Squid e Iptables com uma placa de rede [RESOLVIDO]
1. Squid e Iptables com uma placa de rede [RESOLVIDO]
LeonardoKadina
(usa Ubuntu)
Enviado em 01/12/2009 - 16:39h
Pessoal, estou novamente com um problema no meu firewall, preciso configurar a minha internet direta em um roteador e um firewall com squid na rede todas as maquinas irão usar IP fixo então o que eu preciso é subir o iptables com o squid e assim gerenciar o trafego a internet. Já tenho um script de firewall na mesma empresa funcionando perfeitamente, só que ele rola com 2 placas de rede (eth0 com o ip de internet e eth1 com a rede local). Neste novo firewall ira somente funcionar eth0, e as maquinas irei jogar o gateway, que será o ip do meu firewall X squid. Não sei como faço!estou mandando o meu script do firewall.
A detalhe irei fazer isso somente porque tenho um 2003 e não consegui configurar o acesso remoto a porta 3389 no Terminal Server, se puder me ajudar também e bem melhor direto com o Firewall.
Agradeço desde já pela ajuda!
Segue Script do meu Firewall!
Firewall!
-->
#! /bin/bash
iniciar(){
#Carregar moduloss
modprobe iptable_nat
modprobe ip_tables
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe iptable_filter
modprobe iptable_mangle
modprobe ipt_LOG
modprobe ip_gre
modprobe ipt_MASQUERADE
modprobe ip_nat
modprobe ip_nat_ftp
modprobe ipt_limit
printf "Modulos carreagdos.\n"
printf "*****************************ok********************************* \n"
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
printf "Limpando tabelas e setando variaveis do kernel.. \n"
printf "*****************************ok********************************* \n"
#Definir regras
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
echo "Regras definidas."
printf "*****************************ok********************************* \n"
#Abilitando comunicação entre as placas de rede.
echo 1 > /proc/sys/net/ipv4/ip_forward
printf "Roteamento ativos.\n"
printf "*****************************ok********************************* \n"
# Evitando Spoofing de Rede
echo "1" > /proc/sys/net/ipv4/conf/default/rp_filter
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/default/accept_source_route
printf "Protecao contra Spoofing ativas.\n"
printf "*****************************ok********************************* \n"
# Evitando um Overflow de pacotes TCP
echo "1" > /proc/sys/net/ipv4/tcp_abort_on_overflow
printf "Protecao contra Overflow de pacotes TCP ativas.\n"
printf "*****************************ok********************************* \n"
# Tentando Evitar DDOS,DOS e SYN-FLOOD
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "0" > /proc/sys/net/ipv4/conf/default/accept_source_route
printf "Protecao contra DDOS,DOS e SYN-FLOOD ativas.\n"
printf "*****************************ok********************************* \n"
#Protecao conta Ping da morte
printf "Protecao contra PING DA MORTE ativas.\n"
printf "*****************************ok********************************* \n"
#iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
#Proteçao contra portscan stealth.
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
printf "Protecao contra PROT SACN STEALTH ativas.\n"
printf "*****************************ok********************************* \n"
#********************************* REGRAS OUTPT ************************************
# *
#***********************************************************************************
#********************************* REGRAS INPUT ************************************
# *
#***********************************************************************************
# Abre a faixa de ip.
iptables -A INPUT -s 192.168.204.0/255.255.255.0 -j ACCEPT
#cira um masquerade.
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# Abre as portas 3389 / 22 / 21 (inclusive para a Internet):
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
# NET
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
# Impede pacotes mal formados
iptables -A INPUT -m state --state INVALID -j DROP
# Abre o trafego interno
iptables -A INPUT -i lo -j ACCEPT
printf "Abre comunicacao para interface interna ativas.\n"
printf "*****************************ok********************************* \n"
#Proxy transparente e Term. Server
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
printf "Proxtransparente ativado.\n"
printf "*****************************ok********************************* \n"
#***********************************************************************#
# echo "Direcionando Terminal Server" *
#***********************************************************************#
#******************************** REGRAS FORWARD ***********************************
# *
#***********************************************************************************
iptables -A FORWARD -p tcp -i eth0 --dport 2000 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 8080 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 5900 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 5222 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 3389 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 -s 192.168.204.0/24 --dport 3128 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 -s 192.168.204.0/24 --sport 3128 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 1719 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --sport 1723 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 1723 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 4156 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 809 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 143 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --sport 143 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --sport 443 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 110 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --sport 110 -j ACCEPT
iptables -A FORWARD -p udp -i eth0 --dport 53 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --sport 53 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 -s 192.168.204.0/24 --dport 53 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 -s 192.168.204.0/24 --sport 53 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --sport 80 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 -s 192.168.204.0/24 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 -s 192.168.204.0/24 --sport 80 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --sport 25 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 47 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --sport 47 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 22 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 21 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 20 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --sport 21 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp -i eth0 --sport 25 -j ACCEPT
printf "Fechando as demais portas. \n"
printf "*****************************ok********************************* \n"
iptables -A FORWARD -p tcp -i eth0 -j DROP
iptables -A FORWARD -p udp -i eth0 -j DROP
iptables -A INPUT -p tcp -i eth0 -j DROP
iptables -A INPUT -p udp -i eth0 -j DROP
printf "Regras de firewall ativadas.\n"
printf "*****************************ok********************************* \n"
}
status(){
iptables -L
}
parar(){
iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
printf "Regras de firewall desativadas.\n"
}
case "$1" in
"start") iniciar ;;
"stop") parar ;;
"status") status ;;
"restart") parar; iniciar ;;
*) echo "Use os parametros stop|start|status|restart"
esac