FIREWALL DO CENTOS

sinner
(usa Outra)

Enviado em 03/04/2017 - 21:06h

Olá pessoal ! Gostaria de um ajuda aqui no maior Fórum Linux do Brasil como dizem por aí !
Eu tenho um problema que não consigo resolver.

Eu tenho CentOS instalado e fiz as configurações iniciais para utilizar com iptables.

1 - Eu desativei o firewalld

systemctl disable firewalld.service

systemctl stop firewalld.service

2 - Instalei o iptables-service

yum install iptables-service

e depois habilitei o serviço

systemctl start iptables.service

systemctl enable iptables.service


3 - Desabilitei o SELinux

Com um bloco de notas qualquer

/etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of three two values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted

O problema é que mesmo depois de o firewall estar desativado ter limpado as regras e salvado o arquivo ele apresenta um configuração padrão de firewall o que não deveria aparecer !!

alguém sabe onde posso encontrar esse script ?

Rpfreitas
(usa Linux Mint)

Enviado em 04/04/2017 - 07:05h

Normalmente após instalar o iptables.service ele cria uma arquivo chamado iptables em. /etc/sysconfig. Este é o arquivo padrão de firewall do sistema que utiliza iptables, edita ele ou faz um script e execulta depois um iptables-save.

sinner
(usa Outra)

Enviado em 05/04/2017 - 01:59h

Pois é meu amigo já fiz isso limpei os arquivos inclusive tem dois tipo de arquivos.
Como você falou quando instala o iptables.service ele cria tanto iptables como ip6tables
e ele já tem os arquivos iptables-config e ip6tables-config

Já editei e exclui os arquivos iptables-config e ip6tables-config
Limpei o firewall com os comandos.

Depois salvei com o comando
iptables > /etc/sysconfig/iptables
ip6tables > /etc/sysconfig/ip6config

É uma praga, parece que tem algum script rodando!

depois reiniciei a maquina e mesmo assim apareceu as mesmas regras.

sinner
(usa Outra)

Enviado em 05/04/2017 - 06:33h

Mano fui editar o arquivo que fica no /etc/sysconfig/iptables e depois executei o comando iptables-save olha o que aparece
no aqui arquivo deixei em branco !!

