irado
(usa XUbuntu)
Enviado em 09/01/2009 - 13:53h
o script completo é este aqui; originalmente pra Slackware, foi modificado pra se usar no CentOS (RH-like), mas deve funcionar em QUALQUER distribuição Linux.
divirta-se.
#!/bin/bash -x
#
# iptables Start iptables firewall
#
# chkconfig: 235 08 92
# description: starts, stops restart iptables firewall
#
IPT=/sbin/iptables
TORRENT=6881:6991
limpa(){
$IPT -F -t filter
$IPT -X -t filter
$IPT -F -t nat
$IPT -X -t nat
$IPT -F -t mangle
$IPT -X -t mangle
}
iniciar(){
limpa
# estabelecendo politicas
$IPT -t filter -P FORWARD DROP
$IPT -t filter -P INPUT DROP
$IPT -t filter -P OUTPUT ACCEPT
#
###--> regras TABELA FILTER, chain OUTPUT
# default ACCEPT
# regra para squid
#$IPT -t filter -A OUTPUT -p tcp -m multiport --dport http,https -m owner ! --uid-owner squid -j REJECT --reject-with tcp-reset
##--> regras TABELA FILTER, chain INPUT
$IPT -t filter -A INPUT -p tcp --dport auth -j REJECT
$IPT -t filter -A INPUT -p udp --dport auth -j REJECT
$IPT -t filter -A INPUT -p tcp --dport 67:68 -j ACCEPT
$IPT -t filter -A INPUT -p udp --dport 67:68 -j ACCEPT
$IPT -t filter -A INPUT -p tcp -m multiport --dport ssh,$TORRENT,domain -j ACCEPT
$IPT -t filter -A INPUT -s 127.0.0.1 -j ACCEPT
$IPT -t filter -A INPUT -s 189.38.18.122 -p tcp --sport nntp -j ACCEPT
$IPT -t filter -A INPUT -p icmp -m icmp --icmp-type echo-request -m limit --limit 1/sec --limit-burst 5 -j ACCEPT # Echo Request
$IPT -t filter -A INPUT -p udp -m multiport --dport domain,ntp -j ACCEPT
$IPT -t filter -A INPUT -p tcp --destination-port 18768 -j ACCEPT # torrent via Opera
$IPT -t filter -A INPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPT -t filter -A INPUT -j LOG --log-prefix '** INPUT DROP **'
}
encerrar(){
limpa
$IPT -t filter -P FORWARD ACCEPT
$IPT -t filter -P INPUT ACCEPT
$IPT -t filter -P OUTPUT ACCEPT
}
case "$1" in
start)
iniciar
;;
stop)
encerrar
limpa
;;
restart)
encerrar
iniciar
;;
*)
echo "Uso $0 {start | stop | restart}"
;;
esac