pankdo
(usa Debian)
Enviado em 22/04/2008 - 15:44h
#!/bin/bash
echo "Configurando Variáveis..."
# Localização do comando iptables
IPTABLES=/sbin/iptables
# Localização do comando ip
IP=/sbin/ip
# Interface Externa 1 - pankdo 600Kbps
NET_EXT_INT0=eth4
# IP snt 01
NET_EXT_IP0=xxx.xxx.xxx.xxx
# Default Gateway pankdo
NET_EXT_GW0=xxx.xxx.xxx.xxx
NET_EXT_NET0=xxx.xxx.xxx.xxx
# Subnet externa
NET_EXT_SUB0=xx
# Interface externa 2 - pankdo 1000Kbps
NET_EXT_INT1=eth5
# IP snt 02
NET_EXT_IP1=xxx.xxx.xxx.xxx
# Default Gateway pankdo
NET_EXT_GW1=xxx.xxx.xxx.xxx
NET_EXT_NET1=xxx.xxx.xxx.xxx
# Subnet interna
NET_EXT_SUB1=xx
# Interface interna
NET_INT_INT3=eth0
# IP interno
NET_INT_IP3=xxx.xxx.xxx.xxx
# Subnet interna
NET_INT_SUB3=xx
# Rede interna
NET_INT_NET3=xxx.xxx.xxx.xxx
echo "Limpando as tabelas..."
$IPTABLES -F
$IPTABLES -F -t nat
$IPTABLES -F -t mangle
$IPTABLES -X -t nat
$IPTABLES -X -t mangle
$IPTABLES -X
echo "Configurando tabela Mangle para eth4..."
$IPTABLES -t mangle -N ETH4
$IPTABLES -t mangle -F ETH4
$IPTABLES -t mangle -A ETH4 -p tcp -j LOG --log-prefix MANGLE_TCP_ETH4 #debug
$IPTABLES -t mangle -A ETH4 -p icmp -j LOG --log-prefix MANGLE_ICMP_ETH4 #debug
$IPTABLES -t mangle -A ETH4 -j MARK --set-mark 1
echo "Configurando tabela Mangle para eth5..."
$IPTABLES -t mangle -N ETH5
$IPTABLES -t mangle -F ETH5
$IPTABLES -t mangle -A ETH5 -p tcp -j LOG --log-prefix MANGLE_TCP_ETH5 #debug
$IPTABLES -t mangle -A ETH5 -p icmp -j LOG --log-prefix MANGLE_ICMP_ETH5 #debug
$IPTABLES -t mangle -A ETH5 -j MARK --set-mark 2
echo "Configurando tabela Nat para eth4..."
$IPTABLES -t nat -N SPOOF_ETH4
$IPTABLES -t nat -F SPOOF_ETH4
$IPTABLES -t nat -A SPOOF_ETH4 -j LOG --log-prefix SPOOF_ETH4
$IPTABLES -t nat -A SPOOF_ETH4 -j SNAT --to ${NET_EXT_IP0}
echo "Configurando tabela Nat para eth5..."
$IPTABLES -t nat -N SPOOF_ETH5
$IPTABLES -t nat -F SPOOF_ETH5
$IPTABLES -t nat -A SPOOF_ETH5 -j LOG --log-prefix SPOOF_ETH5
$IPTABLES -t nat -A SPOOF_ETH5 -j SNAT --to ${NET_EXT_IP1}
echo "Permitindo ping..."
$IPTABLES -A INPUT -p icmp -s ${NET_INT_NET3}/${NET_INT_SUB3} -d ${NET_INT_IP3} -j ACCEPT
$IPTABLES -A INPUT -p icmp -s ${NET_EXT_NET0}/${NET_EXT_SUB0} -d ${NET_EXT_IP0} -j ACCEPT
$IPTABLES -A INPUT -p icmp -s ${NET_EXT_NET1}/${NET_EXT_SUB1} -d ${NET_EXT_IP1} -j ACCEPT
echo "Configurando regras de Mangle para eth4..."
$IP ru add from ${NET_EXT_IP0} lookup 1
$IP ro add table 10 default via ${NET_EXT_GW0} dev ${NET_EXT_INT0}
$IP ru add fwmark 1 table 10
$IP ro fl ca
echo "Configurando regras de Mangle para eth5..."
$IP ru add from ${NET_EXT_IP1} lookup 2
$IP ro add table 20 default via ${NET_EXT_GW1} dev ${NET_EXT_INT1}
$IP ru add fwmark 2 table 20
$IP ro fl ca
echo "Configurando regras de spoofing..."
$IPTABLES -t nat -A POSTROUTING -o ${NET_EXT_INT0} -j SPOOF_ETH4
$IPTABLES -t nat -A POSTROUTING -o ${NET_EXT_INT1} -j SPOOF_ETH5
#removendo rota anterior pankdo
echo "removendo rota default anterior..."
ip ro del default
echo "Adicionando rota default..."
ip route add xxx.xxx.xxx.xxx dev eth1 src xxx.xxx.xxx.xxx
ip route add xxx.xxx.xxx.xxx dev eth4 src xxx.xxx.xxx.xxx
ip route add xxx.xxx.xxx.xxx dev eth5 src xxx.xxx.xxx.xxx
ip route add default scope global nexthop via xxx.xxx.xxx.xxx dev eth4 weight 1 nexthop via xxx.xxx.xxx.xxx dev eth5 weight 2
echo "Desabilitando filtro de caminho reverso..."
echo "0" > /proc/sys/net/ipv4/conf/eth4/rp_filter
echo "0" > /proc/sys/net/ipv4/conf/eth5/rp_filter
echo "0" > /proc/sys/net/ipv4/conf/eth1/rp_filter
echo "Habilitando redirecionamento de pacotes..."
echo "1" > /proc/sys/net/ipv4/ip_forward
# Squid Transparente..
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
#masquerade
iptables -t nat -A POSTROUTING -j MASQUERADE
ta um pouco bagunçado mas funciona