iptables-save
# Generated by iptables-save v1.6.0 on Wed Apr 5 06:30:57 2017
*mangle
:PREROUTING ACCEPT [586:55896]
:INPUT ACCEPT [585:55568]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [515:86144]
:POSTROUTING ACCEPT [515:86144]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
:POSTROUTING_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_FedoraServer - [0:0]
:PRE_FedoraServer_allow - [0:0]
:PRE_FedoraServer_deny - [0:0]
:PRE_FedoraServer_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A INPUT -j INPUT_direct
-A FORWARD -j FORWARD_direct
-A OUTPUT -j OUTPUT_direct
-A POSTROUTING -j POSTROUTING_direct
-A PREROUTING_ZONES -i enp0s3 -g PRE_FedoraServer
-A PREROUTING_ZONES -g PRE_FedoraServer
-A PRE_FedoraServer -j PRE_FedoraServer_log
-A PRE_FedoraServer -j PRE_FedoraServer_deny
-A PRE_FedoraServer -j PRE_FedoraServer_allow
COMMIT
# Completed on Wed Apr 5 06:30:57 2017
# Generated by iptables-save v1.6.0 on Wed Apr 5 06:30:57 2017
*nat
:PREROUTING ACCEPT [3:612]
:INPUT ACCEPT [1:52]
:OUTPUT ACCEPT [22:1636]
:POSTROUTING ACCEPT [22:1636]
:OUTPUT_direct - [0:0]
:POSTROUTING_ZONES - [0:0]
:POSTROUTING_ZONES_SOURCE - [0:0]
:POSTROUTING_direct - [0:0]
:POST_FedoraServer - [0:0]
:POST_FedoraServer_allow - [0:0]
:POST_FedoraServer_deny - [0:0]
:POST_FedoraServer_log - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_FedoraServer - [0:0]
:PRE_FedoraServer_allow - [0:0]
:PRE_FedoraServer_deny - [0:0]
:PRE_FedoraServer_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A OUTPUT -j OUTPUT_direct
-A POSTROUTING -j POSTROUTING_direct
-A POSTROUTING -j POSTROUTING_ZONES_SOURCE
-A POSTROUTING -j POSTROUTING_ZONES
-A POSTROUTING_ZONES -o enp0s3 -g POST_FedoraServer
-A POSTROUTING_ZONES -g POST_FedoraServer
-A POST_FedoraServer -j POST_FedoraServer_log
-A POST_FedoraServer -j POST_FedoraServer_deny
-A POST_FedoraServer -j POST_FedoraServer_allow
-A PREROUTING_ZONES -i enp0s3 -g PRE_FedoraServer
-A PREROUTING_ZONES -g PRE_FedoraServer
-A PRE_FedoraServer -j PRE_FedoraServer_log
-A PRE_FedoraServer -j PRE_FedoraServer_deny
-A PRE_FedoraServer -j PRE_FedoraServer_allow
COMMIT
# Completed on Wed Apr 5 06:30:57 2017
# Generated by iptables-save v1.6.0 on Wed Apr 5 06:30:57 2017
*security
:INPUT ACCEPT [584:55336]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [515:86144]
:FORWARD_direct - [0:0]
:INPUT_direct - [0:0]
:OUTPUT_direct - [0:0]
-A INPUT -j INPUT_direct
-A FORWARD -j FORWARD_direct
-A OUTPUT -j OUTPUT_direct
COMMIT
# Completed on Wed Apr 5 06:30:57 2017
# Generated by iptables-save v1.6.0 on Wed Apr 5 06:30:57 2017
*raw
:PREROUTING ACCEPT [586:55896]
:OUTPUT ACCEPT [515:86144]
:OUTPUT_direct - [0:0]
:PREROUTING_ZONES - [0:0]
:PREROUTING_ZONES_SOURCE - [0:0]
:PREROUTING_direct - [0:0]
:PRE_FedoraServer - [0:0]
:PRE_FedoraServer_allow - [0:0]
:PRE_FedoraServer_deny - [0:0]
:PRE_FedoraServer_log - [0:0]
-A PREROUTING -j PREROUTING_direct
-A PREROUTING -j PREROUTING_ZONES_SOURCE
-A PREROUTING -j PREROUTING_ZONES
-A OUTPUT -j OUTPUT_direct
-A PREROUTING_ZONES -i enp0s3 -g PRE_FedoraServer
-A PREROUTING_ZONES -g PRE_FedoraServer
-A PRE_FedoraServer -j PRE_FedoraServer_log
-A PRE_FedoraServer -j PRE_FedoraServer_deny
-A PRE_FedoraServer -j PRE_FedoraServer_allow
COMMIT
# Completed on Wed Apr 5 06:30:57 2017
# Generated by iptables-save v1.6.0 on Wed Apr 5 06:30:57 2017
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [515:86144]
:FORWARD_IN_ZONES - [0:0]
:FORWARD_IN_ZONES_SOURCE - [0:0]
:FORWARD_OUT_ZONES - [0:0]
:FORWARD_OUT_ZONES_SOURCE - [0:0]
:FORWARD_direct - [0:0]
:FWDI_FedoraServer - [0:0]
:FWDI_FedoraServer_allow - [0:0]
:FWDI_FedoraServer_deny - [0:0]
:FWDI_FedoraServer_log - [0:0]
:FWDO_FedoraServer - [0:0]
:FWDO_FedoraServer_allow - [0:0]
:FWDO_FedoraServer_deny - [0:0]
:FWDO_FedoraServer_log - [0:0]
:INPUT_ZONES - [0:0]
:INPUT_ZONES_SOURCE - [0:0]
:INPUT_direct - [0:0]
:IN_FedoraServer - [0:0]
:IN_FedoraServer_allow - [0:0]
:IN_FedoraServer_deny - [0:0]
:IN_FedoraServer_log - [0:0]
:OUTPUT_direct - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j INPUT_direct
-A INPUT -j INPUT_ZONES_SOURCE
-A INPUT -j INPUT_ZONES
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -j FORWARD_direct
-A FORWARD -j FORWARD_IN_ZONES_SOURCE
-A FORWARD -j FORWARD_IN_ZONES
-A FORWARD -j FORWARD_OUT_ZONES_SOURCE
-A FORWARD -j FORWARD_OUT_ZONES
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -j OUTPUT_direct
-A FORWARD_IN_ZONES -i enp0s3 -g FWDI_FedoraServer
-A FORWARD_IN_ZONES -g FWDI_FedoraServer
-A FORWARD_OUT_ZONES -o enp0s3 -g FWDO_FedoraServer
-A FORWARD_OUT_ZONES -g FWDO_FedoraServer
-A FWDI_FedoraServer -j FWDI_FedoraServer_log
-A FWDI_FedoraServer -j FWDI_FedoraServer_deny
-A FWDI_FedoraServer -j FWDI_FedoraServer_allow
-A FWDI_FedoraServer -p icmp -j ACCEPT
-A FWDO_FedoraServer -j FWDO_FedoraServer_log
-A FWDO_FedoraServer -j FWDO_FedoraServer_deny
-A FWDO_FedoraServer -j FWDO_FedoraServer_allow
-A INPUT_ZONES -i enp0s3 -g IN_FedoraServer
-A INPUT_ZONES -g IN_FedoraServer
-A IN_FedoraServer -j IN_FedoraServer_log
-A IN_FedoraServer -j IN_FedoraServer_deny
-A IN_FedoraServer -j IN_FedoraServer_allow
-A IN_FedoraServer -p icmp -j ACCEPT
-A IN_FedoraServer_allow -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
-A IN_FedoraServer_allow -p tcp -m tcp --dport 9090 -m conntrack --ctstate NEW -j ACCEPT
COMMIT
# Completed on Wed Apr 5 06:30:57 2017