rubens_web
(usa Debian)
Enviado em 02/03/2012 - 17:24h
DMS_ escreveu:
Que [*****] em rubens :/
Você já deve ter tentado isso mas, coloca uma regra liberando estes IPs no seu firewall, mas coloca antes de qualquer DROP.
Rlx que tu vai achar a resposta.
Tá phoda!!
Fiz o seguinte teste DMS,
1° parei o serviço do firewall (TESTEI E NÃO FUNCIONOU)
2° comentei a linha onde direciona porta 80 para porta squid 3128 dentro do script do STOP (AI FUNCIONOU)
qq eu faço agora! vou postar novamente o meu firewall.sh
#======================================================
root@dhcpserver:~# cat /etc/init.d/firewall.sh
#! /bin/sh
# chkconfig: 235 99 10
# description: Start or stop the Webmin server
#
### BEGIN INIT INFO
# Provides: webmin
# Required-Start: $network $syslog
# Required-Stop: $network
# Default-Start: 2 3 5
# Default-Stop: 0 1 6
# Description: Start or stop the Webmin server
### END INIT INFO
#! /bin/bash
#Variaveis
ifaceExt="eth0"; #acesso internet (offboard)
ifaceInt="eth1"; #acesso intranet (rede interna) (onboard)
LAN="192.168.1.0/24"; #rede local
WAN="XXX.XXX.XX.XX"; #ip fixo RADIO
#Carrega modulos
/sbin/modprobe ip_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_queue
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_nat
/sbin/modprobe iptable_mangle
/sbin/modprobe ipt_state
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_multiport
/sbin/modprobe ipt_mac
/sbin/modprobe ipt_string
/sbin/modprobe ipt_MASQUERADE
start(){
echo "Firewall iniciado ...................... [OK]";
#limpa as regras
iptables -F
iptables -X
iptables -Z
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z
#Politica padrao INPUT=DROP | OUTUPT=ACCEPT | FORWARD=DROP
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
#Bloquei ping externo para o servidor (ICMP)
iptables -A INPUT -i $ifaceExt -p icmp --icmp-type 8 -j DROP
#LIBERANDO PORTAS
#--------------------------------------------------------------------------------------------------------
#Libera porta ssh
iptables -A INPUT -p tcp --dport 22 -i $ifaceInt -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -i $ifaceExt -j ACCEPT
#Libera porta (HTTP)
iptables -A INPUT -s $LAN -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -s $LAN -p udp --dport 80 -j ACCEPT
#Libera porta (DNS)
iptables -A INPUT -s $LAN -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s $LAN -p udp --dport 53 -j ACCEPT
#Libera porta (SQUID)
iptables -A INPUT -s $LAN -p tcp --dport 3128 -j ACCEPT
#Libera portas (SAMBA)
iptables -A INPUT -s $LAN -p tcp --dport 139 -j ACCEPT
iptables -A INPUT -s $LAN -p udp --dport 139 -j ACCEPT
#Libera portas para acesso ao servidor (APACHE)
iptables -A FORWARD -p tcp --destination-port 80 -j ACCEPT
# OLHE AQUI ==============================
# OLHE AQUI ==============================
# OLHE AQUI ==============================
#Libera IP (CLIPASNET)
#=========================================
iptables -I FORWARD -p tcp --dport 80 -d 200.180.72.107 -j ACCEPT
iptables -I FORWARD -p tcp --dport 80 -d 200.247.221.35 -j ACCEPT
#Sistema ClipasNet nao passando pelo squid
iptables -t nat -A PREROUTING -i $ifaceInt -p tcp ! -d 200.180.72.107 --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -i $ifaceInt -p tcp ! -d 200.247.221.35 --dport 80 -j REDIRECT --to-port 3128
# OLHE AQUI ==============================
# OLHE AQUI ==============================
# OLHE AQUI ==============================
# OLHE AQUI ==============================
#--------------------------------------------------------------------------------------------------------
#Permite pacotes transmitidos atraves da interface de loopback (localhost)
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i $ifaceInt -j ACCEPT
iptables -A INPUT -i $ifaceExt -j ACCEPT
#Compartilha a conexao disponivel na interface de internet
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s $LAN -o $ifaceExt -j MASQUERADE
echo "Compartilhamento de rede ativo";
#Permitindo e filtrando conexao estabelecidas
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -s $LAN -o $ifaceExt -j ACCEPT
#Direciona trafego para squid
iptables -t nat -A PREROUTING -i $ifaceInt -p tcp --dport 80 -j REDIRECT --to-port 3128
#ROTA ACESSO SISTEMA BKP (APACHE)
#------------------------------------------------------------------------------------------------------------------
iptables -t nat -A PREROUTING -i $ifaceExt -p tcp -m multiport --dports 21,80 -j DNAT --to-destination 192.168.1.61
iptables -t nat -A POSTROUTING -o $ifaceExt -j MASQUERADE
iptables -t nat -A POSTROUTING -d 192.168.1.61/32 -j SNAT --to-source 192.168.1.50
#------------------------------------------------------------------------------------------------------------------
echo "Firewall ativado! ...................... [OK]";
}
stop(){
#limpa as regras
iptables -F
iptables -X
iptables -Z
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z
#Politica padrao
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
#Compartilha a conexao disponivel na interface de internet
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s $LAN -o $ifaceExt -j MASQUERADE
echo "Compartilhamento de rede ativo";
#Permitindo e filtrando conexao estabelecidas
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -s $LAN -o $ifaceExt -j ACCEPT
#Proxy squid
iptables -t nat -A PREROUTING -i $ifaceInt -p tcp --dport 80 -j REDIRECT --to-port 3128
echo "Firewall desativado! ................... [OK]";
}
case "$1" in
"start") start ;;
"stop") stop ;;
"reload") stop; start ;;
*)
echo "Use parametros start|stop|reload" ;;
esac
root@dhcpserver:~#
