Liberar ssh e ftp

jr.jorro
(usa Debian)

Enviado em 10/06/2010 - 15:18h

Pessoal

O iptable está bloqueando ssh(local) e impedindo que eu liste diretório no ftp do cliente. Abri todo o firewall e mesmo assim não funciona. Gostaria que vocês olhassem meu script iptables e me ajudassem a verificar possíveis erros.

erro FTP (cliente winscp)
---Lost connection
---timeout detected
---could not retrieve directory listing
---transfer complete
---error listing directory '/home/moises'

Script do firewall (também uso proxy squid).

#!/bin/bash -x

# FIREWALL PADRÃO
/sbin/modprobe ip_nat
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_REJECT
/sbin/modprobe ipt_MASQUERADE

# Habilitar roteamento
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter

#Limpa Regras atuais
iptables -F
iptables -X
iptables -Z
iptables -t nat -F

#Define Políticas das Chains
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT

# ==========================================================
# VARI�VEIS
# ==========================================================

WAN="eth0" # Interface Externa
LAN="eth1" # Interface Interna Desktops

LAN_ADDRESS="192.168.0.0/24"

#INTERNAL_INT_SERVERS="eth2" # Interface Interna Servidores
LAN_IP="192.168.0.1" # IP Interno rede Desktops
WAN_IP="189.40.10.50" # IP Externo

DNS1="8.8.8.8" # DNS Externo do ISP
DNS2="8.8.4.4" # DNS Externo secundario ISP

WEB_SERVER="192.168.0.2" # IP do webserver
UP_SERVER="192.168.0.184" # Servidor de Upload
SFTP_IP="192.168.0.10" # IP do SFTP

# Conexões Pré-estabelecidas
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED,NEW -j ACCEPT

# Tudo desde a Rede Interna, fazer NAT
iptables -t nat -A POSTROUTING -s $LAN_ADDRESS -o $WAN -j MASQUERADE

#######################################################
# INPUT
#######################################################

# Liberar DNS
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Liberar para proxy
iptables -A INPUT -s $LAN_ADDRESS -p tcp --dport 3128 -j ACCEPT

# Liberar Rede Interna
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -s $LAN_ADDRESS -j ACCEPT
#iptables -A INPUT -s $LAN_ADDRESS -i $WAN -j ACCEPT
#iptables -A INPUT -s $LAN_ADDRESS -i $LAN_ADDRESS -j ACCEPT
#iptables -A OUTPUT -s $LAN_ADDRESS -j ACCEPT

#ptables -A INPUT -s $LAN_ADDRESS -p tcp --dport 22 -j ACCEPT

######################################################
# FORWARD
######################################################
# Acesso da LAN a WAN
iptables -A FORWARD -s $LAN_ADDRESS -i $WAN -p tcp --dport 80 -j ACCEPT
#iptables -A FORWARD -s $LAN_ADDRESS -i $WAN -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -s 0/0 -d 0/0 --dport 22 -j ACCEPT

#######################################################
# NAT
#######################################################
# Fazer NAT na saída da LAN
iptables -t nat -A POSTROUTING -s $LAN_ADDRESS -o $WAN -j MASQUERADE

# Bypass email
iptables -t nat -A PREROUTING -s $LAN_ADDRESS -d 200.200.200.202 -p tcp -j ACCEPT
iptables -t nat -A PREROUTING -s $LAN_ADDRESS -d 200.200.200.210 -p tcp -j ACCEPT

# Bypass proxy FTP
iptables -t nat -A PREROUTING -s $LAN_ADDRESS -d 201.12.20.200 -p tcp -j ACCEPT


# Proxy
iptables -t nat -A PREROUTING -i $LAN -p tcp --dport 3128 -j ACCEPT
iptables -t nat -A PREROUTING -s $LAN_ADDRESS -d ! $LAN_ADDRESS -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -i $LAN -p tcp -j REDIRECT --to-port 3128


# Redirecionsando ao Servidor WEB
iptables -t nat -A PREROUTING -i $WAN -p tcp -d $WAN_IP --dport 80 -j DNAT --to-destination $WEB_SERVER:80

# Redirecionamento para servidor SSH WEB SERVER
iptables -t nat -A PREROUTING -i $WAN -p tcp -d $WAN_IP --dport 2223 -j DNAT --to-destination $WEB_SERVER:22

# Acesso ao SFTP:2222
iptables -t nat -A PREROUTING -i $WAN -p tcp -d $WAN_IP --dport 2222 -j DNAT --to $SFTP_IP:2222

# Ativando Roteamento
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -L -n

rmnobarra
(usa CentOS)

Enviado em 10/06/2010 - 17:01h

prezado.

Para acesso ssh local, tente
iptables -t filter -p tcp -I INPUT -s "ip-rede ou maquina" --dport 22 -j ACCEPT

jr.jorro
(usa Debian)

Enviado em 10/06/2010 - 17:13h

Prezado, obrigado pela ajuda, mas não funcionou. As regras tão todas abertas, o que pode estar bloqueando isso ?

vlw

irado
(usa XUbuntu)

Enviado em 10/06/2010 - 22:15h

vc diz ssh depois só vejo ftp.. decida-se.

erro FTP (cliente winscp) <--argh..cusp, cusp..
---Lost connection

bem.. vc CONFERIU se o sshd está ouvindo na porta 22? E, se estiver, ouve 0.0.0.0 ou só 127.0.0.1?

netstat -nlpt

se tudo estiver como deve, então:

ssh -vv usuario@ip.destino