Proxy iptables

kenia_meriane
(usa Outra)

Enviado em 18/05/2010 - 14:27h

gente, sou nova no linux e estou fazendo um firewall aki para minha rede... eu peguei um iptables.conf de um colega aki no forum e dei umas modificadas para melhor me satisfazer... em tese o bixu esta funcionando, ele e proxy transparente e eu tive que direcionar manualmente todos os browsers para se conectar atraves do proxy... que no caso e o IP do servidor e a porta é 3128... ate ai, tudo blz, ta funcionando... so que se algum usuario retirar o proxy do navegador, ele consegue acessar normalmente qualquer conteudo, mesmo ele sendo bloqueado. teria como alguem me ajudar... segue abaixo meu proxy.

#!/bin/sh
#########################################
#
case "$1" in
start)
echo "starting firewall..."

#Variáveis
IPTABLES="/sbin/iptables"
LANEXT=eth0
LANINT=eth1
LAN_NET="10.0.0.0/16"
ADMIN="10.0.0.2/16"

#Módulos IPTABLES
modprobe ip_tables
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ipt_REJECT
modprobe ipt_MASQUERADE
modprobe ipt_state
modprobe ipt_multiport
modprobe iptable_mangle
modprobe ipt_limit
modprobe ipt_TOS

#Zera todas as regras do iptables
$IPTABLES -F
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F
$IPTABLES -X

#Politicas Padrao de NAT
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT

#Políticas Padrão
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT

#Ativar ip_forward
echo "1" > /proc/sys/net/ipv4/ip_forward

#####################################
# FILTER NAT
#####################################

#Acesso ao Servidor
$IPTABLES -t nat -A PREROUTING -p tcp -s 10.0.0.1/16 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p tcp -s 192.168.0.0/24 -j ACCEPT

#Libera SSH
$IPTABLES -t nat -A PREROUTING -p tcp -i $LANEXT -s 0/0 --dport 22 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p tcp -i $LANINT -s $LAN_NET --dport 22 -j ACCEPT
echo "Ativado a liberacao da porta 22"
echo "ON ....................................................... [ OK ]"

#Liberar DNS Interno
$IPTABLES -t nat -A PREROUTING -p udp -i $LANINT -s $LAN_NET --dport 53 -j ACCEPT
echo "Liberar porta DNS Interno"
echo "ON ....................................................... [ OK ]"

#Liberar SAMBA para rede Interna
$IPTABLES -t nat -A PREROUTING -p tcp -i $LANINT -s $LAN_NET --dport 139 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p udp -i $LANINT -s $LAN_NET --dport 139 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p udp -i $LANINT -s $LAN_NET --dport 138 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p udp -i $LANINT -s $LAN_NET --dport 137 -j ACCEPT
echo "Liberar porta SAMBA Interno"
echo "ON ....................................................... [ OK ]"

#Liberar Proxy para rede interna
$IPTABLES -t nat -A PREROUTING -p tcp -i $LANINT -s $LAN_NET --dport 3128 -j ACCEPT

#####################################
# FILTER INPUT
#####################################

#Asterisk
$IPTABLES -A INPUT -p udp -s 0/0 --dport 5060 -j ACCEPT

#Libera SSH
$IPTABLES -A INPUT -p tcp -i $LANEXT -s 0/0 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -i $LANINT -s $LAN_NET --dport 22 -j ACCEPT

#Liberar Proxy para rede interna
$IPTABLES -A INPUT -p tcp -i $LANINT -s $LAN_NET --dport 3128 -j ACCEPT

#Habilitando o LO interno
$IPTABLES -A INPUT -i lo -j ACCEPT
echo "Ativado o fluxo interno"
echo "ON ....................................................... [ OK ]"

#Liberar DNS Interno
$IPTABLES -A INPUT -p udp -i $LANINT -s $LAN_NET --dport 53 -j ACCEPT
echo "Liberar porta DNS Interno"
echo "ON ....................................................... [ OK ]"

#Liberar SAMBA para rede Interna
$IPTABLES -A INPUT -p tcp -i $LANINT -s $LAN_NET --dport 139 -j ACCEPT
$IPTABLES -A INPUT -p udp -i $LANINT -s $LAN_NET --dport 139 -j ACCEPT
$IPTABLES -A INPUT -p udp -i $LANINT -s $LAN_NET --dport 138 -j ACCEPT
$IPTABLES -A INPUT -p udp -i $LANINT -s $LAN_NET --dport 137 -j ACCEPT
echo "Liberar porta SAMBA Interno"
echo "ON ....................................................... [ OK ]"

#Libera as portas principais do servidor
$IPTABLES -A INPUT -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -m state --state RELATED -j ACCEPT
$IPTABLES -A INPUT -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -m state --state INVALID -j DROP
echo "Ativado a liberação das portas principais"
echo "ON ....................................................... [ OK ]"

######################################
# FILTER OUTPUT
######################################
#Habilitando o icmp interno
$IPTABLES -A OUTPUT -o lo -j ACCEPT

