firewall dando erro

22nato
(usa Debian)

Enviado em 25/12/2012 - 21:57h

#!/bin/bash
#########################################################################
# #
# Funç do Script: #
# Versã 1.0 .1 #
# #
#########################################################################
EXT=eth1
INT=eth0
IP=172.16.0.0/16
IP2=192.168.30.0/23
IP3=192.168.10.0/24
IP5=192.168.20.0/24
IP6=192.168.40.0/24
IP7=192.168.35.0/24
IP9=192.168.60.0/22
ALL=0.0.0.0/0.0.0.0

#CARREGANDO MODULOS
/sbin/modprobe iptable_nat
/sbin/modprobe ip_tables
/sbin/modprobe ipt_state
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ipt_multiport
/sbin/modprobe ip_nat_ftp
/sbin/modprobe iptable_mangle
/sbin/modprobe ipt_tos
/sbin/modprobe ipt_limit
/sbin/modprobe iptable_filter
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe ipt_LOG

#Habilitando o roteamento e bloqueando alguns de pacotes
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all

# Zera regras
iptables -F
iptables -X
iptables -F -t nat
iptables -X -t nat
iptables -F -t mangle
iptables -X -t mangle

# Determina a políca padrã
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

# Liberacao do Loopback
iptables -A INPUT -i lo -j ACCEPT

#########################################################
# Gerar Log's - Interfaces

iptables -t nat -I PREROUTING -i eth0 -d 0.0.0.0/0.0.0.0 -p tcp -j LOG --log-prefix="FIREWALL-"
iptables -t nat -I PREROUTING -i eth0 -d 0.0.0.0/0.0.0.0 -p udp -j LOG --log-prefix="FIREWALL-"

##########################################################
# Bloqueio de Pacotes Maliciosos

# Aceita os pacotes que realmente devem entrar

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT

# 1 - Protecao contra Trinoo
iptables -N TRINOO
iptables -A TRINOO -m limit --limit 1/s -j LOG --log-level 6 --log-prefix "FIREWALL(Prot. Trinoo): "
iptables -A TRINOO -j DROP
iptables -A INPUT -p tcp -i eth0 --dport 27444 -j TRINOO
iptables -A INPUT -p tcp -i eth0 --dport 27665 -j TRINOO
iptables -A INPUT -p tcp -i eth0 --dport 31335 -j TRINOO
iptables -A INPUT -p tcp -i eth0 --dport 34555 -j TRINOO
iptables -A INPUT -p tcp -i eth0 --dport 35555 -j TRINOO
#echo "ativado o bloqueio a tentativa de ataque do tipo Trinoo"
#echo "ON .................................................[ OK ]"

# bloqueando Tracertroute

iptables -A INPUT -p udp -s 0/0 -i $INT --dport 33435:33525 -j DROP

#Protecao contra Port Scanners
iptables -N SCANNER
iptables -A SCANNER -m limit --limit 1/s -j LOG --log-level 6 --log-prefix "FIREWALL(Port Scanner): "
iptables -A SCANNER -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -i eth0 -j SCANNER
iptables -A INPUT -p tcp --tcp-flags ALL NONE -i eth0 -j SCANNER
iptables -A INPUT -p tcp --tcp-flags ALL ALL -i eth0 -j SCANNER
iptables -A INPUT -p tcp --tcp-flags ALL FIN,SYN -i eth0 -j SCANNER
iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -i eth0 -j SCANNER
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -i eth0 -j SCANNER
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -i eth0 -j SCANNER
iptables -A INPUT -p udp -s 0/0 -i eth0 --dport 33435:33525 -j REJECT
iptables -A INPUT -m state --state INVALID -j REJECT
#echo "ativado o bloqueio a tentativa de ataque do tipo Scanners"
#echo "ON .................................................[ OK ]"

# Protecao contra worms
iptables -A FORWARD -p tcp --dport 135 -i $INT -j REJECT

# Protecao contra syn-flood
iptables -A FORWARD -p tcp --syn -m limit --limit 2/s -j ACCEPT

# Protecao contra ping da morte
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

# Protecao contra port scanners

iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

# Liberar Envio e recebimento de e-mail (Master Brasil) - Outlook

iptables -I POSTROUTING -j MASQUERADE -t nat -p tcp --dport 993
iptables -I POSTROUTING -j MASQUERADE -t nat -p udp --dport 993
iptables -I POSTROUTING -j MASQUERADE -t nat -p tcp --dport 110
iptables -I POSTROUTING -j MASQUERADE -t nat -p udp --dport 110
iptables -I POSTROUTING -j MASQUERADE -t nat -p tcp --dport 25
iptables -I POSTROUTING -j MASQUERADE -t nat -p udp --dport 25
iptables -I POSTROUTING -j MASQUERADE -t nat -p tcp --dport 53
iptables -I POSTROUTING -j MASQUERADE -t nat -p udp --dport 53
iptables -I POSTROUTING -J MASQUERADE -t nat -p tcp --dport 995
iptables -I POSTROUTING -J MASQUERADE -t nat -p udp --dport 995
iptables -I POSTROUTING -J MASQUERADE -t nat -p udp --dport 80

############################################################################################

# Libera Conexao SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 9999 -j ACCEPT
iptables -A INPUT -p tcp --dport 7071 -j ACCEPT

############################################################################################

# Ativa mascaramento de saida
iptables -t filter -A INPUT -i lo -j ACCEPT

# IP BLOQUEADOS
iptables -I INPUT -s 195.138.66.157 -j DROP
iptables -I INPUT -s 69.162.120.234 -j DROP
iptables -I INPUT -s 69.162.126.194 -j DROP
iptables -I INPUT -s 109.230.251.32 -j DROP
iptables -I INPUT -s 83.167.123.83 -j DROP
iptables -I INPUT -s 81.88.214.108 -j DROP
iptables -I INPUT -s 65.55.80.234 -j DROP
iptables -I INPUT -s 65.55.57.251 -j DROP
iptables -I INPUT -s 93.152.176.25 -j DROP
iptables -I INPUT -s 182.18.179.22 -j DROP

# BLOQUEA O QUE NAO SE ENCAIXA NAS REGRAS ACIMA
iptables -A INPUT -p tcp --syn -j DROP
iptables -P FORWARD DROP
#echo firewall fucionando

meu firewall esta dando esse erro nao consigo achar a linha que esta com o erro alguem por favor poderia me ajudar
obrigado segue o erro abaixo
iptables v1.4.2: Unknown arg `(null)'
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.4.2: Unknown arg `(null)'
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.4.2: Unknown arg `(null)'
Try `iptables -h' or 'iptables --help' for more information.

saitam
(usa Slackware)

Enviado em 25/12/2012 - 22:08h

seu script de firewall esta desorganizado. Recomendo que faça uma leitura no conceito de firewall e como aplicar regras iptables, ao final veja o script em shell que pode ser utilizado adaptando com sua rede.
Segue:
http://mundodacomputacaointegral.blogspot.com.br/2012/05/entendendo-o-funcionamento-de-um.html

22nato
(usa Debian)

Enviado em 25/12/2012 - 23:50h

resolvido era o parâmetro de regra do de saída de email. obrigado pela resposta.