rubens_web
(usa Debian)
Enviado em 01/03/2012 - 15:14h
eabreu escreveu:
Quais são as regras que estão atualmente no teu firewall ?
O Proxy está bloqueando o ip da máquina que usa para acessar esses endereços ?
#! /bin/sh
# chkconfig: 235 99 10
# description: Start or stop the Webmin server
#
### BEGIN INIT INFO
# Provides: webmin
# Required-Start: $network $syslog
# Required-Stop: $network
# Default-Start: 2 3 5
# Default-Stop: 0 1 6
# Description: Start or stop the Webmin server
### END INIT INFO
#! /bin/bash
#Variaveis
ifaceExt="eth0"; #acesso internet (offboard)
ifaceInt="eth1"; #acesso intranet (rede interna) (onboard)
LAN="192.168.1.0/24"; #rede local
WAN="XXX.XXX.XXX.XX"; #ip fixo radio
#Carrega modulos
/sbin/modprobe ip_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_queue
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_nat
/sbin/modprobe iptable_mangle
/sbin/modprobe ipt_state
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_multiport
/sbin/modprobe ipt_mac
/sbin/modprobe ipt_string
/sbin/modprobe ipt_MASQUERADE
start(){
echo "Firewall iniciado ...................... [OK]";
#limpa as regras
iptables -F
iptables -X
iptables -Z
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z
#Politica padrao INPUT=DROP | OUTUPT=ACCEPT | FORWARD=DROP
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
#Bloqueia porta (HTTPS)
#iptables -A FORWARD -s $LAN -p tcp --dport 443 -j DROP
#Bloquei ping externo para o servidor (ICMP)
iptables -A INPUT -i $ifaceExt -p icmp --icmp-type 8 -j DROP
#LIBERANDO PORTAS
#--------------------------------------------------------------------------------------------------------
#Libera porta ssh
iptables -A INPUT -p tcp --dport 22 -i $ifaceInt -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -i $ifaceExt -j ACCEPT
#Libera porta (HTTP)
iptables -A INPUT -s $LAN -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -s $LAN -p udp --dport 80 -j ACCEPT
#Libera porta (FTP)
#iptables -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#iptables -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED,RELATED -j ACCEPT
#iptables -A INPUT -i $ifaceExt -p tcp --dport 20:21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#iptables -A INPUT -i $ifaceExt -p tcp --sport 20:21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#iptables -A FORWARD -p tcp -s $LAN -d $WAN --dport 21 -j ACCEPT
#iptables -A FORWARD -p tcp -s $LAN -d $WAN --dport 20 -j ACCEPT
#Libera porta (DNS)
iptables -A INPUT -s $LAN -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s $LAN -p udp --dport 53 -j ACCEPT
#Libera porta (SQUID)
iptables -A INPUT -s $LAN -p tcp --dport 3128 -j ACCEPT
#Libera portas (SAMBA)
iptables -A INPUT -s $LAN -p tcp --dport 139 -j ACCEPT
iptables -A INPUT -s $LAN -p udp --dport 139 -j ACCEPT
#Libera portas para acesso ao servidor (APACHE)
iptables -A FORWARD -p tcp --destination-port 80 -j ACCEPT
#Libera IP (CLIPASNET)
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -d 200.180.72.107 -j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -d 200.247.221.35 -j ACCEPT
#--------------------------------------------------------------------------------------------------
#Permite pacotes transmitidos atraves da interface de loopback (localhost)
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i $ifaceInt -j ACCEPT
iptables -A INPUT -i $ifaceExt -j ACCEPT
#Compartilha a conexao disponivel na interface de internet
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s $LAN -o $ifaceExt -j MASQUERADE
echo "Compartilhamento de rede ativo";
#Permitindo e filtrando conexao estabelecidas
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -s $LAN -o $ifaceExt -j ACCEPT
#Proxy squid
iptables -t nat -A PREROUTING -i $ifaceInt -p tcp --dport 80 -j REDIRECT --to-port 3128
#ROTA ACESSO SISTEMA BKP (APACHE)
#----------------------------------------------------------------------------------------------------
iptables -t nat -A PREROUTING -i $ifaceExt -p tcp -m multiport --dports 21,80 -j DNAT --to-destination 192.168.1.61
iptables -t nat -A POSTROUTING -o $ifaceExt -j MASQUERADE
iptables -t nat -A POSTROUTING -d 192.168.1.61/32 -j SNAT --to-source 192.168.1.50
#----------------------------------------------------------------------------------------------------
echo "Firewall ativado! ...................... [OK]";
}
stop(){
#limpa as regras
iptables -F
iptables -X
iptables -Z
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z
#Politica padrao
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
#Compartilha a conexao disponivel na interface de internet
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s $LAN -o $ifaceExt -j MASQUERADE
echo "Compartilhamento de rede ativo";
#Permitindo e filtrando conexao estabelecidas
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -s $LAN -o $ifaceExt -j ACCEPT
#Proxy squid
iptables -t nat -A PREROUTING -i $ifaceInt -p tcp --dport 80 -j REDIRECT --to-port 3128
echo "Firewall desativado! ................... [OK]";
}
case "$1" in
"start") start ;;
"stop") stop ;;
"reload") stop; start ;;
*)
echo "Use parametros start|stop|reload" ;;
esac
###############
A linha comentada #Libera IP (CLIPASNET) onde está a liberação que eu quero.
