Conectar terminal server remoto

xoff
(usa RedHat)

Enviado em 13/10/2008 - 20:49h

Olá galera,
Estou com um problema na saida da minha rede local para meus clientes Ruindows server.

Tenho um server Ubuntu compartilhando um link de internet para minha rede local.

Nas regras do iptables qual a regra que utilizo para liberar uma conexão da porta 3389 para fora????

quando ligo o link de internet direto numa maquina windows eu conecto nos meus clientes, mas quando coloco pelo servidor linux, não sai nem a pau, alguem pode me ajudar??????

Regras do meu iptables:
echo "Definindo as variaveis"

IPTABLES="iptables"
REDEINT="192.168.0.0/24"
IPDNSPROVEDOR="200.189.80.5"
INT="eth1"
EXT="eth0"
TROJAN_PORTS_TCP="12345,12346,1524,27665,31337"
TROJAN_PORTS_UDP="12345,12346,27444,31335,31337"
WORM_PORTS="33270,1234,6711,16660,60001,6000,6001,6002,10999"

######################################################################
# politica de seguraca#
echo "polices padroes"

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT


#########################################


echo "SYN Cookie Protection"
echo "1" > /proc/sys/net/ipv4/tcp_syncookies

echo "Disable response to ping"
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all

echo "Disable response to broadcasts"
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

echo "Don't accept source routed packets"

echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/all/send_redirects

echo "Disable ICMP redirect acceptance"
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects

echo "Enable bad error message protection"
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

echo "Log spoofed packets, source routed packets, redirect packets"
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians

echo "Turn on reverse path filtering"
for interface in /proc/sys/net/ipv4/conf/*/rp_filter; do
/bin/echo "1" > ${interface}
done

######################################################################

echo "limpando as tabelas"
$IPTABLES -F
$IPTABLES -t nat -F

######################################################################

echo "Protege contra os Ping of Death"
$IPTABLES -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

echo "Protege contra os ataques do tipo Syn-flood DoS etc"
$IPTABLES -A FORWARD -p tcp -m limit --limit 1/s -j ACCEPT

echo "Permitir repassamento NAT DNAT SNAT de pacotes etabilizados e os relatados ..."
$IPTABLES -A FORWARD -m state --state ESTABLISHED -j ACCEPT

echo "Logar os pacotes mortos por inatividade ..."
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3

echo "Protege contra port scanners"
$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT


echo "Performance - Setando acesso a web com delay minimo"
$IPTABLES -t mangle -A OUTPUT -o $EXT -p tcp --dport 53 -j TOS --set-tos Minimize-Delay
$IPTABLES -t mangle -A OUTPUT -o $EXT -p tcp --dport 80 -j TOS --set-tos Minimize-Delay

#echo "Deixa passar as portas UDP do servidores DNS e Rejeitar o restante"
#$IPTABLES -A INPUT -i $EXT -p udp -s $IPDNSPROVEDOR -j ACCEPT
#$IPTABLES -A INPUT -i $EXT -p udp -s $IPDNSPROVEDOR -j ACCEPT


echo "Responde pacotes icmp especificados e rejeita o restante"
$IPTABLES -A INPUT -i $EXT -p icmp --icmp-type host-unreachable -j ACCEPT
$IPTABLES -A INPUT -i $EXT -p icmp --icmp-type source-quench -j ACCEPT
$IPTABLES -A INPUT -i $EXT -p icmp -j REJECT --reject-with icmp-host-unreachable

echo "libera acesso interno da rede"
$IPTABLES -A INPUT -p tcp --syn -s $REDEINT -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --syn -s $REDEINT -j ACCEPT
$IPTABLES -A FORWARD -p tcp --syn -s $REDEINT -j ACCEPT

echo "libera o loopback"
#$IPTABLES -A INPUT -p tcp --syn -s 127.0.0.1/255.0.0.0 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --syn -s 127.0.0.1/255.0.0.0 -j ACCEPT

