WDOMICIANO
(usa Outra)
Enviado em 28/07/2015 - 09:53h
Deem uma olhada nas minhas regras de firewall.
#!/bin/bash
### BEGIN INIT INFO
# Provides: firewall
# Required-Start: $local_fs $remote_fs $network $syslog
# Required-Stop: $local_fs $remote_fs $network $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start firewall.sh at boot time
# Description: Enable service provided by firewall
### END INIT INFO
# ATENÇÃO # AS LINHAS ACIMA NÃO SÃO COMENTTARIOS , ELAS FORMAM O CABEÇADLHO DO SCRIPT NÃO PODEM SER ALTERADAS E NEM APAGADAS.
iniciar(){
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
modprobe ppp-compress-18
modprobe ip_nat_pptp
modprobe ip_conntrack_pptp
modprobe ip_tables
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ipt_LOG
modprobe ipt_REJECT
modprobe ipt_MASQUERADE
modprobe ipt_state
modprobe ipt_multiport
modprobe iptable_mangle
modprobe ipt_tos
modprobe ipt_limit
modprobe ipt_mark
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m multiport --dport 22 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp -m multiport --dport 22,3128 -j ACCEPT
iptables -A INPUT -p tcp -s x.x.x.x/24 -m multiport --dport 139,445 -j ACCEPT # SAMBA
iptables -A INPUT -p udp -s x.x.x.x/24 -m multiport --dport 138,139 -j ACCEPT # SAMBA
iptables -A INPUT -p tcp -s 0/0 -m multiport --dport 139,445 -j DROP # SAMBA
iptables -A INPUT -p udp -s 0/0 -m multiport --dport 137,138,139 -j DROP # SAMBA
iptables -A OUTPUT -p tcp -s x.x.x.x/24 -m multiport --dport 139,445 -j ACCEPT # SAMBA
iptables -A OUTPUT -p udp -s x.x.x.x/24 -m multiport --dport 138,139 -j ACCEPT # SAMBA
iptables -A INPUT -p udp -s x.x.x.x/24 -m multiport --dport 25,53,110,143,465,587,993,995 -j ACCEPT # EMAIL
iptables -A OUTPUT -p tcp -s x.x.x.x/24 -m multiport --dport 25,53,110,143,465,587,993,995 -j ACCEPT # EMAIL
iptables -A FORWARD -p tcp --dport 22 -j ACCEPT # SSH
iptables -A FORWARD -p tcp --dport 1433 -j ACCEPT # SQL
iptables -A FORWARD -p udp --dport 1433 -j ACCEPT # SQL
iptables -A FORWARD -p udp --dport 53 -j ACCEPT # DNS
iptables -t nat -A POSTROUTING -p tcp -m multiport --dport 25,53,110,143,465,587,993,995 -j MASQUERADE
iptables -t nat -A POSTROUTING -p udp -m multiport --dport 25,53,110,143,465,587,993,995 -j MASQUERADE
iptables -t nat -A POSTROUTING -s x.x.x.x/24 -d 10.5.0.0/24 -j ACCEPT # LOGISTICA RJ
iptables -t nat -A POSTROUTING -d x.x.x.x/24 -s 10.5.0.0/24 -j ACCEPT # LOGISTICA RJ
iptables -t nat -I POSTROUTING -s 10.5.0.0/24 -o eth1 -j MASQUERADE # LOGISTICA RJ
# Mascarando Ping (icmp) Regra de ping pra a internet
iptables -t nat -A POSTROUTING -s x.x.x.x/24 -o eth0 -p icmp -j MASQUERADE
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A FORWARD -p icmp -j ACCEPT
iptables -t nat -A POSTROUTING -p icmp -j MASQUERADE
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -j DROP
iptables -A OUTPUT -j ACCEPT
iptables -A FORWARD -j ACCEPT
}
parar(){
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
}
case "$1" in
"start") iniciar ;;
"stop") parar ;;
"restart") parar; iniciar ;;
*) echo "Use os parâmetros start ou stop"
esac
