NAT postgresql (5432) não funciona

ederlopes7
(usa CentOS)

Enviado em 21/01/2013 - 14:53h

Ola pessoal


Mais uma vez venho recorrer ao meus amigos que sabem + que eu....


Faz alguns dias que eu estou brigando com o IPTABLES, pois preciso fazer um NAT do PostgreSQL (5432) porem não estou dando conta.. não sei o que estou fazendo de errado, porem tudo que eu estou tentando de uma maneira não funciona


( No Post está correto, pois já efetuei conexões várias vezes externamente, mas depois que eu formatei o pc que estava o firewall e o squid que eu perdi o acesso )






antes apenas funcionava assim

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 5432 -j DNAT --to-destination 192.168.1.254:5432
iptables -t nat -A PREROUTING -i eth1 -p udp --dport 5432 -j DNAT --to-destination 192.168.1.254:5432


porem agora nem assim funciona...




segue meu firewall


!/bin/sh

### Firewall
case "$1" in
start)
echo "starting firewall..."
#Variaveis
IPTABLES="/sbin/iptables"
LANEXT=eth0
LANINT=eth1
LAN_NET="17.0.0.0/16"
ADMIN="192.168.1.0/24"

#Modulos IPTABLES
modprobe ip_tables
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ipt_REJECT
modprobe ipt_MASQUERADE
modprobe ipt_state
modprobe ipt_multiport
modprobe iptable_mangle
modprobe ipt_limit
modprobe ipt_TOS

#echo "1" > /proc/sys/net/ipv4/ip_forward
#iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
#Zera todas as regras do iptables
$IPTABLES -F
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F
$IPTABLES -X

#Politicas Padrao de NAT
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT

#Polcas Padr
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
#Ativar ip_forward
echo "1" > /proc/sys/net/ipv4/ip_forward

#$IPTABLES -A INPUT -s 192.168.1.0/24 -p tcp --dport 80 -j DROP
$IPTABLES -t nat -A PREROUTING -p tcp -i eth1 --dport 80 -j REDIRECT --to 3128

#Acesso ao Servidor
$IPTABLES -t nat -A PREROUTING -p tcp -s 17.0.0.1/16 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p tcp -s 192.168.1.0/24 -j ACCEPT

#Libera SSH
$IPTABLES -t nat -A PREROUTING -p tcp -i $LANEXT -s 0/0 --dport 22 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p tcp -i $LANINT -s $LAN_NET --dport 22 -j ACCEPT
echo "Ativado a liberacao da porta 22"
echo "ON ....................................................... [ OK ]"

#$IPTABLES -t nat -A PREROUTING -i $LANEXT -p tcp --dport 2222 -j DNAT --to-destination 192.168.1.254:2222

#Liberar DNS Interno
$IPTABLES -t nat -A PREROUTING -p udp -i $LANINT -s $LAN_NET --dport 53 -j ACCEPT
echo "Liberar porta DNS Interno"
echo "ON ....................................................... [ OK ]"

#Liberar SAMBA para rede Interna
$IPTABLES -t nat -A PREROUTING -p tcp -i $LANINT -s $LAN_NET --dport 139 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p udp -i $LANINT -s $LAN_NET --dport 139 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p udp -i $LANINT -s $LAN_NET --dport 138 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p udp -i $LANINT -s $LAN_NET --dport 137 -j ACCEPT
echo "Liberar porta SAMBA Interno"
echo "ON ....................................................... [ OK ]"

#Liberar Proxy para rede interna
$IPTABLES -t nat -A PREROUTING -p tcp -i $LANINT -s $LAN_NET --dport 3128 -j ACCEPT

#####################################
# FILTER INPUT
#####################################

#Asterisk
$IPTABLES -A INPUT -p udp -s 0/0 --dport 5060 -j ACCEPT

#Libera SSH
$IPTABLES -A INPUT -p tcp -i $LANEXT -s 0/0 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -i $LANINT -s $LAN_NET --dport 22 -j ACCEPT

#Liberar Proxy para rede interna
$IPTABLES -A INPUT -p tcp -i $LANINT -s $LAN_NET --dport 3128 -j ACCEPT

#Habilitando o LO interno
$IPTABLES -A INPUT -i lo -j ACCEPT
echo "Ativado o fluxo interno"
echo "ON ....................................................... [ OK ]"

