Comentário enviado por
jcms_eng em 18/03/2004:
#!/bin/sh
# Remember to set up the network interface card with IRQ and base address
# in syslinux.cfg if nessesary.
#
# Grabbing the config.
#
. /etc/config
ifconfig lo 127.0.0.1
#
# Inside:
#
ifconfig ${INSIDE_DEV} ${INSIDE_IP} netmask ${INSIDE_NETMASK} broadcast ${INSIDE_BROADCAST}
#
# Brad wanted these next 5 lines.
#
echo "INSIDE_DEVICE=${INSIDE_DEV}" > /etc/inside.info
echo "INSIDE_IP=${INSIDE_IP}" >> /etc/inside.info
echo "INSIDE_NETWORK=${INSIDE_NETWORK}" >> /etc/inside.info
echo "INSIDE_NETMASK=${INSIDE_NETMASK}" >> /etc/inside.info
echo "INSIDE_BROADCAST=${INSIDE_BROADCAST}" >> /etc/inside.info
#
# setting up /etc/hosts
#
echo "${INSIDE_IP} ${HOSTNAME}.${DOMAIN} ${HOSTNAME}" >> /etc/hosts
# setting up hostname
hostname ${HOSTNAME}
hostname -d ${DOMAIN}
echo "Hostname (fully qualified) set up to `hostname -f`"
#
# Tip from Jacco Kok.
#
if [ "$OUTSIDE_MAC" != "" ]
then
/bin/ifconfig ${OUTSIDE_DEV} hw ether ${OUTSIDE_MAC}
fi
#
# Outside
#
if [ ${OUTSIDE_IP} = 'DHCP' ];
then
echo "Booting udhcpc"
echo "OUTSIDE_DEVICE=${OUTSIDE_DEV}" > /etc/outside.info
HARGS=
[ "${HOSTNAME}" != "" ] && HARGS="-H ${HOSTNAME}"
if /bin/udhcpc -n -s /etc/udhcpcrenew.sh ${HARGS} -i ${OUTSIDE_DEV}; then
. /etc/outside.info
else
echo "duh!" # Or some more useful error handling
fi
else
if [ ${OUTSIDE_IP} = 'EXTERNAL' ];
then
/etc/ext-up.init
else
/bin/ifconfig ${OUTSIDE_DEV} ${OUTSIDE_IP} netmask ${OUTSIDE_NETMASK} broadcast ${OUTSIDE_BROADCAST}
#
# Default gateway
#
/bin/route add default gw ${DEFAULT_GATEWAY} metric 1
echo "Setting up name server (etc/resolv.conf) "
echo "domain ${DOMAIN}" >> /etc/resolv.conf
echo "search ${DOMAIN}" >> /etc/resolv.conf
echo "nameserver ${NAME_SERVER_IP1}" >> /etc/resolv.conf
echo "nameserver ${NAME_SERVER_IP2}" >> /etc/resolv.conf
echo "OUTSIDE_DEVICE=${OUTSIDE_DEV}" > /etc/outside.info
echo "OUTSIDE_IP=${OUTSIDE_IP}" >> /etc/outside.info
echo "OUTSIDE_GATEWAY=${DEFAULT_GATEWAY}" >> /etc/outside.info
echo "OUTSIDE_NETMASK=${OUTSIDE_NETMASK}" >> /etc/outside.info
echo "OUTSIDE_NETWORK=${OUTSIDE_NETWORK}" >> /etc/outside.info
echo "OUTSIDE_BROADCAST=${OUTSIDE_BROADCAST}" >> /etc/outside.info
echo "Setting up firewall rules: "
/etc/firewall.init
echo
fi # if EXTERNAL
fi # if DHCP
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
if [ -f /proc/sys/net/ipv4/conf/all/rp_filter ] ; then
echo "Enabling anti spoofing: "
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo -n " $f "
echo 1 > $f
done
else
echo "Anti spoofing is not available, the author of this floppy spoofed, mail him."
fi
#
# No umask so it ends up with 600 with both dhcp and PPPoE
# I'm lazy and place it here.
chmod 644 /etc/resolv.conf
#
# DHCP Daemon and DNS Cache.
#
p=`pidof dnsmasq`
if [ "${DHCP_DAEMON}" = "y" ];
then
/etc/udhcpd.conf.sh
udhcpd
[ $p ] || dnsmasq -i ${INSIDE_DEV}
else
if [ "${DNSMASQ}" = "y" ];
