pablokapp
(usa Debian)
Enviado em 29/01/2014 - 16:24h
junior.rocha escreveu:
Amigo, coloca aqui seu arquivo do firewall (iptables) original, sem a alteração que eu sugeri a você.
#!/bin/bash
firewall_start() {
/sbin/modprobe ip_nat_ftp
/sbin/modprobe iptable_nat
modprobe iptable_nat
echo "==============================================="
echo "| :: ATIVANDO IPTABLES :: |"
echo "==============================================="
iptables -F
iptables -t nat -F
iptables -t mangle -F
##############Compartilhando Conexão############
# PERMITE A VOLTA DOS PACOTES RELACIONADOS AS CONEXOES
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# LIBERA TRAFEGO NA LOOPBACK
iptables -A INPUT -i lo -j ACCEPT
# DESTINA OS PACOTES DA REDE LOCAL, PORTA 80, A SEREM ENCAMINHADOS PARA O SQUID
#iptables -t nat -A PREROUTING -s 192.168.75.0/24 -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
#iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 3130
# MASCARANDO E ROTEANDO OS PACOTES PARA PLACA DE REDE DE INTERNET
iptables -t nat -A POSTROUTING -s xxx.xx.xxx.xx/24 -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# LIBERANDO O ROTEAMENTO POR KERNEL
echo 1 >/proc/sys/net/ipv4/ip_forward
##################INTERNA#######################
# LIBERA PROXY
iptables -A INPUT -p tcp -m tcp -s 192.168.75.0/24 --dport 3128 -j ACCEPT
# LIBERA SAMBA
iptables -A INPUT -p udp -m udp -s 192.168.75.0/24 --dport 137 -j ACCEPT
iptables -A INPUT -p udp -m udp -s 192.168.75.0/24 --dport 138 -j ACCEPT
iptables -A INPUT -p tcp -m tcp -s 192.168.75.0/24 --dport 139 -j ACCEPT
iptables -A INPUT -p tcp -m tcp -s 192.168.75.0/24 --dport 445 -j ACCEPT
#################Ãrea de Trabalho Remota###########
iptables -A FORWARD -p tcp --dport 3389 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 3389 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 3389 -j ACCEPT
iptables -t nat -A PREROUTING -d xxx.xx.xxx.xx -p tcp --dport 3390 -j DNAT --to 192.168.75.198:3389
iptables -t nat -A PREROUTING -d xxx.xx.xxx.xx -p tcp --dport 3392 -j DNAT --to 192.168.75.162:3389
iptables -t nat -A PREROUTING -d xxx.xx.xxx.xx -p tcp --dport 37777 -j DNAT --to 192.168.75.248:37777
iptables -t nat -A PREROUTING -d xxx.xx.xxx.xx -p tcp --dport 3391 -j DNAT --to 192.168.75.171:3389
################## SEGURANCA ###################
# FLOODING POR ICMP LIMITANDO POR 10 SEGUNDOS
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 10/s -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -A INPUT -p icmp -j ACCEPT
# CONTRA OS "PING OF DEATH"
iptables -t filter -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
# CONTRA ATAQUES DO TIPO "SYN-FLOOD E DOS"
iptables -t filter -A FORWARD -p tcp -m limit --limit 1/s -j ACCEPT
# CONTRA PACOTES DANIFICADOS OU SUSPEITOS
iptables -t filter -A FORWARD -m state --state INVALID -j DROP
iptables -A INPUT -m state --state INVALID -j DROP
# ATAQUES DE IP SPOOFING
echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter
iptables -A INPUT -m state --state INVALID -j DROP
#DELAY MINIMO PARA NAVEGACAO WEB
iptables -t mangle -A OUTPUT -o ppp0 -p tcp --dport 53 -j TOS --set-tos Minimize-Delay
iptables -t mangle -A OUTPUT -o ppp0 -p tcp --dport 80 -j TOS --set-tos Minimize-Delay
iptables -A INPUT -p tcp --syn -s 192.168.75.0/255.255.255.0 -j ACCEPT
### "BLOQUEIA TODAS CONEXõES DE ENTRADA CASO PROBLEMAS DESATIVAR"
echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_all
iptables -A INPUT -p tcp --syn -j DROP
###"Não responde a ping"
}
firewall_restart() {
firewall_stop
firewall_start
}
firewall_stop() {
echo "==========================================="
echo "| :: DESLIGANDO FIREWALL :: |"
echo "==========================================="
iptables -F
iptables -t nat -F
iptables -t mangle -F
echo "Limpando todas as regras .................[ OK ]"
}
case "$1" in
'start')
firewall_start
;;
'stop')
firewall_stop
;;
'restart')
firewall_restart
;;
*)
firewall_start
esac