#Liberar DNS Interno
$IPTABLES -A INPUT -p udp -i $LANINT -s $LAN_NET --dport 53 -j ACCEPT
echo "Liberar porta DNS Interno"
echo "ON ....................................................... [ OK ]"

#Liberar SAMBA para rede Interna
$IPTABLES -A INPUT -p tcp -i $LANINT -s $LAN_NET --dport 139 -j ACCEPT
$IPTABLES -A INPUT -p udp -i $LANINT -s $LAN_NET --dport 139 -j ACCEPT
$IPTABLES -A INPUT -p udp -i $LANINT -s $LAN_NET --dport 138 -j ACCEPT
$IPTABLES -A INPUT -p udp -i $LANINT -s $LAN_NET --dport 137 -j ACCEPT
echo "Liberar porta SAMBA Interno"
echo "ON ....................................................... [ OK ]"

#Libera as portas principais do servidor
$IPTABLES -A INPUT -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -m state --state RELATED -j ACCEPT
$IPTABLES -A INPUT -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -m state --state INVALID -j DROP
echo "Ativado a libera portas principais"
echo "ON ....................................................... [ OK ]"

######################################
# FILTER OUTPUT
######################################
#Habilitando o icmp interno
$IPTABLES -A OUTPUT -o lo -j ACCEPT

##########################################################
# FILTER FORWARD
##########################################################
#Roteamento de placas de REDE iptables
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state NEW -j ACCEPT
$IPTABLES -A FORWARD -m state --state INVALID -j ACCEPT
#Liberar Servidor
$IPTABLES -A FORWARD -s 17.0.0.1/16 -p tcp -j ACCEPT
$IPTABLES -A FORWARD -s 0/0 -d 17.0.0.1/16 -p tcp -j ACCEPT
#DNS
$IPTABLES -A FORWARD -p udp -s $LAN_NET --dport 53 -j ACCEPT
#OUTLOOK
$IPTABLES -A FORWARD -p TCP -s $LAN_NET --dport 1025 -j ACCEPT
$IPTABLES -A FORWARD -p TCP -s $LAN_NET --dport 110 -j ACCEPT
$IPTABLES -A FORWARD -p tcp --sport 1025 -j ACCEPT
$IPTABLES -A FORWARD -p tcp --sport 110 -j ACCEPT
echo "Liberando OUTLOOK"
echo "ON ....................................................... [ OK ]"

######################################
# PING-MORTE
######################################
#Bloqueio ping da morte
$IPTABLES -N PING-MORTE
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j PING-MORTE
$IPTABLES -A PING-MORTE -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A PING-MORTE -j DROP
echo "Ativado o bloqueio a tentativa de ataque ping da morte"
echo "ON ....................................................... [ OK ]"

####################################
# SYN ACK and FIN
####################################
#Bloqueio de scanners ocultos (Shealt Scan)
$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,ACK, FIN, -m limit --limit 1/s -j ACCEPT
echo "Bloqueado scanners ocultos"
echo "ON ....................................................... [ OK ]"

######################################
# SSH-BRUT-FORCE
######################################
#Bloqueio de ataque ssh de for bruta
$IPTABLES -N SSH-BRUT-FORCE
$IPTABLES -A INPUT -i $LANEXT -p tcp --dport 22 -j SSH-BRUT-FORCE
$IPTABLES -A SSH-BRUT-FORCE -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A SSH-BRUT-FORCE -j DROP
echo "Ativado o bloqueio a tentativa de ataque do tipo SSH-BRUT-FORCE"
echo "ON ....................................................... [ OK ]"

#Habilita o roteamento da porta 80 para nosso Proxy transparente
#$IPTABLES -t nat -A PREROUTING -i $LANINT -p tcp --dport 80 -j REDIRECT --to-port 3128
#echo "Regra para proxy transparente habilitada"
#echo "ON ....................................................... [ OK ]"


