xlinux
(usa Ubuntu)
Enviado em 04/10/2013 - 16:30h
segue
#!/bin/sh
# Start/stop/restart the iptables.
# Start firewall:
firewall_start() {
echo "Starting iptables"
## CARREGAR MODULOS DE FIREWALL ##
modprobe ip_nat_ftp
modprobe ip_tables
##COMPARTILHANDO A INTERNET
echo 0 > /proc/sys/net/ipv4/conf/all/log_martians
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 1 > /proc/sys/net/ipv4/ip_dynaddr
## LIMPANDO TABELAS ##
/sbin/iptables -t filter -F INPUT
/sbin/iptables -t filter -F FORWARD
/sbin/iptables -t filter -F OUTPUT
/sbin/iptables -t nat -F PREROUTING
/sbin/iptables -t nat -F POSTROUTING
/sbin/iptables -t nat -F OUTPUT
/sbin/iptables -t mangle -F PREROUTING
/sbin/iptables -t mangle -F INPUT
/sbin/iptables -t mangle -F FORWARD
/sbin/iptables -t mangle -F OUTPUT
/sbin/iptables -t mangle -F POSTROUTING
## DEFININDO POLITICA PADRÃO ##
/sbin/iptables -t filter -P INPUT DROP
/sbin/iptables -t filter -P FORWARD DROP
/sbin/iptables -t filter -P OUTPUT ACCEPT
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
# REGRAS ##
IPTABLES="/sbin/iptables"
IFNET="eth0"
IFLAN="eth1"
#IFVPN="tun0"
# Manter conexoes jah estabelecidas para nao parar
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
## LIBERA LOOPBACK ##
$IPTABLES -t filter -A INPUT -j ACCEPT -i lo
## PROTEÇÕES
#PROTEGE CONTRA OS "PING OF DEATH"
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -m limit --limit 20/m -j ACCEPT
$IPTABLES -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 20/m -j ACCEPT
# Protege contra port scanners avançados (Ex.: nmap)
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 20/m -j ACCEPT
# Bloqueando tracertroute
$IPTABLES -A INPUT -p udp -s 0/0 -i eth0 --dport 33435:33525 -j REJECT
# Protecoes contra ataques
$IPTABLES -A INPUT -m state --state INVALID -j REJECT
## LIBERA RETORNO DE PACOTES ##
$IPTABLES -t filter -A INPUT -j ACCEPT -i $IFNET -m state --state ESTABLISHED,RELATED
$IPTABLES -t filter -A INPUT -j ACCEPT -i $IFLAN -m state --state ESTABLISHED,RELATED
$IPTABLES -t filter -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED
## LIBERA PARA LAN O ENVIO DE PING PARA WAN ##
$IPTABLES -t filter -A FORWARD -j ACCEPT -i $IFLAN -o $IFNET -p icmp
##REDIRECIONA AS REQUISIÇÕES PARA PROXY
$IPTABLES -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
$IPTABLES -t nat -A POSTROUTING -o eth1 -j MASQUERADE
## LIBERA ACESSO AO DNS SERVER PARA LAN##
$IPTABLES -t filter -A INPUT -j ACCEPT -i $IFLAN -s 192.168.1.0/24 -d 8.8.8.8 -p udp --dport 53
$IPTABLES -t filter -A INPUT -j ACCEPT -i $IFLAN -s 192.168.1.0/24 -d 8.8.4.4 -p udp --dport 53
# LIBERA O ACESSO A CLIENTES DE EMAIL,POP E SMTP
$IPTABLES -A FORWARD -p tcp -m multiport --dports 25,110,143,993,995 -j ACCEPT
# LIBERA O ACESSO AO http https FTP
$IPTABLES -A FORWARD -p tcp -m multiport --dports 21,80,443,80 -j ACCEPT
}
# Stop firewall:
firewall_stop() {
/sbin/iptables -t filter -F INPUT
/sbin/iptables -t filter -F FORWARD
/sbin/iptables -t filter -F OUTPUT
/sbin/iptables -t nat -F PREROUTING
/sbin/iptables -t nat -F POSTROUTING
/sbin/iptables -t nat -F OUTPUT
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
}
# Restart firewall:
firewall_restart() {
firewall_stop
sleep 1
firewall_start
}
case "$1" in
'start')
firewall_start
;;
'stop')
firewall_stop
;;
'restart')
firewall_restart
;;
*)
echo "usage $0 start|stop|restart"
esac
obrigado
