harryy.potter
(usa Suse)
Enviado em 20/03/2008 - 08:05h
O seu firewall deve funcionar mais ou menos dessa forma...
troque os ips pelos ips da sua rede..
eth0, eth1, etc..
testee!
#!/bin/bash
#
#sendo eth0 a placa de internet
#eth1 a rede 1
#eth2 a rede 2
# carrega biblioteca de função.
if [ -f /etc/init.d/functions ] ; then
. /etc/init.d/functions
elif [ -f /etc/rc.d/init.d/functions ] ; then
. /etc/rc.d/init.d/functions
else
exit 0
fi
# evita usar o temporario do root
unset TMPDIR
# codigo de configuracao da rede.
. /etc/sysconfig/network
# verifica de a rede está funcionando.
[ ${NETWORKING} = "no" ] && exit 0
SERVICE_DESC="Firewall Empresa"
RETVAL=0
#redes
REDE1=192.168......../24
REDE2=192.168......../24
#### Micro de comunicação com as duas redes
CROSSOVER=192.168.....
########################################### INICIANDO FIREWALL #########################################
start() {
gprintf "Iniciando %s: " "$SERVICE_DESC"
if ! [ -f /root/.fwcnlck ]; then #criar arquivo de lock
touch /root/.fwcnlck
fi
# Carrega modulos
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
####### Bloqueia todo pacote que tenta entrar
iptables -P INPUT DROP
####### Aceita passagem de conexoes estabelecidas e relacionadas
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
####### Libera o loopback para localhost
iptables -A INPUT -i lo -j ACCEPT
iptables -A FORWARD -i lo -j ACCEPT
####### Liberando passagem de pacotes CROSSOVER entre as 2 redes
iptables -A FORWARD -s $CROSSOVER -d $REDE2 -m state --state NEW -j ACCEPT
iptables -A FORWARD -s $CROSSOVER -d $REDE1 -m state --state NEW -j ACCEPT
####### Bloqueando repasse de pacotes entre redes internas
iptables -A FORWARD -s $REDE1 -d $REDE2 -m state --state NEW -j DROP
iptables -A FORWARD -s $REDE2 -d $REDE1 -m state --state NEW -j DROP
####### Liberando repasse de pacotes para a internet
iptables -A FORWARD -s $REDE1 -d 0/0 -m state --state NEW -j ACCEPT
iptables -A FORWARD -s $REDE2 -d 0/0 -m state --state NEW -j ACCEPT
####### Libera saida para portas de Email
iptables -t nat -A POSTROUTING -p TCP --dport 25 -s $REDE1 -d 0/0 -j MASQUERADE
iptables -t nat -A POSTROUTING -p TCP --dport 25 -s $REDE2 -d 0/0 -j MASQUERADE
iptables -t nat -A POSTROUTING -p TCP --dport 110 -s $REDE1 -d 0/0 -j MASQUERADE
iptables -t nat -A POSTROUTING -p TCP --dport 110 -s $REDE2 -d 0/0 -j MASQUERADE
####### Liberando acesso remoto interno via terminal service
iptables -A INPUT -i eth0 -p TCP --dport 3389 --syn -j ACCEPT
iptables -A INPUT -i eth0 -p UDP --dport 3389 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -s 200.*.*.* -d 192.*.*.* -p TCP --dport 3389 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -s 200.*.*.* -d 192.*.*.* -p UDP --dport 3389 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p TCP --dport 3389 -j DNAT --to-destination 192.*.*.*:3389
iptables -A FORWARD -i eth0 -d 192.*.*.*/32 -p TCP --dport 3389 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p UDP --dport 3389 -j DNAT --to-destination 192.*.*.*:3389
iptables -A FORWARD -i eth0 -d 192.*.*.*/32 -p UDP --dport 3389 -j ACCEPT
####### Liberando porta do apache
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -p tcp --dport 8180 -j ACCEPT
####### Liberando saida do DNS
iptables -t nat -A POSTROUTING -p TCP --dport 53 -s $REDE1 -d 0/0 -j MASQUERADE
iptables -t nat -A POSTROUTING -p TCP --dport 53 -s $REDE2 -d 0/0 -j MASQUERADE
iptables -t nat -A POSTROUTING -p UDP --dport 53 -s $REDE1 -d 0/0 -j MASQUERADE
iptables -t nat -A POSTROUTING -p UDP --dport 53 -s $REDE2 -d 0/0 -j MASQUERADE
####### Liberando porta para acesso remoto (ssh)
iptables -A INPUT -p TCP -s $REDE1 --dport 22 -m state --state NEW -j ACCEPT
iptables -A INPUT -p TCP -s $REDE2 --dport 22 -m state --state NEW -j ACCEPT
iptables -A INPUT -p TCP -s $REDE1 --dport 2022 -m state --state NEW -j ACCEPT
iptables -A INPUT -p TCP -s $REDE2 --dport 2022 -m state --state NEW -j ACCEPT
####### Liberando porta do squid
iptables -A INPUT -p TCP -s $REDE1 --dport 3128 -m state --state NEW -j ACCEPT
iptables -A INPUT -p TCP -s $REDE2 --dport 3128 -m state --state NEW -j ACCEPT
iptables -A INPUT -p TCP -s $REDE2 --dport 53 -m state --state NEW -j ACCEPT
iptables -A INPUT -p UDP -s $REDE1 --dport 53 -m state --state NEW -j ACCEPT
####### Liberando porta do DG
iptables -A INPUT -p TCP -s $REDE1 --dport 8000 -m state --state NEW -j ACCEPT
iptables -A INPUT -p TCP -s $REDE2 --dport 8000 -m state --state NEW -j ACCEPT
####### Liberando acesso direto CROSSOVER
iptables -t nat -A POSTROUTING -s $CROSSOVER -d 0/0 -j MASQUERADE
iptables -t nat -A PREROUTING -p TCP -i eth2 --dport 4662:4672 -j DNAT --to $CROSSOVER
iptables -t nat -A PREROUTING -p UDP -i eth2 --dport 4662:4672 -j DNAT --to $CROSSOVER
iptables -t nat -A PREROUTING -p UDP -i eth1 --dport 7681 -j DNAT --to $CROSSOVER
#Setando como ativas regras necess�ias
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo_success
echo""
}
stop() {
gprintf "Parando %s: " "$SERVICE_DESC"
if [ -f /root/.fwcnlck ]; then #apaga arquivo de lock
rm -f /root/.fwcnlck
fi
iptables -P INPUT ACCEPT
#Setando como ativas regras necess�ias
echo 0 > /proc/sys/net/ipv4/ip_forward
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo_success
echo""
}
restart() {
limpa_regras
stop
start
}
lstatus() {
if [ -f /root/.fwcnlck ]; then #criar arquivo de lock
gprintf "Firewall CN rodando\n"
else gprintf "Firewall CN parado\n"
fi
}
limpa_regras() {
iptables -F
iptables -F INPUT
iptables -F FORWARD
iptables -t nat -F PREROUTING
iptables -t nat -F POSTROUTING
}
case "$1" in
start)
limpa_regras
start
;;
stop)
limpa_regras
stop
;;
restart)
restart
;;
status)
lstatus
;;
*)
gprintf "Usage: %s {start|stop|restart|status|}\n" "$0"
exit 1
esac
exit $?