echo "libera conexoes de fora pra dentro"
$IPTABLES -A INPUT -p tcp --destination-port 3389 -j ACCEPT
$IPTABLES -A INPUT -p tcp --destination-port 3389 -j ACCEPT
#$IPTABLES -A INPUT -p tcp --destination-port 443 -j ACCEPT
#$IPTABLES -A INPUT -p tcp --destination-port 20 -j ACCEPT
#$IPTABLES -I INPUT -p tcp --destination-port 21 -j ACCEPT
$IPTABLES -I INPUT -p tcp --destination-port 22 -j LOG --log-prefix "SSH: "
$IPTABLES -I INPUT -p tcp --destination-port 22 -j ACCEPT



echo "libera conexoes de dentro pra fora"
$IPTABLES -A OUTPUT -p tcp --destination-port 80 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --destination-port 3306 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --destination-port 22 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --destination-port 20 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --destination-port 21 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --destination-port 86 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --destination-port 5190 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --destination-port 443 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --destination-port 8080 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --destination-port 3389 -j ACCEPT
$IPTABLES -A OUTPUT -p udp --destination-port 3389 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --destination-port 1000:65000 -j ACCEPT
$IPTABLES -A FORWARD -p tcp --destination-port 3389 -j ACCEPT
$IPTABLES -A FORWARD -P udp --destination-port 3389 -j ACCEPT

# libera saida de terminal server #
$IPTABLES -t nat -A PREROUNTING -s 192.168.0.0/24 -d 0/0 -j MASQUERADE

echo "Liberando NTP ntpd porta 123 para envio e recepç protoclo UDP"
$IPTABLES -A INPUT -i $EXT -p udp --dport 123 -j ACCEPT
$IPTABLES -A OUTPUT -o $INT -p udp --sport 123 -j ACCEPT



######################################################################

echo "Protecao contra trojans"
$IPTABLES -A INPUT -i $INT -p tcp -m multiport --dport $TROJAN_PORTS_TCP -j LOG --log-prefix "IPTABLES Trojan INT_IF: "
$IPTABLES -A INPUT -i $INT -p udp -m multiport --dport $TROJAN_PORTS_UDP -j LOG --log-prefix "IPTABLES Trojan INT_IF: "
$IPTABLES -A INPUT -i $INT -p tcp -m multiport --dport $TROJAN_PORTS_TCP -j DROP
$IPTABLES -A INPUT -i $INT -p udp -m multiport --dport $TROJAN_PORTS_UDP -j DROP
$IPTABLES -A INPUT -i $EXT -p tcp -m multiport --dport $TROJAN_PORTS_TCP -j LOG --log-prefix "IPTABLES Trojan EXT: "
$IPTABLES -A INPUT -i $EXT -p udp -m multiport --dport $TROJAN_PORTS_UDP -j LOG --log-prefix "IPTABLES Trojan EXT: "
$IPTABLES -A INPUT -i $EXT -p tcp -m multiport --dport $TROJAN_PORTS_TCP -j DROP
$IPTABLES -A INPUT -i $EXT -p udp -m multiport --dport $TROJAN_PORTS_UDP -j DROP

######################################################################

echo "Protecao contra worms"
$IPTABLES -A INPUT -i $INT -p tcp -m multiport --dport $WORM_PORTS -j LOG --log-prefix "IPTABLES WORM INT_IF: "
$IPTABLES -A INPUT -i $INT -p udp -m multiport --dport $WORM_PORTS -j LOG --log-prefix "IPTABLES WORM INT_IF: "
$IPTABLES -A INPUT -i $INT -p tcp -m multiport --dport $WORM_PORTS -j DROP
$IPTABLES -A INPUT -i $INT -p udp -m multiport --dport $WORM_PORTS -j DROP
$IPTABLES -A INPUT -i $EXT -p tcp -m multiport --dport $WORM_PORTS -j LOG --log-prefix "IPTABLES WORM EXT: "
$IPTABLES -A INPUT -i $EXT -p udp -m multiport --dport $WORM_PORTS -j LOG --log-prefix "IPTABLES WORM EXT: "
$IPTABLES -A INPUT -i $EXT -p tcp -m multiport --dport $WORM_PORTS -j DROP
$IPTABLES -A INPUT -i $EXT -p udp -m multiport --dport $WORM_PORTS -j DROP



