marcelohcm
(usa Ubuntu)
Enviado em 09/11/2012 - 14:41h
eu ja usei essa regra, mas não bloqueou.... onde eu colocaria essa regra dentro do iptables???
segue meu iptables:
IPTABLES='/sbin/iptables'
ALL=0.0.0.0/0
INT_EXT=eth3
INT_INT=eth1
INT_IFV2=eth2
IP_INT=XXX.XXX.XXX.XXX
IP_EXT=XXX.XXX.XXX.XXX
REDE_INT=XXX.XXX.XXX.XXX/XX
INFOVIA_2=XXX.XXX.XXX.XXX/XX
SSH=22
ADMIN=XXX.XXX.XXX.XXX
DNS_NET=XXX.XXX.XXX.XXX
DNS_NET=XXX.XXX.XXX.XXX
BACURAU=XXX.XXX.XXX.XX
case "$1" in
start)
echo -n "Iniciando o Firewall "
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A FORWARD -d 0/0 -s 200.20.194.3 -j ACCEPT
iptables -A FORWARD -d 200.20.194.3 -s 0/0 -j ACCEPT
iptables -A FORWARD -d 0/0 -s 200.20.194.4 -j ACCEPT
iptables -A FORWARD -d 200.20.194.4 -s 0/0 -j ACCEPT
iptables -A FORWARD -d 0/0 -s 200.20.194.5 -j ACCEPT
iptables -A FORWARD -d 200.20.194.5 -s 0/0 -j ACCEPT
iptables -A FORWARD -d 200.20.194.7 -s 0/0 -j ACCEPT
iptables -A FORWARD -d 0/0 -s 200.20.194.7 -j ACCEPT
iptables -A FORWARD -d 200.20.194.9 -s 0/0 -j ACCEPT
iptables -A FORWARD -d 0/0 -s 200.20.194.9 -j ACCEPT
iptables -A FORWARD -d 192.168.100.146 -s 0/0 -j ACCEPT
iptables -A FORWARD -d 0/0 -s 192.168.100.146 -j ACCEPT
iptables -A OUTPUT -o $INT_EXT -s $IP_EXT -p tcp --sport 1024:65535 --dport 443 -j ACCEPT
iptables -A INPUT -i $INT_EXT -d $IP_EXT -p tcp --dport 1024:65535 --sport 443 -j ACCEPT
iptables -t nat -I PREROUTING -s 0/0 -d $IP_EXT -j DNAT --to 200.20.194.8
iptables -t nat -I POSTROUTING -d 0/0 -s 200.20.194.8 -j SNAT --to $IP_EXT
iptables -t filter -I FORWARD -d $IP_EXT -j ACCEPT
iptables -t filter -I FORWARD -s $IP_EXT -j ACCEPT
iptables -A INPUT -p tcp --dport 3128 -i eth1 -j ACCEPT
iptables -A INPUT -p udp --dport 3128 -i eth1 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -i eth1 -j ACCEPT
iptables -A INPUT -p udp --dport 80 -i eth1 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -i eth1 -j ACCEPT
iptables -A INPUT -p udp --dport 3000 -i eth1 -j ACCEPT
iptables -t nat -A PREROUTING -m iprange --src-range 200.20.194.12-200.20.194.255 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -m iprange --src-range 200.20.194.12-200.20.194.255 -p udp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -m iprange --src-range 192.168.100.2-192.168.103.254 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -m iprange --src-range 192.168.100.2-192.168.103.254 -p udp --dport 80 -j REDIRECT --to-ports 3128
iptables -A INPUT -p tcp --dport 1863 -j DROP
iptables -A INPUT -p UDP --sport 68 --dport 67 -j ACCEPT
iptables -A OUTPUT -p UDP --sport 67 --dport 68 -j ACCEPT
iptables -A FORWARD -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -i $INT_INT -p tcp -s $REDE_INT --sport 1024:65535 -o $INT_EXT -d $BACURAU --dport 3306 -j ACCEPT
iptables -A FORWARD -i $INT_EXT -p tcp -s $BACURAU --sport 3306 -o $INT_INT -d $REDE_INT --dport 1024:65535 -j ACCEPT
for x in `cat /etc/firewall/ftpsite.frw`; do
iptables -A FORWARD -i $INT_INT -p tcp -s `echo $x | cut -d':' -f1` --sport 1024:65535 -o $INT_EXT -d `echo $x | cut -d':' -f2` --dport 20:21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $INT_EXT -p tcp -s `echo $x | cut -d':' -f2` --sport 20:21 -o $INT_INT -d `echo $x | cut -d':' -f1` --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
done
iptables -t nat -A POSTROUTING -s $REDE_INT -o $INT_EXT -j MASQUERADE
iptables -t nat -A POSTROUTING -s $INFOVIA_2 -o $INT_EXT -j MASQUERADE
echo ". Feito"
;;
aberto)
echo -n "Abrindo o firewall . . ."
iptables -F
iptables -Z
iptables -t nat -F
iptables -t nat -Z
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
echo "Feito"
;;
stop)
echo -n "Parando o firewall . . ."
iptables -F
iptables -Z
iptables -t nat -F
iptables -t nat -Z
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
echo "Feito"
;;
restart)
/etc/firewall/firewall.sh stop
sleep 2
/etc/firewall/firewall.sh start
;;
*)
echo "Use firewall {start|stop|restart|aberto}"
;;
esac