####################################################################################################################
####################################################################################################################
####################################################################################################################
#NAT DE SERVICOS DA SANTA CASA
####################################################################################################################
# Terminal Service
$IPTABLES -A FORWARD -i $LANEXT -p tcp --dport 3389 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i $LANEXT -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.1.5:3389
$IPTABLES -A FORWARD -i $LANEXT -p tcp --dport 3388 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i $LANEXT -p tcp -m tcp --dport 3388 -j DNAT --to-destination 192.168.1.140:3389
$IPTABLES -A FORWARD -i $LANEXT -p tcp --dport 3390 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i $LANEXT -p tcp -m tcp --dport 3390 -j DNAT --to-destination 192.168.1.5:3389

echo "REDIRECIONAMENTO RDP"
echo "ON ....................................................... [ OK ]"
####################################################################################################################
# ACESSO PARA CAMERAS EXTERNO
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3008 -j DNAT --to-destination 192.168.1.18:3008
iptables -t nat -A PREROUTING -i eth0 -p tcp --sport 3008 -j DNAT --to-destination 192.168.1.18:3008
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3001 -j DNAT --to-destination 192.168.1.18:3001
iptables -t nat -A PREROUTING -i eth0 -p tcp --sport 3001 -j DNAT --to-destination 192.168.1.18:3001
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3002 -j DNAT --to-destination 192.168.1.18:3002
iptables -t nat -A PREROUTING -i eth0 -p tcp --sport 3002 -j DNAT --to-destination 192.168.1.18:3002
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3003 -j DNAT --to-destination 192.168.1.18:3003
iptables -t nat -A PREROUTING -i eth0 -p tcp --sport 3003 -j DNAT --to-destination 192.168.1.18:3003
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3004 -j DNAT --to-destination 192.168.1.18:3004
iptables -t nat -A PREROUTING -i eth0 -p tcp --sport 3004 -j DNAT --to-destination 192.168.1.18:3004
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 3005 -j DNAT --to-destination 192.168.1.18:3005
iptables -t nat -A PREROUTING -i eth0 -p udp --sport 3005 -j DNAT --to-destination 192.168.1.18:3005
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3006 -j DNAT --to-destination 192.168.1.18:3006
iptables -t nat -A PREROUTING -i eth0 -p tcp --sport 3006 -j DNAT --to-destination 192.168.1.18:3006
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3007 -j DNAT --to-destination 192.168.1.18:3007
iptables -t nat -A PREROUTING -i eth0 -p tcp --sport 3007 -j DNAT --to-destination 192.168.1.18:3007
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 3000 -j DNAT --to-destination 192.168.1.18:3000
iptables -t nat -A PREROUTING -i eth0 -p tcp --sport 3000 -j DNAT --to-destination 192.168.1.18:3000
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8800 -j DNAT --to-destination 192.168.1.18:8800
iptables -t nat -A PREROUTING -i eth0 -p tcp --sport 8800 -j DNAT --to-destination 192.168.1.18:8800
echo "ACESSO CAMERAS EXTERNO"
echo "ON ....................................................... [ OK ]"
####################################################################################################################

# ACESSO AO BANCO DE DADOS WARELINE

iptables -A FORWARD -i eth0 -d 192.168.1.254/32 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 5432 -j DNAT --to-destination 192.168.1.254:5432
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 5432 -j DNAT --to-destination 192.168.1.254:5432
iptables -t nat -A PREROUTING -i eth0 -p tcp --sport 5432 -j DNAT --to-destination 192.168.1.254:5432
iptables -t nat -A PREROUTING -i eth0 -p udp --sport 5432 -j DNAT --to-destination 192.168.1.254:5432

echo "ACESSO EXTERNO AO BANCO DE DADOS"
echo "ON ....................................................... [ OK ]"
####################################################################################################################
####################################################################################################################
####################################################################################################################