echo "Bloqueia todas as portas udp"
$IPTABLES -A INPUT -i $EXT -p udp -j REJECT

echo "Bloqueia qualquer tentativa de conexao de fora para dentro por TCP"
$IPTABLES -A INPUT -i $EXT -p tcp --syn -j DROP

echo "Mesmo assim fechar todas as portas abaixo de 32000"
$IPTABLES -A INPUT -i $EXT -p tcp --dport :32000 -j DROP


echo "Protege contra pacotes que podem procurar e obter informacoes da rede interna ..."
$IPTABLES -A FORWARD --protocol tcp --tcp-flags ALL SYN,ACK -j DROP

echo "Bloqueando tracertroute"
$IPTABLES -A INPUT -p udp -s 0/0 -i $EXT --dport 33435:33525 -j DROP

echo "Protecoes contra ataques"
$IPTABLES -A INPUT -m state --state INVALID -j DROP

echo "Nada de pacotes fragmentados"
$IPTABLES -A INPUT -f -j DROP

# trava orkut

# iptables -I FORWARD -d www.orkut.com -p tcp --dport 443 -j DROP
# iptables -I INPUT -d www.orkut.com -p tcp --dport 443 -j DROP
# iptables -I FORWARD -d orkut.com -p tcp --dport 443 -j DROP
# iptables -I INPUT -d orkut.com -p tcp --dport 443 -j DROP

echo "bloqueia o resto"
# teste fredy

$IPTABLES -A INPUT -p tcp --syn -j DROP
$IPTABLES -A OUTPUT -p tcp --syn -j DROP
$IPTABLES -A FORWARD -p tcp --syn -j DROP
# ----------------------------------------------------------------

echo "Firewall carregado..."


echo "Mais regras"

echo "libera ssh de casa"
$IPTABLES -A INPUT -p tcp -s 192.168.0.0 --dport 22 -j ACCEPT

echo "bloqueia acesso ftp de fora e grava no log opcao abilitar ssh"
#$IPTABLES -A INPUT -p tcp --dport 22 -j LOG --log-prefix "IN: SSH "
#$IPTABLES -A INPUT -p tcp --dport 22 -j REJECT
$IPTABLES -A INPUT -p tcp --dport 23 -j LOG --log-prefix "IN: Telnet "
$IPTABLES -A INPUT -p tcp --dport 23 -j REJECT

echo "bloqueia acesso netbios de fora e da rede interna para fora"
$IPTABLES -A INPUT -p tcp --sport 137:139 -i $EXT -j DROP
$IPTABLES -A INPUT -p udp --sport 137:139 -i $EXT -j DROP
$IPTABLES -A FORWARD -p tcp --sport 137:139 -o $EXT -j DROP
$IPTABLES -A FORWARD -p udp --sport 137:139 -o $EXT -j DROP
$IPTABLES -A OUTPUT -p tcp --sport 137:139 -o $EXT -j DROP
$IPTABLES -A OUTPUT -p udp --sport 137:139 -o $EXT -j DROP

# libera o bittorrent - (nãtestado)
# troque o X.X.X.X pelo IP da máina correspondente
#$IPTABLES -A INPUT -p tcp --destination-port 1214 -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -i eth1 -p tcp --dport 1214 -j DNAT --to-dest X.X.X.X
#$IPTABLES -A FORWARD -p tcp -i eth1 --dport 1214 -d X.X.X.X -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -i eth1 -p udp --dport 1214 -j DNAT --to-dest X.X.X.X
#$IPTABLES -A FORWARD -p udp -i eth1 --dport 1214 -d X.X.X.X -j ACCEPT

# faz o icq receber arquivos - (nãtestado)
# troque o X.X.X.X pelo IP da máina correspondente
#$IPTABLES -A INPUT -p tcp --destination-port 2000:3000 -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -i eth1 -p tcp --dport 2000:3000 -j DNAT --to-dest X.X.X.X
#$IPTABLES -A FORWARD -p tcp -i eth1 --dport 2000:3000 -d X.X.X.X -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -i eth1 -p udp --dport 2000:3000 -j DNAT --to-dest X.X.X.X
#$IPTABLES -A FORWARD -p udp -i eth1 --dport 2000:3000 -d X.X.X.X -j ACCEPT


Se alguem puder me ajudar, desde já agradeço.