Iptables v1.4.3.1: erro [RESOLVIDO]

1. Iptables v1.4.3.1: erro [RESOLVIDO]

lanaf
(usa Debian)

Enviado em 06/04/2009 - 10:58h

AI amigos da vol, estou com um problemina eu utilizo a versão debian lenny kernel 2.6.26,quando eu rodo o meu script de firewall aparece a seguinte menssagem:

iptables v1.4.3.1:
The "nat" table is not intended for filtering, the use of DROP is therefore inhibited.

Alguem poderia me ajudar com esse proble.
Valeu

0 0

Quote

2. Re: Iptables v1.4.3.1: erro [RESOLVIDO]

ST. RaLF
(usa Arch Linux)

Enviado em 06/04/2009 - 11:07h

Você esta usando DROP com NAT?

Posta a linha que esta com erro, ou todo o seu script.

0 0

Quote

3. Iptables v1.4.3.1: erro

lanaf
(usa Debian)

Enviado em 06/04/2009 - 11:29h

#!/bin/sh
#########################################
# IPTABLES
# Luiz Augusto
# andradefilho@pop.com.br
#########################################

case "$1" in
start)
echo "starting firewall..."

#Variáveis
IPTABLES="/sbin/iptables"
LANEXT=eth0
LANINT=eth1
LAN_NET="192.168.0.0/24"
ADMIN="192.168.0.123/32"
MAC=

#Módulos IPTABLES
modprobe ip_tables
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ipt_REJECT
modprobe ipt_MASQUERADE
modprobe ipt_state
modprobe ipt_multiport
modprobe iptable_mangle
modprobe ipt_limit
modprobe ipt_TOS

echo "#######################################"
echo "#IPTABLES"
echo "#Luiz Augusto"
echo "#andradefilho@pop.com.br"
echo "#######################################"

#Zera todas as regras do iptables
$IPTABLES -F
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F
$IPTABLES -X

#Politicas Padrao de NAT
$IPTABLES -t nat -P PREROUTING DROP
$IPTABLES -t nat -P OUTPUT ACCEPT

#Políticas Padrão
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT

#Ativar ip_forward
echo "1" > /proc/sys/net/ipv4/ip_forward

#Desabilitar respostas a comandos ping
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all

#************************************
#REDIRECIONAMENTO
#************************************
#$IPTABLES -t nat -A PREROUTING -p tcp -s $LANINT -d 0/0 -m multiport --dport 443,1863 -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -p tcp -s 0/0 -m multiport --sport 443,1863 -j ACCEPT

$IPTABLES -t nat -A PREROUTING -p tcp -i $LANEXT -s 0/0 --dport 10000 -j DNAT --to 192.168.0.2:22
$IPTABLES -t nat -A PREROUTING -p udp -s 0/0 --dport 5060 -j ACCEPT

#####################################
#TABELA MANGLE
#####################################

#Servico VOIP SIP ASTERISK
$IPTABLES -t mangle -A PREROUTING -p udp -s 0/0 --dport 5060 -j TOS --set-tos 0x10

#Servicos WEB FTP
$IPTABLES -t mangle -A PREROUTING -p tcp -i $LANEXT --sport 21 -j TOS --set-tos 0x10
$IPTABLES -t mangle -A PREROUTING -p tcp -i $LANEXT --sport 80 -j TOS --set-tos 0x10

$IPTABLES -t mangle -A OUTPUT -p tcp -o $LANEXT --dport 21 -j TOS --set-tos 0x10
$IPTABLES -t mangle -A OUTPUT -p tcp -o $LANEXT --dport 80 -j TOS --set-tos 0x10
echo " Tabela Mangle "
echo "ON ....................................................... [ OK ]"

#####################################
# FILTER NAT
#####################################

#Acesso ao Servidor
$IPTABLES -t nat -A PREROUTING -p tcp -s 192.168.0.2/32 -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -p tcp -s 192.168.0.123/32 -j ACCEPT

#Libera SSH
$IPTABLES -t nat -A PREROUTING -p tcp -i $LANEXT -s 0/0 --dport 22 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p tcp -i $LANINT -s $ADMIN --dport 22 -j ACCEPT
echo "Ativado a liberacao da porta 22"
echo "ON ....................................................... [ OK ]"

#Liberar DNS Interno
$IPTABLES -t nat -A PREROUTING -p udp -i $LANINT -s $LAN_NET --dport 53 -j ACCEPT
echo "Liberar porta DNS Interno"
echo "ON ....................................................... [ OK ]"

