IPTABLES - LIBERAR TUDO DE DENTRO PARA FORA DA REDE INTERNA
1. IPTABLES - LIBERAR TUDO DE DENTRO PARA FORA DA REDE INTERNA
ewandrocesar
(usa Conectiva)
Enviado em 05/01/2012 - 10:31h
Pessoal,Bom dia!
Poderia me ajudar com o meu firewall (script abaixo)
Da forma que está configurado as políticas padrões é necessário que eu libere porta a porta o acesso para qualquer aplicativo (ESPECÍFICOS), eu gostaria que da rede interna para fora seja tudo liberado, e que apenas eu precise 1 a 1 liberar o que vem de fora, alguém poderia me dizer o que preciso alterar para que isso aconteça?
Obrigado!
#!/bin/bash
iniciar(){
echo Carregando Regras de FIREWALL...
##INTERFACES
INT_LAN=eth2
INT_WAN=eth0
##REDES LAN
LAN1="10.1.0.0/24"
LAN2="10.2.0.0/24"
LAN3="10.0.0.0/24"
####### LIMPA AS REGRAS #########
iptables -F
####################### Politica padrao ####################################
iptables -t filter -P INPUT DROP
iptables -t filter -P OUTPUT ACCEPT
iptables -t filter -P FORWARD DROP
########ROUTER##########
route add -net 10.0.0.0 netmask 255.255.255.0 gw 10.1.0.250
route add -net 10.2.0.0 netmask 255.255.255.0 gw 10.1.0.250
###LIBERA COMUNICAÇÃO ENTRE LANS###
iptables -t filter -A FORWARD -s $LAN1 -d $LAN2 -j ACCEPT
iptables -t filter -A FORWARD -s $LAN2 -d $LAN1 -j ACCEPT
iptables -t filter -A FORWARD -s $LAN1 -d $LAN3 -j ACCEPT
iptables -t filter -A FORWARD -s $LAN3 -d $LAN1 -j ACCEPT
iptables -t filter -A FORWARD -s $LAN2 -d $LAN3 -j ACCEPT
iptables -t filter -A FORWARD -s $LAN3 -d $LAN2 -j ACCEPT
######## Compartilhando conexao.###########
modprobe iptable_nat
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
######################### Conexao Estabelecida ############################
iptables -t filter -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
iptables -t filter -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED
########################## Libera DNS ######################################
iptables -t filter -A FORWARD -p udp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A FORWARD -p tcp --dport 53 -j ACCEPT
#### Proxy ####
iptables -t filter -A FORWARD -i eth2 -p tcp --dport 3128 -j ACCEPT
iptables -t filter -A INPUT -i eth2 -p tcp --dport 3128 -j ACCEPT
iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 80 -j REDIRECT --to-port 3128
##ESPECIFICOS
iptables -t filter -A FORWARD -i eth2 -p tcp --dport 443 -j ACCEPT
iptables -t filter -A INPUT -i eth2 -p tcp --dport 443 -j ACCEPT
#iptables -t filter -A FORWARD -i eth2 -p tcp --dport 25 -j ACCEPT
#iptables -t filter -A INPUT -i eth2 -p tcp --dport 25 -j ACCEPT
iptables -t filter -A FORWARD -i eth2 -p tcp --dport 465 -j ACCEPT
iptables -t filter -A INPUT -i eth2 -p tcp --dport 465 -j ACCEPT
############# DIRECIONAMENTOS #######################
##### ACESSO REMOTE TS #####
##SRV01##
iptables -t filter -A INPUT -p tcp --dport 3389 -j ACCEPT
iptables -t filter -A FORWARD -p tcp --dport 3389 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 3389 -j DNAT --to-destination 10.1.0.101:9901
}
parar(){
iptables -F
iptables -X
iptables -Z
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
echo "Regras de firewall desativadas."
}
regras(){
iptables -L
}
case "$1" in
"rules") regras ;;
"start") iniciar ;;
"stop") parar ;;
"restart") parar; iniciar ;;
*) echo "Use os parametros start, stop ou rules."
esac