#Libera Conectividade Segura - CEF
#$IPTABLES -t nat -I PREROUTING -i $LANEXT -d 200.201.174.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
#$IPTABLES -t nat -A PREROUTING -i $LANEXT -d www.caixa.gov.br -p tcp --dport 80 -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -i $LANEXT -d www1.caixa.gov.br -p tcp --dport 80 -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -i $LANEXT -d cmt.caixa.gov.br -p tcp --dport 80 -j ACCEPT
$IPTABLES -t nat -I PREROUTING -d 200.201.174.207 -j ACCEPT
$IPTABLES -t nat -I PREROUTING -s 200.201.174.207 -j ACCEPT
$IPTABLES -A INPUT -i $LANINT -p udp -s 200.201.174.207 -j ACCEPT
$IPTABLES -A INPUT -i $LANEXT -p udp -s 200.201.174.207 -j ACCEPT
$IPTABLES -A INPUT -p tcp --destination-port 2631:2631 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --destination-port 2631:2631 -j ACCEPT
$IPTABLES -I FORWARD -p tcp --dport 80 -s $LAN_NET -d 200.201.174.0/24 -j ACCEPT
$IPTABLES -I FORWARD -p tcp --dport 21 -d 200.201.174.207 -j ACCEPT
$IPTABLES -I FORWARD -p tcp --dport 80 -d 200.201.174.207 -j ACCEPT
$IPTABLES -I FORWARD -p tcp --dport 20001:20005 -s 200.201.174.207 -j ACCEPT
$IPTABLES -I FORWARD -p tcp --dport 20000:20019 -d 200.201.174.207 -j ACCEPT
$IPTABLES -I FORWARD -p tcp -s 200.201.174.207 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -j ACCEPT -p tcp -i eth0 --sport 2631
$IPTABLES -A INPUT -j ACCEPT -p tcp -i eth0 --dport 2631
$IPTABLES -A INPUT -j ACCEPT -p tcp -i eth0 -s 200.201.174.0/24
$IPTABLES -A INPUT -j ACCEPT -p tcp -i eth0 -d 200.201.174.0/24
iptables -A FORWARD -s $ADMIN -d 200.192.88.130 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s $ADMIN -d 200.192.88.130 -p tcp --dport 80 -j ACCEPT


#=======================================================================
iptables -A FORWARD -j ACCEPT -p tcp --sport 2631
iptables -A FORWARD -j ACCEPT -p tcp --dport 2631


echo "Liberar Conectividade Segura - CEF"
echo "ON ....................................................... [ OK ]"

#Roteamento de interface
$IPTABLES -t nat -A POSTROUTING -o $LANEXT -j MASQUERADE
echo "Ativado o redirecionamento ip_forward"
echo "ON ....................................................... [ OK ]"



#Zera contadores
echo "FIREWALL SANTA CASA CARREGADO COM SUCESSO!!"
echo "ON ....................................................... [ OK ]"
;;
restart)
$0 stop
$0 start
;;
status)
iptables-save > /var/log/firewall |less
cat /var/firewall/firewall
;;
stop)
iptables -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -F
iptables -t nat -P PREROUTING ACCEPT
iptables -t mangle -F
iptables -t mangle -P PREROUTING ACCEPT
echo "stoping firewall..."
;;
*)
echo "usage: {start|stop|restart}"
exit 1
esac
exit 0

phrich
(usa Slackware)

Enviado em 22/01/2013 - 16:26h

Cara eu dei uma lida muito rápida no seu script, mas pelo q vi, falta uma organização nele, tente fazer da seguinte forma:

# AJUSTES
Variáveis
Roteamento
Politicas padrões
etc

# REGRAS DE NAT

# REGRAS DE INPUT

# REGRAS DE OUTPUT

# REGRAS DE FORWARD

Carlos_Cunha
(usa Linux Mint)

Enviado em 22/01/2013 - 20:59h

Realmente faça isso que o colega disse, pois isso esta bagunça...
Outra coisa se seu firewall é o gateway da rede então a internet vai nele e depois nos outros certo, então a regra deveria ser de INPUT, porem se ele so faz o roteamente e faz aquele DNAT, além disso se sua politica de FORWARD for drop, então precisa dessa também...

ederlopes7
(usa CentOS)

Enviado em 22/01/2013 - 23:17h

Boiei agora... hehehheheh

como arrumar esta bagunça ae??? rs.. dah umas dicas

phrich
(usa Slackware)

Enviado em 23/01/2013 - 08:57h

http://www.vivaolinux.com.br/artigo/Iptables-Seguranca-total-para-sua-rede/

Carlos_Cunha
(usa Linux Mint)

Enviado em 23/01/2013 - 20:03h

hehe pelo geito não foi vc que fez esse script, mas da nada...
Pega a dica do colega ali e tem mais coisas ai na VOL
Boa Sorte...

ederlopes7
(usa CentOS)

Enviado em 23/01/2013 - 23:06h

peguei aqui no VOL mesmo...
eu apenas modifiquei ele para o que eu precisava...


todos os redirecionamento que eu criei funciona perfeitamente... apenas a do Post não quer funcionar!!