#Liberar DHCP Server Interno
$IPTABLES -t nat -A PREROUTING -p tcp -i $LANINT -s $LAN_NET --dport 67 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p udp -i $LANINT -s $LAN_NET --dport 67 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p tcp -i $LANINT -s $LAN_NET --dport 68 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -p udp -i $LANINT -s $LAN_NET --dport 68 -j ACCEPT
echo "Liberar porta DHCP Server Interno"
echo "ON ....................................................... [ OK ]"

#Liberar SAMBA para rede Interna
#$IPTABLES -t nat -A PREROUTING -p tcp -i $LANINT -s $LAN_NET --dport 139 -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -p udp -i $LANINT -s $LAN_NET --dport 139 -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -p udp -i $LANINT -s $LAN_NET --dport 138 -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -p udp -i $LANINT -s $LAN_NET --dport 137 -j ACCEPT
#echo "Liberar porta SAMBA Interno"
#echo "ON ....................................................... [ OK ]"

#Liberar Proxy para rede interna
$IPTABLES -t nat -A PREROUTING -p tcp -i $LANINT -s $LAN_NET --dport 3128 -j ACCEPT

#####################################
# FILTER INPUT
#####################################

#Asterisk
$IPTABLES -A INPUT -p udp -s 0/0 --dport 5060 -j ACCEPT

#Libera SSH
$IPTABLES -A INPUT -p tcp -i $LANEXT -s 0/0 --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp -i $LANINT -s $LAN_NET --dport 22 -j ACCEPT
echo "Ativado a liberacao da porta 22"
echo "ON ....................................................... [ OK ]"

#Liberar Proxy para rede interna
$IPTABLES -A INPUT -p tcp -i $LANINT -s $LAN_NET --dport 3128 -j ACCEPT

#Habilitando o LO interno
$IPTABLES -A INPUT -i lo -j ACCEPT
echo "Ativado o fluxo interno"
echo "ON ....................................................... [ OK ]"

#Liberar DNS Interno
$IPTABLES -A INPUT -p udp -i $LANINT -s $LAN_NET --dport 53 -j ACCEPT
echo "Liberar porta DNS Interno"
echo "ON ....................................................... [ OK ]"

#Liberar DHCP Server Interno
$IPTABLES -A INPUT -p tcp -i $LANINT -s $LAN_NET --dport 67 -j ACCEPT
$IPTABLES -A INPUT -p udp -i $LANINT -s $LAN_NET --dport 67 -j ACCEPT
$IPTABLES -A INPUT -p tcp -i $LANINT -s $LAN_NET --dport 68 -j ACCEPT
$IPTABLES -A INPUT -p udp -i $LANINT -s $LAN_NET --dport 68 -j ACCEPT
echo "Liberar porta DHCP Server Interno"
echo "ON ....................................................... [ OK ]"

#Liberar SAMBA para rede Interna
#$IPTABLES -A INPUT -p tcp -i $LANINT -s $LAN_NET --dport 139 -j ACCEPT
#$IPTABLES -A INPUT -p udp -i $LANINT -s $LAN_NET --dport 139 -j ACCEPT
#$IPTABLES -A INPUT -p udp -i $LANINT -s $LAN_NET --dport 138 -j ACCEPT
#$IPTABLES -A INPUT -p udp -i $LANINT -s $LAN_NET --dport 137 -j ACCEPT
#echo "Liberar porta SAMBA Interno"
#echo "ON ....................................................... [ OK ]"

#Libera as portas principais do servidor
$IPTABLES -A INPUT -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A INPUT -m state --state RELATED -j ACCEPT
$IPTABLES -A INPUT -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -m state --state INVALID -j DROP
echo "Ativado a liberação das portas principais"

######################################
# FILTER OUTPUT
######################################
#Habilitando o icmp interno
$IPTABLES -A OUTPUT -o lo -j ACCEPT

##########################################################
# FILTER FORWARD
######################################
#Roteamento de placas de REDE iptables
#$IPTABLES -A FORWARD -s 0/0 -d 0/0 -j DROP
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state NEW -j ACCEPT
$IPTABLES -A FORWARD -m state --state INVALID -j ACCEPT
#Liberar Servidor PRXTESTE
$IPTABLES -A FORWARD -s 192.168.0.2/32 -p tcp -j ACCEPT
$IPTABLES -A FORWARD -s 0/0 -d 192.168.0.2/32 -p tcp -j ACCEPT
#$IPTABLES -A FORWARD -s 192.168.0.123/32 -p tcp -j ACCEPT
#$IPTABLES -A FORWARD -s 0/0 -d 192.168.0.123/32 -p tcp -j ACCEPT

