alamluiz
(usa Debian)
Enviado em 01/07/2010 - 14:57h
desculpe,
segue abaixo o .conf.
echo "Definindo politica padrao...DROP"
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
echo "Ativando Fluxo interno entre processos...."
$IPTABLES -I INPUT -i lo -j ACCEPT
$IPTABLES -I OUTPUT -o lo -j ACCEPT
echo "ativando a liberacao das portas principais do servidor FIRE-CICLO..."
for i in `cat $PORTLIB`; do
$IPTABLES -A INPUT -p tcp --dport $i -j ACCEPT
$IPTABLES -A INPUT -p UDP --dport $i -j ACCEPT
$IPTABLES -A FORWARD -p tcp --dport $i -j ACCEPT
$IPTABLES -A FORWARD -p udp --dport $i -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport $i -j ACCEPT
$IPTABLES -A OUTPUT -p udp --dport $i -j ACCEPT
done
$IPTABLES -I INPUT -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -I INPUT -m state --state RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -I OUTPUT -p icmp -j ACCEPT
#$IPTABLES -I FORWARD -s 10.1.1.0/24 -p tcp --dport 1863 -j ACCEPT
#$IPTABLES -I FORWARD -s 10.1.1.0/24 -d login.live.com -j ACCEPT
#$IPTABLES -I FORWARD -s 10.1.1.0/24 -d gateway.messenger.hotmail.com -j ACCEPT
#$IPTABLES -I FORWARD -s 10.1.1.0/24 -d login.passport.com -j ACCEPT
#$IPTABLES -I FORWARD -s 10.1.1.0/24 -d 64.4.13.0/24 -j ACCEPT
#$IPTABLES -t nat -A POSTROUTING -s 10.1.1.0/24 -d 64.4.13.0/24 -j ACCEPT
#$IPTABLES -I FORWARD -s 10.1.1.0/24 -d 65.54.179.162 -j ACCEPT
#$IPTABLES -I FORWARD -s 10.1.1.0/24 -d loginnet.password.com -j ACCEPT
echo "Liberando OUTLOOK..."
$IPTABLES -A FORWARD -p udp -s 10.1.1.0/24 -d 201.10.120.3 --dport 53 -j ACCEPT
$IPTABLES -A FORWARD -p udp -s 201.10.120.3 --sport 53 -d 10.1.1.0/24 -j ACCEPT
$IPTABLES -A FORWARD -p udp -s 10.1.1.0/24 -d 200.215.63.4 --dport 53 -j ACCEPT
$IPTABLES -A FORWARD -p udp -s 200.215.63.4 --sport 53 -d 10.1.1.0/24 -j ACCEPT
$IPTABLES -A FORWARD -p tcp -s 10.1.1.0/24 --dport 25 -j ACCEPT
$IPTABLES -A FORWARD -p tcp -s 10.1.1.0/24 --dport 110 -j ACCEPT
$IPTABLES -A FORWARD -p tcp --sport 25 -j ACCEPT
$IPTABLES -A FORWARD -p tcp --sport 110 -j ACCEPT
echo "BLOQUEANDO ATAQUES..."
#BLOQUEIO DE PING DA MORTE
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all
$IPTABLES -N PING-MORTE
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j PING-MORTE
$IPTABLES -A PING-MORTE -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A PING-MORTE -j DROP
#BLOQUEIO SYN-FLOOD
echo "0" > /proc/sys/net/ipv4/tcp_syncookies
$IPTABLES -N syn-flood
$IPTABLES -A INPUT -i $WAN -p tcp --syn -j syn-flood
$IPTABLES -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A syn-flood -j DROP
#BLOQUEIO SSH FORCA BRUTA
$IPTABLES -N SSH-BRUT-FORCE
$IPTABLES -A INPUT -i $WAN -p tcp --dport 22 -j SSH-BRUT-FORCE
$IPTABLES -A SSH-BRUT-FORCE -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A SSH-BRUT-FORCE -j DROP
#BLOQUEIO ANTI-SPOOFINGS
$IPTABLES -A INPUT -s 10.0.0.0/8 -i $WAN -j DROP
$IPTABLES -A INPUT -s 127.0.0.0/8 -i $WAN -j DROP
$IPTABLES -A INPUT -s 172.16.0.0/12 -i $WAN -j DROP
$IPTABLES -A INPUT -s 192.168.1.0/16 -i $WAN -j DROP
echo "LIBERANDO ACESOS..."
$IPTABLES -t nat -A PREROUTING -i $LAN -s 10.1.1.9 -m mac --mac-source 00:16:d4:b1:f9:d2 -j ACCEPT
$IPTABLES -t filter -A FORWARD -s 10.1.1.9 -m mac --mac-source 00:16:d4:b1:f9:d2 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i $LAN -s 10.1.1.10 -m mac --mac-source 00:02:2a:e3:d2:1a -j ACCEPT
$IPTABLES -t filter -A FORWARD -s 10.1.1.10 -m mac --mac-source 00:02:2a:e3:d2:1a -j ACCEPT
$IPTABLES -A FORWARD -p tcp -s $LAN -d 216.245.203.178 -j REJECT
echo "ATIVANDO MASCARAMENTO..."
$IPTABLES -t nat -A POSTROUTING -o $WAN -j MASQUERADE
echo "CONFIGURANDO REDIRECIONAMENTO..."
$IPTABLES -t nat -A PREROUTING -i $WAN -p tcp --dport 3389 -j DNAT --to-dest 10.1.1.20:3389 #MSTSC
$IPTABLES -A FORWARD -p tcp -i $WAN --dport 3389 -d 10.1.1.20 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i $WAN -p tcp --dport 29001 -j DNAT --to-dest 10.1.1.20:29001 #SESMO
$IPTABLES -A FORWARD -p tcp -i $WAN --dport 29001 -d 10.1.1.20 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 49750 -j ACCEPT #SSH
echo "LIBERANDO MSN...."
$IPTABLES -A FORWARD -i $LAN -p tcp --dport 1863 -j ACCEPT
$IPTABLES -A FORWARD -i $LAN -d 64.4.13.0/24 -j ACCEPT
$IPTABLES -A FORWARD -i $LAN -d login.passport.com -j ACCEPT
$IPTABLES -t filter -A FORWARD -d 10.1.1.0/24 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
echo "ATIVANDO PROXY TRANSPARENTE..."
$IPTABLES -t nat -A PREROUTING -i $LAN -p tcp --dport 80 -j REDIRECT --to-port 3128
$IPTABLES -t nat -A PREROUTING -s 0/0 -p tcp --dport 80 -j REDIRECT --to-port 3128
$IPTABLES -t nat -A PREROUTING -s 0/0 -p tcp --dport 80 -j LOG --log-prefix "PROXY::ACTIVE "
