport 9090 -d 192.168.1.5 -j ACCEPT
#--------------------------------------------------------------------#
####### PORTAS LIBERADAS ########
#--------------------------------------------------------------------#
#CONECTIVIDADE SOCIAL#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 2631 -j ACCEPT
#DETRAN
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 8084 -j ACCEPT
#ATMTEC#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 8080 -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 3128 -j ACCEPT
#POP#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 110 -j ACCEPT
#SMTP#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 25 -j ACCEPT
#VNC#
iptables -A FORWARD -p tcp -i 192.168.1.0/24 --dport 5500:5550 -j ACCEPT
#CAT#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 5017 -j ACCEPT
#POSWEB#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 3001 -j ACCEPT
#RECEITANET#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 3456 -j ACCEPT
#OUTROS#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 8083 -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 995 -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 28800 -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 28809 -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 8081 -j ACCEPT
#ECONET EDITORA#
#5060#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 5060 -j ACCEPT
#8000#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 8000 -j ACCEPT
#8081#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 8001 -j ACCEPT
#8002#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 8002 -j ACCEPT
#8003#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 8003 -j ACCEPT
#8004
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 8004 -j ACCEPT
#8005#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 8005 -j ACCEPT
#8006#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 8006 -j ACCEPT
#Transmicao Eletronica#
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 8017 -j ACCEPT
#Vivo Gestor
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 7003 -j ACCEPT
#NETWORLD
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 2095 -j ACCEPT
#DEMMS
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 20 -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 21 -j ACCEPT
#--------------------------------------------------------------------#
####### DIRECIONAMENTO SITES ########
#--------------------------------------------------------------------#
###SERVIDORES E SITES LIBERADOS###
#CONECTIVIDADE SOCIAL#
#Server1
iptables -A FORWARD -s 192.168.1.0/24 -d 200.201.174.207 -j ACCEPT
#Server2
iptables -A FORWARD -s 192.168.1.0/24 -d 200.201.174.204 -j ACCEPT
#WINDOWS UPDATE#
iptables -A FORWARD -s 192.168.1.0/24 -d update.microsoft.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -d www.windowsupdate.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -d download.microsoft.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -d www.microsoft.com.br -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -d www.microsfot.com -j ACCEPT
#Mail Transoeste
#Default
iptables -A FORWARD -p tcp -i eth0 -d 173.193.195.10 -j ACCEPT
#ATMTEC#
#Default
iptables -A FORWARD -s 192.168.1.0/24 -d www.atmtec.com.br -j ACCEPT
#POSWEB#
#Default
iptables -A FORWARD -s 192.168.1.0/24 -d gwfc.appi.com.br -j ACCEPT
#SINTEGRA#
#Default
iptables -A FORWARD -s 192.168.1.0/24 -d www.sintegra.gov.br -j ACCEPT
#SEFAZ#
#MT
iptables -A FORWARD -s 192.168.1.0/24 -d www.sefaz.mt.gov.br -j ACCEPT
#RECEITA FEDERAL#
#Default
iptables -A FORWARD -s 192.168.1.0/24 -d www.receita.fazenda.gov.br -j ACCEPT
#ECONET EDITORA#
#Default
iptables -A FORWARD -s 192.168.1.0/24 -d www.econeteditora.com.br -j ACCEPT
#BANCO DO BRASIL#
iptables -A FORWARD -p tcp -i 192.168.1.0/24 -d www.bb.com.br -j ACCEPT
iptables -A FORWARD -p tcp -i 192.168.1.0/24 -d aapj.bb.com.br -j ACCEPT
#MAIL TRANSOESTE#
iptables -A FORWARD -p tcp -i 192.168.1.0/24 -d www.transoeste.com.br -j ACCEPT
#DETRAN#
iptables -A FORWARD -p tcp -i 192.168.1.0/24 -d 201.49.161.124 -j ACCEPT
#VIVO GESTOR#
iptables -A FORWARD -p tcp -i 192.168.1.0/24 -d vivogestao.vivo-sp.com.br -j ACCEPT
#VERBANET#
iptables -A FORWARD -s 192.168.1.0/24 -d www.verbanet.com.br -j ACCEPT
#NETWORLD#
iptables -A FORWARD -s 192.168.1.0/24 -d www.networld.com.br -j ACCEPT
#DEMMS#
iptables -A FORWARD -s 192.168.1.0/24 -d ftp.rondonopolis.mt.gov.br -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -d demms.rondonopolis.mt.gov.br -j ACCEPT
#--------------------------------------------------------------------#
####### ACESSO MSN ########
#--------------------------------------------------------------------#
#Rafael
iptables -A FORWARD -s 192.168.1.221 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.221 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.221 -d login.live.com -j ACCEPT
#Jean
iptables -A FORWARD -s 192.168.1.100 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.100 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.100 -d login.live.com -j ACCEPT
#Niandra
