daltonpimmel
(usa Outra)
Enviado em 01/06/2013 - 11:45h
Esse é meu firewall.
#!/bin/bash
#
# firewall: Bring up/down the packet filtering rules
#
# ----------------------------------------------------------------------
# DEFINICAO DE VARIAVEIS
# ----------------------------------------------------------------------
IPTABLES="/sbin/iptables"
MODPROBE="/sbin/modprobe"
SYSCTL="/sbin/sysctl"
IF_LO="lo" # Interface Loopback
IP_LO="127.0.0.1" # IP da interface LOC_IF
IF_EXT="wlan0" # Interface da rede Internet
IP_EXT="192.168.0.100" # IP da interface externa
IF_INT="eth0" # Interface da rede interna
IP_INT="192.168.0.1" # IP da interface da interna
NET_INT="255.255.255.0" # Rede da interface da interna
BRO_INT="192.168.0.255 " # Broadcast da interface da interna
carrega_modulos() {
$MODPROBE ip_tables
$MODPROBE iptable_nat
$MODPROBE ip_nat_ftp
}
limpa_regras() {
for i in filter nat mangle ; do
$IPTABLES -t $i -F # Limpa regras de Filter, NAT e Mangle
$IPTABLES -t $i -X # Apaga tabelas de regras
$IPTABLES -t $i -Z # Zera contadores
done
}
drop_policy() {
# Politica default para a tabela "Filter"
$IPTABLES -P INPUT ACCEPT
}
accept_policy() {
# Politica default para a tabela "Filter"
$IPTABLES -P INPUT ACCEPT
}
# ----------------------------------------------------------------------
# CHAIN INPUT
# ----------------------------------------------------------------------
cria_regras_INPUT() {
#Fazendo o Firewall Statefull
${IPTABLES} -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#Liberando o acesso da máquina LOCAL
${IPTABLES} -A INPUT -d $IP_LO -j ACCEPT
#Liberando acesso a internet atraves do proxy
${IPTABLES} -A INPUT -p tcp -i $IF_INT --dport 3128 -j ACCEPT
}
# ----------------------------------------------------------------------
# CHAIN DE POSTROUTING
# ----------------------------------------------------------------------
cria_regras_POSTROUTING() {
echo 1 > /proc/sys/net/ipv4/ip_forward
# Fazendo o Nat da rede
${IPTABLES} -t nat -A POSTROUTING -o ${IF_EXT} -j MASQUERADE
${IPTABLES} -t nat -A POSTROUTING -s $IP_EXT -j SNAT --to $IP_EXT
}
cria_regras_PREROUTING() {
${IPTABLES} -t nat -A PREROUTING -i ${IF_INT} -p tcp -m multiport --dport 80 -j REDIRECT --to-port 3128
}
proxy_autenticado() {
${IPTABLES} -A FORWARD -p tcp --dport 80 -j ACCEPT
${IPTABLES} -A FORWARD -p tcp --dport 443 -j ACCEPT
}
# Carrega modulos do kernel
carrega_modulos
# Parametros de chamada do script
case "$1" in
start)
echo -e "\n\t.........................."
echo -e "\n\tIniciando firewall ... "
carrega_modulos
limpa_regras
drop_policy
cria_regras_INPUT
cria_regras_POSTROUTING
#cria_regras_PREROUTING
proxy_autenticado
echo -e "\n\tFirewall Inicado com Sucesso!"
echo -e "\n\t............................"
;;
stop)
echo -e "\n\t.........................."
echo -e "\n\tParando firewall ... "
limpa_regras
accept_policy
echo -e "\n\tFirewall parado com Sucesso!"
echo -e "\n\t.........................."
;;
restart)
echo -e "\n\t.........................."
echo -e "\n\tParando firewall ... "
limpa_regras
accept_policy
echo -e "\n\tFirewall parado com Sucesso!"
echo -e "\n\t.........................."
echo -e "\n\t.........................."
echo -e "\n\tIniciando firewall ... "
carrega_modulos
limpa_regras
drop_policy
cria_regras_INPUT
cria_regras_POSTROUTING
#cria_regras_PREROUTING
proxy_autenticado
echo -e "\n\tFirewall Inicado com Sucesso!"
echo -e "\n\t............................"
;;
status)
echo ""
echo "Listando Tabela FILTER ... "
echo "-----------------------"
$IPTABLES -t filter -L -v -n
echo ""
echo ""
echo ""
echo "Listando Tabela NAT ... "
echo "-----------------------"
$IPTABLES -t nat -L -v -n
echo ""
echo ""
echo ""
echo "Listando Tabela MANGLE ... "
echo "-----------------------"
$IPTABLES -t mangle -L -v -n
echo ""
echo ""
;;
*)
echo "Usage: $0 {start|stop|status}"
esac
exit $?
Esse é o arquivo dhcp.conf
ddns-update-style none;
default-lease-time 600;
max-lease-time 7200;
authoritative;
subnet 192.168.0.0 netmask 255.255.255.0 {
range 192.168.0.3 192.168.0.98;
option routers 192.168.0.1;
option domain-name-servers 8.8.8.8;
option broadcast-address 192.168.0.255;
}
Esse é o arquivo /etc/default/isc-dhcp-server
# Defaults for isc-dhcp-server initscript
# sourced by /etc/init.d/isc-dhcp-server
# installed at /etc/default/isc-dhcp-server by the maintainer scripts
#
# This is a POSIX shell fragment
#
# Path to dhcpd's config file (default: /etc/dhcp/dhcpd.conf).
#DHCPD_CONF=/etc/dhcp/dhcpd.conf
# Path to dhcpd's PID file (default: /var/run/dhcpd.pid).
#DHCPD_PID=/var/run/dhcpd.pid
# Additional options to start dhcpd with.
# Don't use options -cf or -pf here; use DHCPD_CONF/ DHCPD_PID instead
#OPTIONS=""
# On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
# Separate multiple interfaces with spaces, e.g. "eth0 eth1".
INTERFACES="eth0"
Eu estou usando a wlan para se conectar com a internet, e a eth0 para desbriur os ip.
