diawd
(usa Ubuntu)
Enviado em 26/01/2011 - 17:15h
############# Define regras Padrao ##########
case "$1" in
start)
iptables -P FORWARD ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
echo " "
echo " Definindo Regras Padrao ...... Ok"
echo " "
########### Limpa Regras do Iptables ##########
iptables -F # Limpa regras da tabela Filter
iptables -X # Deleta todas as cadeias da tabela filter
iptables -Z # Zera o contador da tabela filter
iptables -t nat -F # Limpa regras da tabela NAT
iptables -t nat -X # Deleta todas as cadeias da tabela NAT
iptables -t nat -Z # Zera o contador da tabela NAT
echo " "
echo " Limpando Regras ............ Ok"
echo " "
############## Carregando Modulos ########
modprobe ip_tables
modprobe iptable_filter
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
echo " "
echo " Carregando Modulos ............ Ok "
echo " "
############## Redirecionamento de porta do Proxy ###########
iptables -t mangle -A PREROUTING -i eth1 -p tcp --dport 80 -j MARK --set-mark 2
iptables -t mangle -A PREROUTING -i eth1 -p tcp --dport 443 -j MARK --set-mark 2
iptables -t mangle -A PREROUTING -i eth1 -p tcp --dport 25 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp --dport 110 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i eth1 -p tcp --dport 3306 -j MARK --set-mark 3
iptables -t mangle -A OUTPUT -p tcp --dport 80 -j MARK --set-mark 2
iptables -t mangle -A OUTPUT -p tcp --dport 443 -j MARK --set-mark 2
iptable -t mangle -A OUTPUT -p tcp --dport 25 -j MARK --set-mark 3
iptables -t mangle -A OUTPUT -p tcp --dport 110 -j MARK --set-mark 3
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE
ip rule add fwmark 2 table 20 prio 20
ip rule add fwmark 3 table 30 prio 20
ip route add default via 10.0.0.223 dev eth0 table 20
ip route add default via 10.0.0.105 dev eth2 table 30
echo " "
echo " Ativando servidor Proxy .............. Ok "
echo " "
############ Liberando Portas ##########
# Stateful
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --sport 22 -j ACCEPT
# Terminsl Service
iptables -A INPUT -p tcp --dport 3389 -j ACCEPT
iptables -A FORWARD -p tcp --dport 3389 -j ACCEPT
## PRECISA DO PACOTE REDIR INSTALADO #####
#redir --laddr=0.0.0.0 --lport 3389 --caddr=10.0.0.205 --cport 3389 &
# Email
iptables -A FORWARD -p tcp --sport 25 -j ACCEPT # SMTP
iptables -A FORWARD -p tcp --sport 110 -j ACCEPT # POP3
iptables -A FORWARD -p tcp --dport 25 -j ACCEPT # SMTP
iptables -A FORWARD -p tcp --dport 110 -j ACCEPT # POP3
# ftp
iptables -A FORWARD -p tcp --dport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp --sport 20 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp --sport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# DNS
iptables -A FORWARD -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -p tcp --sport 53 -j ACCEPT
iptables -A FORWARD -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -p udp --sport 53 -j ACCEPT
# Loja SPtrans
iptables -A FORWARD -p tcp --sport 809 -j ACCEPT
iptables -A FORWARD -p tcp --dport 809 -j ACCEPT
# Internet
iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp --sport 80 -j ACCEPT
iptables -A FORWARD -p tcp --sport 443 -j ACCEPT
iptables -A FORWARD -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp --dport 8080 -j ACCEPT
iptables -A FORWARD -p tcp --sport 8080 -j ACCEPT
iptables -A INPUT -p tcp -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT
iptables -A FORWARD -p tcp --dport 3128 -j ACCEPT
# MySQL
iptables -A FORWARD -p tcp --dport 3306 -j ACCEPT
iptables -A FORWARD -p tcp --sport 3306 -j ACCEPT
#iptables -A FORWARD -p tcp --dport 3306 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#iptables -A FORWARD -p tcp --sport 3306 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
echo " "
echo " Liberando Portas "
echo " "
echo " "
echo " MySQL ............... Ok "
echo " Terminal Service .... Ok "
echo " Email ............... Ok "
echo " FTP ................. Ok "
echo " Skype ............... Ok "
echo " Internet ............ Ok "
echo " "
# Nao responde a Pings
iptables -A INPUT -p icmp -j LOG
iptables -A INPUT -p icmp -j ACCEPT
echo " "
echo " Bloqueando Protocolos ........... Ok "
echo " "
# Libera ping externo
iptables -A FORWARD -p icmp -j LOG
iptables -A FORWARD -p icmp -j ACCEPT
iptables -A INPUT -p icmp -j DROP
echo " "
echo " Ativando Firewall ............. Ok "
echo " "
;;
stop)
iptables -F
;;
status)
echo ""
echo "Tabela Filter"
echo ""
iptables -L -n
echo ""
echo "Tabela NAT"
echo ""
iptables -t nat -L -n
echo ""
echo "Tabela Mangle"
echo ""
iptables -t mangle -L -n
;;
restart)
$0 stop
$0 start
;;
*)
echo $"Usar: $0 {start|stop|status|restart|}"
exit 1
;;
esac
exit $?
