O firewall esta bloqueando o FTP
1. O firewall esta bloqueando o FTP
andre_ramos
(usa openSUSE)
Enviado em 21/07/2009 - 09:20h
O firewall esta bloqueando o acesso ao FTP, nao consigo ter acesso, alguem poderia me ajudar? Como liberar o ftpsegue o scrip do firewall
grato
#!/bin/bash
iniciar () {
# Compartilha a conexao ----------------------------------------
IPTABLES=/usr/sbin/iptables
echo 1 > /proc/sys/net/ipv4/ip_forward
$IPTABLES -t nat -A POSTROUTING -o eth1 -j MASQUERADE
echo "Ativando compartilhamento!"
# Limpando Tabelas ----------------------------------------------
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
# Ativando modulos ----------------------------------------------
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe iptable_nat
modprobe ip_tables
modprobe ipt_LOG
modprobe ipt_REJECT
modprobe ipt_MASQUERADE
# Protecao contra spoofing --------------------------------------
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
# Proxy tranparente --------------------------------------------
$IPTABLES -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
# Politicas de acesso geral
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
########## loopback #############################################
$IPTABLES -A OUTPUT -p tcp --syn -s 127.0.0.1/255.0.0.0 -j ACCEPT
#----------------------------------------------------------------
# localhost
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT
################################################################
#######################
## Regras de Filtros ##
#######################
# Aceita pacotes que realmente devem entra----------------------
$IPTABLES -A INPUT -i ! eth1 -j ACCEPT
$IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED,NEW -j ACCEPT
$IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED,NEW -j ACCEPT
# Protecao contra worms ----------------------------------------
$IPTABLES -A FORWARD -p tcp --dport 135 -i eth0 -j ACCEPT
# Protecao contra syn-flood ------------------------------------
$IPTABLES -A FORWARD -p tcp --syn -m limit --limit 2/s -j ACCEPT
# Protecao contra port scanners --------------------------------
$IPTABLES -N SCANNER
$IPTABLES -A SCANNER -j DROP
$IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -i eth1 -j SCANNER
$IPTABLES -A INPUT -p tcp --tcp-flags ALL NONE -i eth1 -j SCANNER
$IPTABLES -A INPUT -p tcp --tcp-flags ALL ALL -i eth1 -j SCANNER
$IPTABLES -A INPUT -p tcp --tcp-flags ALL FIN,SYN -i eth1 -j SCANNER
$IPTABLES -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -i eth1 -j SCANNER
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -i eth1 -j SCANNER
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -i eth1 -j SCANNER
######### Conectividade Social ###################################
INTERNA=eth0 #placa de rede ligada a rede interna
CAIXA=200.201.174.0/24 # IP da Caixa a ser liberado para toda a rede
iptables -t nat -A PREROUTING -i $INTERNA -d 200.201.174.0/24 -j ACCEPT
iptables -t filter -A FORWARD -i $INTERNA -d 200.201.174.0/24 -j ACCEPT
########## Tabelas ################################################
# INPUT ( Pacotes que entra na rede)
$IPTABLES -A INPUT -p tcp -s 10.1.1.0/8 -d 201.76.49.33 --dport 110 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 10.1.1.0/8 -d 201.76.49.33 --dport 25 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 20 -j ACCEPT
# ftp
$IPTABLES -A INPUT -p tcp --dport 21 -j ACCEPT
# smtp
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
# ssh
$IPTABLES -A INPUT -p tcp --dport 25 -j ACCEPT
# dns
$IPTABLES -A INPUT -p udp --dport 53 -j ACCEPT
# pop3
$IPTABLES -A INPUT -p tcp --dport 110 -j ACCEPT
# http
$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT
# HTTPS
$IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 563 -j ACCEPT
#--------------------------------------------------------------------
# OUTPUT ( Pacotes que sai da rede)
$IPTABLES -A OUTPUT -p tcp -s 10.1.1.0/8 -d 201.76.49.33 --dport 110 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -s 10.1.1.0/8 -d 201.76.49.33 --dport 25 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 20 -j ACCEPT
# ftp
$IPTABLES -A OUTPUT -p tcp --dport 21 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --sport 20 -j ACCEPT
# ftp
$IPTABLES -A OUTPUT -p tcp --sport 21 -j ACCEPT
# smtp
$IPTABLES -A OUTPUT -p tcp --dport 25 -j ACCEPT
# ssh
$IPTABLES -A OUTPUT -p tcp --dport 25 -j ACCEPT
# dns
$IPTABLES -A OUTPUT -p udp --dport 53 -j ACCEPT
# pop3
$IPTABLES -A OUTPUT -p tcp --dport 110 -j ACCEPT
# httpd
$IPTABLES -A OUTPUT -p tcp --dport 80 -j ACCEPT
# HTTPS
$IPTABLES -A OUTPUT -p tcp --dport 443 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 563 -j ACCEPT
#--------------------------------------------------------------------
# FORWARD - REDE LOCAL
$IPTABLES -A FORWARD -p tcp --dport 20 -j ACCEPT
# ftp
$IPTABLES -A FORWARD -p tcp --dport 21 -j ACCEPT
# SSH
$IPTABLES -A FORWARD -p tcp --dport 22 -j ACCEPT
# smtp
$IPTABLES -A FORWARD -p tcp --dport 25 -j ACCEPT
# SMTP
$IPTABLES -A FORWARD -p tcp --sport 25 -j ACCEPT
# dns
$IPTABLES -A FORWARD -p udp --dport 53 -j ACCEPT
# pop3
$IPTABLES -A FORWARD -p tcp --dport 110 -j ACCEPT
# pop3
$IPTABLES -A FORWARD -p tcp --sport 110 -j ACCEPT
# POP
$IPTABLES -A FORWARD -p tcp --dport 8333 -j ACCEPT
# HTTPS
$IPTABLES -A FORWARD -p tcp --dport 443 -j ACCEPT
$IPTABLES -A FORWARD -p tcp --dport 563 -j ACCEPT
# msn
$IPTABLES -A FORWARD -s 10.1.1.0/8 -p tcp --dport 1863 -j REJECT
$IPTABLES -A FORWARD -s 10.1.1.0/8 -p tcp --dport 1864 -j REJECT
$IPTABLES -A FORWARD -s 10.1.1.0/8 -j ACCEPT
########################################################################
echo "Firewall Ativado"
}
parar(){
echo "Regras de firewall e compartilhamento desativados"
}
case "$1" in
"start") iniciar ;;
"stop") parar ;;
"restart") parar; iniciar ;;
*) echo "Use os parametros start ou stop"
esac