Iptables + Squid duvidas bloqueis
1. Iptables + Squid duvidas bloqueis
tcorte
(usa CentOS)
Enviado em 31/08/2013 - 18:56h
Pessoal boa noite...Estou em um cliente e preciso deixar funcionando ate segunda feira a rede do mesmo...
Pois bem tenho squid iptables sarg webmin funcionando perfeitamente.
Porem existe alguns detalhes que nao estou conseguindo resolver...
1- nao estou conseguindo dar ping das estacoes de trabalho para fora ex. ping 8.8.8.8
2- nao consigo liberar a porta 7000 para acessar um ip externo
Alguem pode me ajudar? Não tenho mta pratica com iptables.
segue o firewall
#!/bin/bash
# Local para o executavel do IPTables
# Interface da rede INTERNA
IF_INTERNA="eth0";
# Interface da rede EXTERNA
IF_EXTERNA="eth1";
# Definição da rede interna
REDE_INTERNA="10.1.1.0"
fw_start()
{
echo "Limpando Regras.....................................[OK]"
### Limpando regras iptables ###
iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F
iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING
iptables -X
echo "Ativando roteamento.................................[OK]"
#ativa o roteamento dinamico
echo 0 > /proc/sys/net/ipv4/ip_forward
echo 0 > /proc/sys/net/ipv4/ip_dynaddr
iptables -A INPUT -p icmp -i eth0 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 3389 -s 0/0 -d 200.175.93.151 -j DNAT --to-destination 10.1.1.3:3389
# ================ POLITICAS PADRAO ===================
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P POSTROUTING ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
iptables -t mangle -P INPUT ACCEPT
iptables -t mangle -P FORWARD ACCEPT
echo "Criando Regras de Seguranca.........................[OK]"
# Cria chain com regras de segurança
iptables -N BLOCK
iptables -A BLOCK -p icmp --icmp-type echo-request -j DROP
iptables -A BLOCK -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A BLOCK -p tcp -m limit --limit 1/s -j ACCEPT
iptables -A BLOCK -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -m limit --limit 1/s -j ACCEPT
# iptables -A BLOCK -m unclean -j DROP
iptables -A BLOCK -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A BLOCK -j LOG --log-prefix "FW_ALERT: "
iptables -A BLOCK -j DROP
# iptables -A FORWARD -p tcp --dport 7000 -j ACCEPT
# Muda a prioridade dos pacotes (Type Of Service) para agilizar as coisas
iptables -t mangle -A OUTPUT -o $IF_EXTERNA -p tcp -m multiport --dports 21,22,80,6667,7000,445,587 -j TOS --set-tos 0x10
iptables -t filter -A OUTPUT -o $IF_EXTERNA -p tcp -m multiport --dports 21,22,80,6667,7000,445,587 -j ACCEPT
echo "Liberando Trafego local.............................[OK]"
# Libera todo o trafego local
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A INPUT -i $IF_INTERNA -j ACCEPT
iptables -t filter -A FORWARD -i $IF_INTERNA -j ACCEPT
# Libera só FTP, SSH e WEB
iptables -A INPUT -p icmp --icmp-type 0 -i eth1 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 8 -i eth1 -j ACCEPT
iptables -t filter -A INPUT -i $IF_EXTERNA -p tcp -m multiport --dports 21,22,80,6667,7000,445 -j ACCEPT
# Libera a conexao para a rede interna
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# Liberando portas squid, http e NTP. Estes serviços o firewall só irá responder se vierem da interface da rede interna.
iptables -A INPUT -p tcp --dport 3128 -i $REDE_INTERNA -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -i $REDE_INTERNA -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -i $REDE_INTERNA -j ACCEPT
iptables -A INPUT -p tcp --dport 123 -i $REDE_INTERNA -j ACCEPT
iptables -A INPUT -p udp --dport 123 -i $REDE_INTERNA -j ACCEPT
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
# Regras para evitar packet flood
iptables -A INPUT -j BLOCK
iptables -A FORWARD -j BLOCK
echo " "
echo ".................. FIREWALL NBRtec ATIVADO................."
echo " "
}
fw_stop()
{
iptables -t filter -P INPUT ACCEPT
iptables -t filter -P FORWARD ACCEPT
iptables -t filter -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P POSTROUTING ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
iptables -t mangle -P INPUT ACCEPT
iptables -t mangle -P FORWARD ACCEPT
iptables -t filter -F
iptables -t nat -F
iptables -t mangle -F
iptables -t filter -X
iptables -t nat -X
iptables -t mangle -X
iptables -t filter -Z
iptables -t nat -Z
iptables -t mangle -Z
}
fw_usage()
{
echo
echo "$0 (start | stop | restart | clear)"
echo
echo "start - Ativa o firewall"
echo "stop - Desativa o firewall"
echo "restart - Reativa o firewall"
echo "clear - Limpa os contatores"
}
fw_clear()
{
iptables -t filter -Z
iptables -t nat -Z
iptables -t mangle -Z
}
case $1 in
start)
fw_start;
;;
stop)
fw_stop;
;;
restart)
fw_stop;
fw_start;
;;
clear)
fw_clear;
;;
*)
fw_usage;
exit;
;;
esac