#DNS
$IPTABLES -A FORWARD -p udp -s $LAN_NET --dport 53 -j ACCEPT

######################################
# PING-MORTE
######################################
#Bloqueio ping da morte
$IPTABLES -N PING-MORTE
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j PING-MORTE
$IPTABLES -A PING-MORTE -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A PING-MORTE -j DROP
echo "Ativado o bloqueio a tentativa de ataque ping da morte"
echo "ON ....................................................... [ OK ]"

####################################
# SYN ACK and FIN
####################################
#Bloqueio de scanners ocultos (Shealt Scan)
$IPTABLES -A FORWARD -p tcp --tcp-flags SYN,ACK, FIN, -m limit --limit 1/s -j ACCEPT
echo "Bloqueado scanners ocultos"
echo "ON ....................................................... [ OK ]"

######################################
# SSH-BRUT-FORCE
######################################
#Bloqueio de ataque ssh de força bruta
$IPTABLES -N SSH-BRUT-FORCE
$IPTABLES -A INPUT -i $LANEXT -p tcp --dport 22 -j SSH-BRUT-FORCE
$IPTABLES -A SSH-BRUT-FORCE -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A SSH-BRUT-FORCE -j DROP
echo "Ativado o bloqueio a tentativa de ataque do tipo SSH-BRUT-FORCE"
echo "ON ....................................................... [ OK ]"

############################
# BLOQUEANDO MSN
############################
#$IPTABLES -t nat -I PREROUTING -p TCP --dport 1863 -j DROP
#$IPTABLES -t nat -I PREROUTING -d loginnet.passport.com -j DROP

#Habilita o roteamento da porta 80 para nosso Proxy transparente
$IPTABLES -t nat -A PREROUTING -i $LANINT -p tcp --dport 80 -j REDIRECT --to-port 3128
echo "Regra para proxy transparente habilitada"
echo "ON ....................................................... [ OK ]"

#Roteamento de interface
$IPTABLES -t nat -A POSTROUTING -s $LAN_NET -j MASQUERADE
echo "Ativado o redirecionamento ip_forward"

#Zera contadores
echo "FIREWALL CARREGADO COM SUCESSO!!"
echo "ON ....................................................... [ OK ]"
;;
restart)
$0 stop
$0 start
;;
status)
iptables-save > /var/log/firewall |less
cat /var/firewall/firewall
;;
stop)
iptables -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -F
iptables -t nat -P PREROUTING ACCEPT
iptables -t mangle -F
iptables -t mangle -P PREROUTING ACCEPT
echo "stoping firewall..."
;;
*)
echo "usage: {start|stop|restart}"
exit 1
esac
exit 0

0 0

Quote

4. Re: Iptables v1.4.3.1: erro [RESOLVIDO]

ST. RaLF
(usa Arch Linux)

Enviado em 06/04/2009 - 11:33h

O problema esta falando que não se usa NAT com DROP.

Tente comentar todas as suas linhas que contenha isto, e rode novamente o seu script, e verifique se o erro irá retornar.

0 0

Quote

5. Iptables

lanaf
(usa Debian)

Enviado em 06/04/2009 - 11:44h

É isso mesmo que vc disse, comentei a linha do PREROUTING que estava DROP, ai não apareceu mais o erro, valeu mesmo cara, mais se eu fosse dropar o nat como faria ou não tem como fazer isso?

0 0

Quote

6. Re: Iptables v1.4.3.1: erro [RESOLVIDO]

ST. RaLF
(usa Arch Linux)

Enviado em 06/04/2009 - 11:47h

Olha, a tradução NAT seria um "redirecionamento" de pacotes.
Já que os pacotes serão redirecionados, o FORWARD dá conta do recado. Pois vai ter que entrar por uma placa e sair por outra.

0 0

Quote

7. Iptables

lanaf
(usa Debian)

Enviado em 06/04/2009 - 11:59h

Blz, entendi, eu sou novo na area, e to apredendo agora, eu me atrapalho um pouco as vaezes com iptables, mais o pessoal aki na comunidade tem ajudado muito, VALEU MESMOS por ter tirado minha duvida e corrigido o erro.,

0 0

Quote