Liberar firewall para clientes de email

jr.jorro
(usa Debian)

Enviado em 16/06/2010 - 15:41h

Prezados,

Na minha rede configurada com iptables/squid, os clientes de email, funcionam intermitentemente... hora sim, hora não. Quando não funciona, aparece a mensagem de pop-smtp de que esgotou o tempo na tentativa de conexão.

Meu firewall com política ACCEPT ALL, está configurado da seguinte forma:

#!/bin/bash -x

# FIREWALL PADRÃO
/sbin/modprobe ip_nat
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_REJECT
/sbin/modprobe ipt_MASQUERADE
/sbin/modprobe ipt_state

# Habilitar roteamento
echo "1" > /proc/sys/net/ipv4/ip_forward

#Limpa Regras atuais
iptables -F
iptables -X
iptables -Z
iptables -t nat -F

#Define Políticas das Chains
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT

# ==========================================================
# VARI�VEIS
# ==========================================================

WAN="eth0" # Interface de comunicação com o ISP WAN
LAN="eth1" # Interface de comunicação com a LAN

LAN_ADDRESS="192.168.0.0/24"

LAN_IP="192.168.0.1" # IP Gateway
WAN_IP="189.39.155.155" # IP Externo

DNSgoogle1="8.8.8.8"
DNSgoogle2="8.8.4.4"
DNS1="200.160.155.155" # DNS Externo do ISP
DNS2="200.160.155.156" # DNS Externo secundario ISP

WEB_SERVER="192.168.0.8" # IP do webserver
SFTP_IP="192.168.0.9" # IP do SFTP

# Conexões Pré-estabelecidas
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT


# Tudo desde a Rede Interna, fazer SNAT!
iptables -t nat -A POSTROUTING -s $LAN_ADDRESS -o $WAN -j SNAT --to-source $WAN_IP
#iptables -t nat -A POSTROUTING -s $LAN_ADDRESS -o $WAN -j MASQUERADE

#######################################################
# INPUT
#######################################################
# Liberar DNS
iptables -A INPUT -p udp -s $DNSgoogle1 --sport 53 -j ACCEPT
iptables -A INPUT -p udp -s $DNSgoogle2 --sport 53 -j ACCEPT

# Liberar SQUID
iptables -A INPUT -i $LAN -p tcp --sport 80 -j ACCEPT
iptables -A INPUT -i $LAN -p tcp --sport 443 -j ACCEPT
iptables -A INPUT -i $LAN -p tcp --sport 20 -j ACCEPT
iptables -A INPUT -i $LAN -p udp --sport 21 -j ACCEPT

# Liberar FTP
iptables -A INPUT -i $LAN -p tcp -d 189.109.155.155 --dport 21 -j ACCEPT
iptables -A INPUT -i $LAN -p tcp -d 201.12.155.155 --dport 21 -j ACCEPT

# Liberar para proxy
iptables -A INPUT -s $LAN_ADDRESS -p tcp --dport 3128 -j ACCEPT

# Liberar Rede Interna
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -s $LAN_ADDRESS -j ACCEPT
iptables -A INPUT -s $LAN_ADDRESS -p tcp -d $LAN_IP --dport 22 -j ACCEPT

######################################################
# FORWARD
######################################################
# Liberar Email/Outlook
iptables -A FORWARD -p udp -s $LAN_ADDRESS -d $DNSgoogle1 --dport 53 -j ACCEPT
iptables -A FORWARD -p udp -s $LAN_ADDRESS -d $DNSgoogle2 --dport 53 -j ACCEPT
iptables -A FORWARD -p udp -s $DNSgoogle1 --sport 53 -d $LAN_ADDRESS -j ACCEPT
iptables -A FORWARD -p udp -s $DNSgoogle2 --sport 53 -d $LAN_ADDRESS -j ACCEPT