##########################################################
# FILTER FORWARD
##########################################################
#Roteamento de placas de REDE iptables
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state NEW -j ACCEPT
$IPTABLES -A FORWARD -m state --state INVALID -j ACCEPT
#Liberar Servidor
$IPTABLES -A FORWARD -s 10.0.0.1/16 -p tcp -j ACCEPT
$IPTABLES -A FORWARD -s 0/0 -d 10.0.0.1/16 -p tcp -j ACCEPT
#DNS
$IPTABLES -A FORWARD -p udp -s $LAN_NET --dport 53 -j ACCEPT
#OUTLOOK
$IPTABLES -A FORWARD -p TCP -s $LAN_NET --dport 1025 -j ACCEPT
$IPTABLES -A FORWARD -p TCP -s $LAN_NET --dport 110 -j ACCEPT
$IPTABLES -A FORWARD -p tcp --sport 1025 -j ACCEPT
$IPTABLES -A FORWARD -p tcp --sport 110 -j ACCEPT
echo "Liberando OUTLOOK"
echo "ON ....................................................... [ OK ]"

######################################
# PING-MORTE
######################################
#Bloqueio ping da morte
$IPTABLES -N PING-MORTE
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j PING-MORTE
$IPTABLES -A PING-MORTE -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A PING-MORTE -j DROP
echo "Ativado o bloqueio a tentativa de ataque ping da morte"
echo "ON ....................................................... [ OK ]"

####################################
# SYN ACK and FIN
####################################
#Bloqueio de scanners ocultos (Shealt Scan)
$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,ACK, FIN, -m limit --limit 1/s -j ACCEPT
echo "Bloqueado scanners ocultos"
echo "ON ....................................................... [ OK ]"

######################################
# SSH-BRUT-FORCE
######################################
#Bloqueio de ataque ssh de força bruta
$IPTABLES -N SSH-BRUT-FORCE
$IPTABLES -A INPUT -i $LANEXT -p tcp --dport 22 -j SSH-BRUT-FORCE
$IPTABLES -A SSH-BRUT-FORCE -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A SSH-BRUT-FORCE -j DROP
echo "Ativado o bloqueio a tentativa de ataque do tipo SSH-BRUT-FORCE"
echo "ON ....................................................... [ OK ]"

#Habilita o roteamento da porta 80 para nosso Proxy transparente
$IPTABLES -t nat -A PREROUTING -i $LANINT -p tcp --dport 80 -j REDIRECT --to-port 3128
echo "Regra para proxy transparente habilitada"
echo "ON ....................................................... [ OK ]"

#Libera Conectividade Segura - CEF
$IPTABLES -t nat -I PREROUTING -i $LANEXT -d 200.201.174.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
$IPTABLES -t nat -A PREROUTING -i $LANEXT -d www.caixa.gov.br -p tcp --dport 80 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i $LANEXT -d www1.caixa.gov.br -p tcp --dport 80 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i $LANEXT -d cmt.caixa.gov.br -p tcp --dport 80 -j ACCEPT
$IPTABLES -t nat -I PREROUTING -d 200.201.174.207 -j ACCEPT
$IPTABLES -t nat -I PREROUTING -s 200.201.174.207 -j ACCEPT
$IPTABLES -A INPUT -i $LANINT -p udp -s 200.201.174.207 -j ACCEPT
$IPTABLES -A INPUT -i $LANEXT -p udp -s 200.201.174.207 -j ACCEPT
$IPTABLES -A INPUT -p tcp --destination-port 2631:2631 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --destination-port 2631:2631 -j ACCEPT
$IPTABLES -I FORWARD -p tcp --dport 80 -s $LAN_NET -d 200.201.174.0/24 -j ACCEPT
$IPTABLES -I FORWARD -p tcp --dport 21 -d 200.201.174.207 -j ACCEPT
$IPTABLES -I FORWARD -p tcp --dport 80 -d 200.201.174.207 -j ACCEPT
$IPTABLES -I FORWARD -p tcp --dport 20001:20005 -s 200.201.174.207 -j ACCEPT
$IPTABLES -I FORWARD -p tcp --dport 20000:20019 -d 200.201.174.207 -j ACCEPT
$IPTABLES -I FORWARD -p tcp -s 200.201.174.207 -m state --state ESTABLISHED,RELATED -j ACCEPT
echo "Liberar Conectividade Segura - CEF"
echo "ON ....................................................... [ OK ]"

#Roteamento de interface
$IPTABLES -t nat -A POSTROUTING -o $LANEXT -j MASQUERADE
echo "Ativado o redirecionamento ip_forward"
echo "ON ....................................................... [ OK ]"

#Zera contadores
echo "FIREWALL CARREGADO COM SUCESSO!!"
echo "ON ....................................................... [ OK ]"
;;
restart)
$0 stop
$0 start
;;
status)
iptables-save > /var/log/firewall |less
cat /var/firewall/firewall
;;
stop)
iptables -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -F
iptables -t nat -P PREROUTING ACCEPT
iptables -t mangle -F
iptables -t mangle -P PREROUTING ACCEPT
echo "stoping firewall..."
;;
*)
echo "usage: {start|stop|restart}"
exit 1
esac
exit 0

totonho
(usa Debian)

Enviado em 18/05/2010 - 14:54h

kenia, por que nao cria um transparente?

renato_pacheco
(usa Debian)

Enviado em 18/05/2010 - 15:03h

Para bloquear isso, basta bloquear a entrada direta pela porta 80:

iptables -A INPUT -s SUA_REDE -p tcp --dport 80 -j DROP

Considerando q SUA_REDE esteja baseado neste exemplo: 192.168.1.0/24

fbsalvi
(usa Outra)

Enviado em 19/05/2010 - 09:10h

como disse o renato drop na porta 80...