iptables -A FORWARD -s 192.168.1.8 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.8 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.8 -d login.live.com -j ACCEPT
#Junior
iptables -A FORWARD -s 192.168.1.58 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.58 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.58 -d login.live.com -j ACCEPT
#Renato
iptables -A FORWARD -s 192.168.1.25 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.25 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.25 -d login.live.com -j ACCEPT
#Odair
iptables -A FORWARD -s 192.168.1.236 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.236 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.236 -d login.live.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.22 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.22 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.22 -d login.live.com -j ACCEPT
#Bruno
iptables -A FORWARD -s 192.168.1.41 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.41 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.41 -d login.live.com -j ACCEPT
#Gleisson
iptables -A FORWARD -s 192.168.1.65 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.65 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.65 -d login.live.com -j ACCEPT
#Katia
iptables -A FORWARD -s 192.168.1.82 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.82 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.82 -d login.live.com -j ACCEPT
#Marcio
iptables -A FORWARD -s 192.168.1.177 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.177 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.177 -d login.live.com -j ACCEPT
#Rosangela
iptables -A FORWARD -s 192.168.1.84 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.84 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.84 -d login.live.com -j ACCEPT
#Heitor
iptables -A FORWARD -s 192.168.1.54 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.54 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.54 -d login.live.com -j ACCEPT
#Marcos
iptables -A FORWARD -s 192.168.1.68 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.68 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.68 -d login.live.com -j ACCEPT
#Rodrigo Casa
iptables -A FORWARD -s 192.168.1.6 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.6 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.6 -d login.live.com -j ACCEPT
#Nilton
iptables -A FORWARD -s 192.168.1.195 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.195 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.196 -d login.live.com -j ACCEPT
#Evandro
iptables -A FORWARD -s 192.168.1.50 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.50 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.50 -d login.live.com -j ACCEPT
#Jeverson
iptables -A FORWARD -s 192.168.1.70 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.70 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.70 -d login.live.com -j ACCEPT
#Dalva
iptables -A FORWARD -s 192.168.1.30 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.30 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.30 -d login.live.com -j ACCEPT
#Rubens
iptables -A FORWARD -s 192.168.1.79 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.79 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.79 -d login.live.com -j ACCEPT
#Alysson
iptables -A FORWARD -s 192.168.1.33 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.33 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.33 -d login.live.com -j ACCEPT
#Marcelo
iptables -A FORWARD -s 192.168.1.42 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.42 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.42 -d login.live.com -j ACCEPT
#Marcela
iptables -A FORWARD -s 192.168.1.17 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.17 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.17 -d login.live.com -j ACCEPT
#Boiadeiro
iptables -A FORWARD -s 192.168.1.75 -p tcp --dport 1863 -j ACCEPT
iptables -A FORWARD -s 192.168.1.75 -d loginnet.passport.com -j ACCEPT
iptables -A FORWARD -s 192.168.1.75 -d login.live.com -j ACCEPT
#--------------------------------------------------------------------#
####### BLOQUEIOS ########
#--------------------------------------------------------------------#
###APPS###
#IMO.IM
iptables -A FORWARD -p tcp -m tcp -d imo.im -j REJECT
#Bloqueia MSN na porta 443
iptables -A FORWARD -p tcp -i eth0 --dport 443 -d login.live.com -j REJECT
iptables -A FORWARD -p tcp -i eth0 --dport 443 -d loginnet.passport.com -j REJECT
#Aceita passagem da rede interna para porta 443
iptables -A FORWARD -p tcp -i eth0 --dport 443 -j ACCEPT
#Fecha o resto
iptables -A FORWARD -j LOG
iptables -A FORWARD -j DROP
#--------------------------------------------------------------------#
####### OUTPUT ########
#--------------------------------------------------------------------#
#Deixa loopback livre
iptables -A OUTPUT -j ACCEPT
#--------------------------------------------------------------------#
####### NAT POSTROUTING ########
#--------------------------------------------------------------------#
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
#FIM de Aquivo