rubens_web
(usa Debian)
Enviado em 11/01/2012 - 14:59h
"saitam", coloquei os módulos conforme orientou. Mas NÃO funcionou no cliente. Funciona apenas quando eu config. o proxy no navegador do cliente. E o objetivo é não precisar configurar o PROXY no navegador do cliente.
meu "firewall.sh" atual
-------------------------
#!/bin/bash
start(){
echo "Firewall iniciando ....................... [OK]";
#limpa as regras
iptables -F
iptables -X
iptables -Z
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z
# eht0 = redelocal (onboard)
# eth1 = web (offboard)
##########POLITICA PADRAO
#-------------------------
echo "Politica padrao ativada";
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
#-------------------------
##########CARREGANDO MODULOS IPTABLES
#-------------------------------------
/sbin/modprobe ip_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_queue
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_tables
/sbin/modprobe iptable_nat
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe ipt_state
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_multiport
/sbin/modprobe ipt_mac
/sbin/modprobe ipt_string
#-------------------------------------
##########HABILITANDO COMPARTILHAMENTO DA INTERNET
#---------------------------------------------------
echo "Compartilhamento Ativado";
#modprobe iptable_nat
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A OUTPUT -s 192.168.1.0/24 -m multiport -p tcp --dport 80,53 -j ACCEPT
iptables -A OUTPUT -s 192.168.1.0/24 -m multiport -p udp --dport 80,53 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth1 -j MASQUERADE
iptables -A FORWARD -i eth0 -j ACCEPT
#---------------------------------------------------
##########PACOTES RECEBIDOS NA REDE LOCAL DIRECIONADO PARA SQUID(3128)
#---------------------------------------------------------------------------------
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
#---------------------------------------------------------------------------------
##########LIBERA PORTAS
#---------------------------------------------------
#LIBERA SSH (PUTTY)
echo "Portas ssh liberadas";
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
iptables -A FORWARD -p tcp --dport 22 -j ACCEPT
#---------------------------------------------------
echo "Firewall ativado! ........................ [OK]";
}
stop (){
#limpa as regras
iptables -F
iptables -X
iptables -Z
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z
#Politica padrao
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
echo "Firewall desativado .............................. [OK]";
}
case "$1" in
"start") start ;;
"stop") stop ;;
"reload") stop; start ;;
*)
echo "Use parametros start | stop | reload" ;;
esac
#----------------------------------------------------------------------