then
[ $p ] || dnsmasq -i ${INSIDE_DEV}
fi
fi
#!/bin/sh
# Firewall setup.
#
# This is a conversion of the ipchains/ipmasqadm based firewall.ini
# from the 1.x series of floppyfw, it's pretty simple and the
# corresponding ipchains rules are kept for references.
#
# Setting up iptables
#
. /etc/config
#
# Do you want to do port forwaring to an internal server?
# Set the server IP here and sort out the port stuff later in this file.
#
SERVER_IP=10.10.1.2
#
# Stopping forwarding (this script may be run during normal uptime because
# for re-lease of HDCP or demand dialing / PPPoE.
#
echo "0" > /proc/sys/net/ipv4/ip_forward
#
# Overriding the /etc/config and adding additional information.
#
. /etc/outside.info
. /etc/inside.info
#
# Brad suggested this:
# And he suggested to check and maybe change the formatting.
# We'll do that later.
#
echo "Starting firewall with the following config:"
echo
echo " Inside Outside"
echo " Network: ${INSIDE_NETWORK} ${OUTSIDE_NETWORK}"
echo " Device: ${INSIDE_DEVICE} ${OUTSIDE_DEVICE}"
echo "IP Address: ${INSIDE_IP} ${OUTSIDE_IP}"
echo " Netmask: ${INSIDE_NETMASK} ${OUTSIDE_NETMASK}"
echo " Broadcast: ${INSIDE_BROADCAST} ${OUTSIDE_BROADCAST}"
echo " Gateway: [None Set] ${OUTSIDE_GATEWAY}"
echo
#
# Flushing the chains.
#
iptables -F
iptables -t nat -F
iptables -X
iptables -Z # zero all counters
#
# Policy for chains DROP everything
#
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
#
# Good old masquerading.
#
iptables -t nat -A POSTROUTING -o ${OUTSIDE_DEVICE} -j MASQUERADE
#
# Forwarding outside ports to an internal server.
# This used to be the ipchains / ipmasqadm portfw commad.
#
# SSH:
iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 22 -j DNAT --to ${SERVER_IP}:22
iptables -A FORWARD -p tcp -d ${SERVER_IP} --dport 22 -o ${INSIDE_DEVICE} -j ACCEPT
# Web:
iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 80 -j DNAT --to ${SERVER_IP}:80
iptables -A FORWARD -p tcp -d ${SERVER_IP} --dport 80 -o ${INSIDE_DEVICE} -j ACCEPT
# Web Mail:
iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 32000 -j DNAT --to ${SERVER_IP}:32000
iptables -A FORWARD -p tcp -d ${SERVER_IP} --dport 32000 -o ${INSIDE_DEVICE} -j ACCEPT
#Redireciona o trafego da FNET sem passar pelo canal
iptables -A PREROUTING -t nat -p tcp -i eth1 -d 200.174.158.145 -j DNAT --to 10.10.1.2
iptables -A POSTROUTING -t nat -p tcp -d 10.10.1.2 -j SNAT --to 10.10.1.1
# SMTP
iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 25 -j DNAT --to ${SERVER_IP}:25
iptables -A FORWARD -p tcp -d ${SERVER_IP} --dport 25 -o ${INSIDE_DEVICE} -j ACCEPT
# POP-3
iptables -A PREROUTING -t nat -p tcp -d ${OUTSIDE_IP} --dport 110 -j DNAT --to ${SERVER_IP}:110
iptables -A FORWARD -p tcp -d ${SERVER_IP} --dport 110 -o ${INSIDE_DEVICE} -j ACCEPT
# FTP:
iptables -A FORWARD -p tcp -d ${SERVER_IP} --dport 21 -o ${INSIDE_DEVICE} -j ACCEPT
#
# Keep state.
#
iptables -A FORWARD -m state --state NEW -i ${INSIDE_DEVICE} -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW,INVALID -i ${OUTSIDE_DEVICE} -j DROP
#
# This is mainly for PPPoE usage but it won't hurt anyway so we'll just
# keep it here.
#
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
#
# We don't like the NetBIOS and Samba leaking..
#
iptables -t nat -A PREROUTING -p TCP -i ${INSIDE_DEVICE} --dport 135:139 -j DROP
iptables -t nat -A PREROUTING -p UDP -i ${INSIDE_DEVICE} --dport 137:139 -j DROP
iptables -t nat -A PREROUTING -p TCP -i ${INSIDE_DEVICE} --dport 445 -j DROP
iptables -t nat -A PREROUTING -p UDP -i ${INSIDE_DEVICE} --dport 445 -j DROP
#
# We would like to ask for names from our floppyfw box
#
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# Ping and friends.
iptables -A OUTPUT -p icmp -j ACCEPT # to both sides.
iptables -A INPUT -p icmp -j ACCEPT
# And also, DHCP, but we can basically accept anything from the inside.
iptables -A INPUT -i ${INSIDE_DEVICE} -j ACCEPT
iptables -A OUTPUT -o ${INSIDE_DEVICE} -j ACCEPT
#
# If the user wants to have the fake identd running, the identd has to
# be able to answer.
#
if [ ${FAKEIDENT} ]
then
iptables -A INPUT -p TCP --dport 113 -i ${OUTSIDE_DEVICE} -j ACCEPT
fi
#
# And, some attempt to get interactive sesions a bit more interactive
# under load:
#
iptables -A PREROUTING -t mangle -p tcp --sport ssh -j TOS --set-tos Minimize-Delay
iptables -A PREROUTING -t mangle -p tcp --sport ftp -j TOS --set-tos Minimize-Delay
iptables -A PREROUTING -t mangle -p tcp --sport ftp-data -j TOS --set-tos Maximize-Throughput
#
# Finally, list what we have
#
#
iptables -L
# If broken DNS:
#iptables -L -n
#
# This enables dynamic IP address following
#
echo 7 > /proc/sys/net/ipv4/ip_dynaddr
#
# Rules set, we can enable forwarding in the kernel.
#
echo "Enabling IP forwarding."
echo "1" > /proc/sys/net/ipv4/ip_forward
#
# Setando Numero de Conexoes
#
echo "65535" > /proc/sys/net/ipv4/ip_conntrack_max
bom, esses sao os arquivos de configuracao do syslinux. um configura a rede o outro o fire.
eu tenho algumas duvidas em relacao a configuracao...
a rede ta assim...
o servidor DC e exchange - 192.168.0.4
mascara de subrede: 255.255.255.0
ip de broadcast: 192,168.0.255
ip interno do firewall: 192.168.0.8
ip externo do firewall: 200.x.x.x
placa de recebimento- eth0
placa de entrega- eth1
o ip externo do firewall é fixo!
quem conseguir configurar os 2 scripts acima eu agradeco!
agradeco desde ja !
abracos,
jcms
Indicar para um amigo
Escrever uma .conf