# Liberar acesso às portas de pop e smtp
iptables -A FORWARD -p tcp -s $LAN_ADDRESS --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp -s $LAN_ADDRESS --dport 110 -j ACCEPT
iptables -A FORWARD -p tcp --sport 25 -j ACCEPT
iptables -A FORWARD -p tcp --sport 110 -j ACCEPT

# DNS
#iptables -A FORWARD -p udp -s $LAN_ADDRESS --dport 53 -j ACCEPT
#iptables -A FORWARD -p udp -d $LAN_ADDRESS --sport 53 -j ACCEPT

# Forward do trafego para web server (MYSQL)
#iptables -A FORWARD -m state --state NEW -p tcp --dport 25 -j ACCEPT
#iptables -A FORWARD -m state --state NEW -p tcp --dport 110 -j ACCEPT
#iptables -A FORWARD -m state --state NEW -p tcp --dport 22 -j ACCEPT
#iptables -I FORWARD -p tcp --dport 110 -j ACCEPT
#iptables -I FORWARD -p tcp --dport 25 -j ACCEPT
# Acesso da LAN a WAN
#iptables -A FORWARD -s $LAN_ADDRESS -i $WAN -p tcp --dport 80 -j ACCEPT
#iptables -A FORWARD -s $LAN_ADDRESS -i $WAN -p tcp --dport 443 -j ACCEPT

#######################################################
# NAT
#######################################################
# Fazer NAT na saída da LAN
iptables -t nat -A POSTROUTING -s $LAN_ADDRESS -o $WAN -j MASQUERADE

# Bypass Proxy EPS
iptables -t nat -A PREROUTING -s $LAN_ADDRESS -d 172.19.155.155 -p tcp -j ACCEPT

# Bypass proxy FTP
iptables -t nat -A PREROUTING -s $LAN_ADDRESS -d 201.12.155.155 -p tcp -j ACCEPT

# Bypass email
iptables -t nat -A PREROUTING -s $LAN_ADDRESS -d pop.lanlynk.com.br -p tcp -j ACCEPT
iptables -t nat -A PREROUTING -s $LAN_ADDRESS -d smtp.lanlynk.com.br -p tcp -j ACCEPT

# Bypass vpn
iptables -t nat -A PREROUTING -s $LAN_ADDRESS -d 200.184.155.155 -p tcp -j ACCEPT
iptables -t nat -A PREROUTING -s $LAN_ADDRESS -d 200.99.155.155 -p tcp -j ACCEPT
iptables -t nat -A PREROUTING -s $LAN_ADDRESS -d 200.169.155.155 -p tcp -j ACCEPT

# Proxy
iptables -t nat -A PREROUTING -i $LAN -p tcp --dport 3128 -j ACCEPT
iptables -t nat -A PREROUTING -s $LAN_ADDRESS -d ! $LAN_ADDRESS -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -i $LAN -p tcp -j REDIRECT --to-port 3128

# Redirecionsando ao Servidor WEB
iptables -t nat -A PREROUTING -i $WAN -p tcp -d $WAN_IP --dport 80 -j DNAT --to-destination $WEB_SERVER:80

# Redirecionamento para servidor FTP WEB SERVER
iptables -t nat -A PREROUTING -i $WAN -p tcp -d $WAN_IP --dport 2122 -j DNAT --to-destination $WEB_SERVER:21

# Acesso ao SFTP:2222
iptables -t nat -A PREROUTING -i $WAN -p tcp -d $WAN_IP --dport 2222 -j DNAT --to $SFTP_IP:2222

#Mostra status do iptables
iptables -L -n

irado
(usa XUbuntu)

Enviado em 16/06/2010 - 21:16h

no momento em que vc definiu isto aqui:

#Define Políticas das Chains
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT

tudo passou a ser aceitável, qualquer coisa. Pode pegar TODAS as demais regras que vc teve tanto trabalho em elaborar e.. jogar fora.

Parabéns, vc NÃO TEM um firewall, vc não tem NADA aí que possa impedir o zémail de sair, entrar, dançar, fazer a maior festa.

procuro o problema em outra coisa. Se possivel, avaliando com o tcpdump ;)