Duvida Iptables [RESOLVIDO]
1. Duvida Iptables [RESOLVIDO]
marcos1983
(usa Debian)
Enviado em 14/08/2011 - 19:22h
Senhores,Criei o firewall abaixo, porém quando executo o script eu perco o acesso ao SSH da máquina pela rede internet e a internet também não funciona mais para nenhum cliente da rede.
Outro problema que tive é que necessito com o MASQUERADE conseguir criar regras de quais protocolos podem trafegar porque a minha internet é com IP DINAMICO, tentei criar regras como os 2 exemplos abaixo e não obtive sucesso. Alguem tem alguma sugestão do que preciso incluir/excluir/alterar nesse script para que ele funcione?
Exemplos:
iptables -t nat -A POSTROUTING -s 192.168.15.1/24 -d 0/0 -p tcp --dport 110 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.15.1/24 -d 0/0 -p tcp --dport 80 -j MASQUERADE
O mesmo equipamento é firewall e também webserver. Possui duas placas de rede sendo a eth0 = placa interna e eth1 = placa externa (internet)
######################
SCRIPT FIREWALL
######################
#/bin/bash
fire_start(){
iptables -P INPUT DROP
iptables -P OUTPUT DROP
#--------------------------------------------------#
# Regras de INPUT #
#--------------------------------------------------#
echo "Definindo regras de INPUT"
###################################################
# Compartilhamento da Internet #
###################################################
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
echo "1" > /proc/sys/net/ipv4/ip_forward
#####################################################
# Aceita todo trafego loopback #
#####################################################
iptables -A INPUT -i lo -j ACCEPT
#####################################################
# Libera trafego LAN #
#####################################################
iptables -A INPUT -s 192.168.15.0/24 -i eth0 -j ACCEPT
#####################################################
# Redirecionamento Terminal Service Desktop Quarto #
#####################################################
iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 3389 -j DNAT --to-destination 192.168.15.31:3389
#####################################################
# Redirecionamento Terminal Service Notebook Marcos #
#####################################################
iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 3390 -j DNAT --to-destination 192.168.15.30:3390
#####################################################
# Redirecionamento Local WebServer #
#####################################################
iptables -v -A INPUT -p tcp --dport 8181 -j ACCEPT
#####################################################
# Redirecionamento WebServer BKP #
#####################################################
iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 8082 -j DNAT --to-destination 192.168.15.110:8082
}
fire_stop(){
echo "Parando o Firewall"
iptables -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
}
fire_restart(){
fire_stop
sleep 1
fire_start
}
case "$1" in
'start')
fire_start
;;
'stop')
fire_stop
;;
'restart')
fire_restart
;;
*)
echo "usage $0 start|stop|restart"
esac