acolatto
(usa Debian)
Enviado em 13/04/2012 - 15:21h
REGRAS IPTABLES
#!/bin/bash
echo "DECLARANDO VARIAVEIS... "
#programas diversos
PATH=/sbin:/bin:/usr/sbin:/usr/bin
#caminho estrutura iptables
IPTABLES=/sbin/iptables
#caminho absoluto do script
PROGRAMA=/etc/init.d/regras.fw
#portas liberadas e bloqueadas
PORTLIB=/etc/conf_personalisadas/portlib
PORTBLO=/etc/conf_personalisadas/portblo
#INTERFACES E IPS
IP_INT=10.1.1.1
IP_EXT=192.168.6.190
REDE_INT=10.1.1.0/24
REDE_EXT=192.168.6.0/24
LAN=eth1
WAN=eth0
#Modulos do iptables do MODPROBE
modprobe iptable_filter
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ipt_LOG
modprobe ipt_REJECT
modprobe ipt_state
modprobe ipt_multiport
modprobe iptable_mangle
modprobe ipt_tos
modprobe ipt_limit
modprobe ipt_mark
modprobe ipt_MARK
echo "Ativando Roteamento... "
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "Limpando regras existentes... "
$IPTABLES -F -t filter
$IPTABLES -F -t nat
$IPTABLES -F -t mangle
$IPTABLES -X -t filter
$IPTABLES -X -t nat
$IPTABLES -X -t mangle
$IPTABLES -Z -t filter
$IPTABLES -Z -t nat
$IPTABLES -Z -t mangle
echo "Definindo politica padrao..."
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
$IPTABLES -A FORWARD -i $LAN -o $WAN -j ACCEPT
echo "Ativando fluxo interno entre processos..."
$IPTABLES -I INPUT -i lo -j ACCEPT
$IPTABLES -I OUTPUT -o lo -j ACCEPT
$IPTABLES -I INPUT -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -I INPUT -m state --state RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -I INPUT -p icmp -j ACCEPT
$IPTABLES -I OUTPUT -p icmp -j ACCEPT
echo "Liberando portas..."
for i in `cat $PORTLIB`; do
$IPTABLES -A INPUT -p tcp --dport $i -j ACCEPT
$IPTABLES -A INPUT -p udp --dport $i -j ACCEPT
$IPTABLES -A FORWARD -p tcp --dport $i -j ACCEPT
$IPTABLES -A FORWARD -p udp --dport $i -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport $i -j ACCEPT
$IPTABLES -A OUTPUT -p udp --dport $i -j ACCEPT
done
$IPTABLES -A FORWARD -p udp -s $REDE_INT -d 8.8.8.8 --dport 53 -j ACCEPT
$IPTABLES -A FORWARD -p udp -s 8.8.8.8 --sport 53 -d $REDE_INT -j ACCEPT
$IPTABLES -A FORWARD -p udp -s $REDE_INT -d 192.168.6.254 --dport 53 -j ACCEPT
$IPTABLES -A FORWARD -p udp -s 192.168.6.254 --sport 53 -d $REDE_INT -j ACCEPT
$IPTABLES -A FORWARD -p tcp -s $REDE_INT --dport 25 -j ACCEPT
$IPTABLES -A FORWARD -p tcp -s $REDE_INT --dport 110 -j ACCEPT
$IPTABLES -A FORWARD -p tcp --sport 25 -j ACCEPT
$IPTABLES -A FORWARD -p tcp --sport 110 -j ACCEPT
echo "Ativando mascaramento..."
$IPTABLES -t nat -A POSTROUTING -o $WAN -j MASQUERADE
echo "Ativando proxy transparente..."
$IPTABLES -t nat -A PREROUTING -s 0/0 -p tcp --dport 80 -j REDIRECT --to-port 3128
REGRAS SQUID
########################################
# Definindo porta padrao squid
########################################
http_port 3128 transparent
#########################################
# Definindo nome do FIREWALL
#########################################
visible_hostname FIREWALL-NOVO
##########################################
# Optimizacao FW
##########################################
cache_mem 200 MB
maximum_object_size_in_memory 100 KB
maximum_object_size 512 MB
minimum_object_size 0 KB
cache_swap_low 90
cache_swap_high 95
cache_dir ufs /var/spool/squid 2048 16 256
refresh_pattern ^ftp: 15 20% 2280
refresh_pattern ^gopher: 15 0% 2280
refresh_pattern . 15 20% 2280
cache_access_log /var/log/squid/access.log
############################################
# Definindo ACLS
############################################
acl all src 0/0
acl localhost src 127.0.0.1/32
acl rede src 10.1.1.0/24
acl manager proto cache_object
acl liberados url_regex -i "/etc/squid/list/sites-liberados"
acl bloqueados url_regex -i "/etc/squid/list/sites-bloqueados"
acl restritos dstdom_regex "/etc/squid/list/palavras-bloqueadas"
acl SSL_ports port 443 563 #http, snews
acl Safe_ports port 6901
acl Safe_ports port 6981
acl Safe_ports port 80 #http
acl Safe_ports port 70 #gopher
acl Safe_ports port 210 #wais
acl Safe_ports port 280 #http, mgmt
acl Safe_ports port 1025-29000 #portas nao declaradas
acl Safe_ports port 29002-65535 #portas nao declaradas
acl Safe_ports port 488 #gss, http
acl Safe_ports port 591 #filemaker
acl Safe_ports port 777 #multiling port
acl purge method PURGE
acl CONNECT method CONNECT
######################################################
# Aplicando Regras
######################################################
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow liberados
http_access deny bloqueados
http_access deny restritos
http_access allow rede
http_access allow localhost
http_access deny all
CENARIO
ETH0 é a WAN com o ip 192.168.6.190
ip do roteador é 192.168.6.254
ETH1 é a LAN com o ip 10.1.1.1
nao tem servico DHCP instalado, somente IPTABLES e SQUID.
a questao é que o squid funciona legal se eu setar manualmente o proxy nas maquinas ou simplesmente colocar um DNS nelas, tipo o do google 8.8.8.8, dai funciona legal. Se deixa o DNS como 10.1.1.1 sem chance... nao navega!
