Ajuda para liberar porta 995 e 465 (Gmail e Yahoo)

1. Ajuda para liberar porta 995 e 465 (Gmail e Yahoo)

Fortes1975
(usa Debian)

Enviado em 19/07/2013 - 12:24h

Bom tarde a todos!
Estou com uma certa dificuldade na liberação de portas o restante está tudo ok, somente o outlook que não funciona.

Quem puder me ajudar!
Agradeço!

Bom, segue a configuração das "ETH"
eth0: DHCP (modem roteado)
eth1: 192.168.0.1 (rede local)

#### ESTE É O SQUID ####
http_port 3128 transparent
visible_hostname FF_FIREWALL

error_directory /usr/share/squid/errors/Portuguese/
cache_mem 64 MB
maximum_object_size_in_memory 64 KB
maximum_object_size 512 MB
maximum_object_size 0 KB
cache_swap_low 90
cache_swap_high 95
cache_dir ufs /var/spool/squid 2048 16 256
cache_access_log /var/log/squid/access.log
refresh_pattern ^ftp: 15 20% 2280
refresh_pattern ^gopher: 15 0% 2280
refresh_pattern . 15 20% 2280

acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 22 25 110 587 465 995 10000
acl Safe_ports port 21 80 138 139 443 563 70 210 280 488 591 777 901 1025-65535
acl purge method PURGE
acl CONNECT method CONNECT

acl GOVERNO url_regex -i "/etc/squid/regras/sites_governos"
http_access allow GOVERNO

acl DOWNLOADS url_regex -i "/etc/squid/regras/downloads"
acl ESTACAO_DIR src "/etc/squid/regras/diretores"
http_access deny DOWNLOADS
http_access allow ESTACAO_DIR !DOWNLOADS

acl SITES_PERMITIDOS url_regex -i "/etc/squid/regras/sites_permitidos"
acl ESTACAO_FUNC src "/etc/squid/regras/funcionarios"
http_access allow SITES_PERMITIDOS
http_access deny ESTACAO_FUNC !SITES_PERMITIDOS

http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

#Validacao da rede local
acl redelocal src 192.168.0.0/24
http_access allow localhost
http_access allow redelocal
http_access deny all

#Bloqueio de arquivos por extensão
acl extensao url_regex -i "/etc/squid/bloqueados/extensao"
http_access deny extensao
http_access allow ESTACAO_DIR !extensao

##################################################### FIM

#### ESTE É O RC.LOCAL ####
#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.

sh /etc/squid/fw.sh
sh /etc/squid/firewall_liberando_outlook.sh
sh /etc/squid/clock.sh

exit 0

################################################# FIM

#### ESTE É O FW.SH ####
#!/bin/bash
echo Inicializando regras do firewall
sleep 0
IF_WAN=eth1 #INTERFACE DE SAIDA PARA INTERNET
LAN=192.168.0.0/24 #ENDERECO PARA REDE LOCAL LAN

#LIMPA REGRAS DO FIREWALL
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -F
iptables -t nat -F

echo "nameserver 127.0.0.1">/etc/resolv.conf
echo "nameserver 8.8.8.8">>/etc/resolv.conf
echo "nameserver 4.4.4.4">>/etc/resolv.conf

#ATIVA O SISTEMA DE ROTEAMENTO DE PACOTES
echo 1 > /proc/sys/net/ipv4/ip_forward

#ATIVA O MODO DE MASQUERADE
iptables -t nat -A POSTROUTING -o $IF_WAN -j MASQUERADE #MASCARANDO A REDE

#FORCA A NAVEGACAO PELA PORTA 3128
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -s $LAN -j REDIRECT --to 3128
#iptables -t nat -A PREROUTING -p tcp -s $LAN --dport 1863 -j DROP

###################################################### FIM

#### ESTE LIBERA O OUTLOOK ####
#!/bin/bash
#
iniciar(){
iptables -F
iptables -t nat -F

# Caso a Conexao seja Velox ou GVT (bridge) mude o parametro abaixo para 1400
#ifconfig ppp0 mtu 1500

# ## Se For usar Proxy TRASPARENT ddescomentar as linhas abaixo ###

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu

#### Liberando OUTLOOK para toda Rede - Basta colocar a porta que o provedo de e-mail usa. ###

iptables -t nat -I PREROUTING -p tcp -s 192.168.0.0/24 -m multiport --dports 995,465,587,993,110,25 -j ACCEPT
iptables -t nat -I POSTROUTING -p tcp -d 0.0.0.0/0.0.0.0 -m multiport --dports 995,465,587,993,110,25 -j ACCEPT

# ## Aqui Voce libera portas de acesso ao seu Linux ###

iptables -A INPUT -i ppp0 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp --dport 3000 -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp --dport 10000 -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp --dport 10001 -j ACCEPT

# A Regras abaixo permitem o OUTLOOK funcionar - Olhar qual portas o provedor de e-mail usa

# SMTP
iptables -A FORWARD -s 192.168.0.0/24 -p tcp --dport 995 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/24 -p tcp --dport 465 -j ACCEPT

iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -d 0/0 -p tcp --dport 110 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -d 0/0 -p tcp --dport 25 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -d 0/0 -p tcp --dport 587 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -d 0/0 -p tcp --dport 993 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -d 0/0 -p tcp --dport 465 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -d 0/0 -p tcp --dport 995 -j MASQUERADE

# IMAP e POP
iptables -t nat -A POSTROUTING -s 0/0 -d 192.168.0.0/0 -p tcp --dport 110 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 0/0 -d 192.168.0.0/0 -p tcp --dport 25 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 0/0 -d 192.168.0.0/0 -p tcp --dport 587 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 0/0 -d 192.168.0.0/0 -p tcp --dport 993 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 0/0 -d 192.168.0.0/0 -p tcp --dport 465 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 0/0 -d 192.168.0.0/0 -p tcp --dport 995 -j MASQUERADE

# Redirecionamento de portas

#iptables -A FORWARD -p tcp --dport 3389 -j ACCEPT
#iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 3389 -j DNAT --to 192.168.0.100

# Redirecionamento para proxy - Descomente a Linha abaixo se for usar proxy trasparent

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

}

parar(){
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
}

case "$1" in
"start") iniciar ;;
"stop") parar ;;
"restart") parar; iniciar ;;
*) echo "Use os parametros start ou stop"
esac

###################################### FIM

0 0

Quote