rafael_theo
(usa Debian)
Enviado em 03/05/2011 - 11:45h
Eriton,
Obrigado por responder!
Como estou aprendendo, deixo para voce explicar...rs
Segue abaixo o script:
---------------------------------------------------------------------------------------------------------------
#!/bin/bash
# Interface da Rede Local
IF_LAN="eth0"
# Interfaces de Internet
IF_LINK1="eth1"
IF_LINK2="ppp0"
# Gateway dos Links
GW_LINK1="201.x.x.1"
GW_LINK2="200.x.x.1"
iniciar(){
# Carregar os módulos
modprobe=ip_tables
modprobe=iptable_nat
modprobe=iptable_filter
modprobe=iptable_mangle
# Anti Ataques
iptables -A INPUT -m state --state INVALID -j DROP
# NAT
iptables -t nat -A POSTROUTING -o $IF_LINK1 -j MASQUERADE
iptables -t nat -A POSTROUTING -o $IF_LINK2 -j MASQUERADE
# Marcar pacotes/porta (Rede)
iptables -t mangle -A PREROUTING -i $IF_LAN -p tcp --dport 80 -j MARK --set-mark 2
iptables -t mangle -A PREROUTING -i $IF_LAN -p tcp --dport 443 -j MARK --set-mark 2
iptables -t mangle -A PREROUTING -i $IF_LAN -p tcp --dport 53 -j MARK --set-mark 2
iptables -t mangle -A PREROUTING -i $IF_LAN -p tcp --dport 25 -j MARK --set-mark 3
iptables -t mangle -A PREROUTING -i $IF_LAN -p tcp --dport 110 -j MARK --set-mark 3
# Marcar pacotes/porta (Servidor)
iptables -t mangle -A OUTPUT -p tcp --dport 80 -j MARK --set-mark 2
iptables -t mangle -A OUTPUT -p tcp --dport 443 -j MARK --set-mark 2
iptables -t mangle -A OUTPUT -p tcp --dport 53 -j MARK --set-mark 2
iptables -t mangle -A OUTPUT -p tcp --dport 25 -j MARK --set-mark 3
iptables -t mangle -A OUTPUT -p tcp --dport 110 -j MARK --set-mark 3
# Tabela dinamica/prioridade
ip rule add fwmark 2 table 20 prio 20
ip rule add fwmark 3 table 21 prio 20
# Direcionar tabelas para o gateway
ip route add default via $GW_LINK1 dev $IF_LINK1 table 20
ip route add default via $GW_LINK2 dev $IF_LINK2 table 21
# Limpar tabelas
ip route flush cache
# Liberar Portas
iptables -A INPUT -p tcp --destination-port 443 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 80 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 21 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 25 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 110 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 22 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 23 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 1723 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 47 -j ACCEPT
iptables -A INPUT -p tcp --destination-port 53 -j ACCEPT
# Bloquear Portas
iptables -A INPUT -p tcp --syn --dport 6891 -j DROP
iptables -A INPUT -p tcp --syn --dport 1863 -j DROP
# Requisições da Porta 80 para o Squid
iptables -t nat -A PREROUTING -i $IF_LAN -p tcp --dport 80 -j REDIRECT --to-port 3128
# Encaminhar ip/porta
iptables -t nat -A PREROUTING -d 200.x.x.x -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.0.5:3389
iptables -t nat -A PREROUTING -d 200.x.x.x -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.0.2:25
iptables -t nat -A PREROUTING -d 200.x.x.x -p tcp -m tcp --dport 110 -j DNAT --to-destination 192.168.0.2:110
# Abrir Rede Local
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i $IF_LAN -j ACCEPT
iptables -A INPUT -p tcp --syn -s 192.168.0.0/255.255.255.0 -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu
# Otimizando o Firewall
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Mantendo Conexões Ativas
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
#Descartar Pacontes Invalidos
iptables -A FORWARD -m state --state INVALID -j DROP
# Fechar o Restante
iptables -A INPUT -p tcp --syn -j DROP
}
parar(){
ip rule del fwmark 2 table 20 prio 20
ip rule del fwmark 3 table 21 prio 20
iptables -F
iptables -F -t nat
}
case $1 in
start) iniciar;;
stop) parar;;
restart) parar; iniciar;;
*)echo "Use os parâmentros start, stop ou restart" ;;
esac
-------------------------------------------------------------------------------------------------------------------
