cfborges1993
(usa Debian)
Enviado em 29/09/2017 - 10:30h
amarildosertorio escreveu:
Poderia postar seu arquivo?
ola amarildo
ele está assim
echo "Bloqueando pacotes ICMP em todas interfaces"
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "Bloqueado ICMP em todas interfaces"
echo " "
echo "Ativando ip_forward"
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "ip_forward ativado"
echo " "
echo "Ativando protecao contra SYNFLOOD"
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo "Protecao contra SYNFLOOD ativa"
echo " "
echo "Ativando protecao contra IP SPOOFING"
for RP in /proc/sys/net/ipv4/conf/*/rp_filter ; do
echo 1 > $RP ;
done
echo "Protecao contra IP SPOOFING ativa"
echo " "
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --syn -s 127.0.0.1/255.0.0.0 -j ACCEPT
echo "Compartilhando a internet"
iptables -t nat -A POSTROUTING -s $REDE -o $IFPUB -j MASQUERADE
echo "Internet compartilhada"
echo " "
iptables -A INPUT -p tcp --dport 3382:3386 -j ACCEPT
iptables -A INPUT -s $REDE -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -s $REDE -p udp --dport 22 -j ACCEPT
iptables -A INPUT -s $REDE -p tcp -m multiport --dport 80,443 -j ACCEPT
iptables -A INPUT -s $REDE -p tcp --dport 3128 -j ACCEPT
iptables -A INPUT -s $REDE -p udp --dport 3128 -j ACCEPT
iptables -A INPUT -s $REDE -p tcp --dport 10000 -j ACCEPT
echo "Redirecionando porta 80 para 3128"
iptables -t nat -A PREROUTING -i $IFINT -d 192.168.20.121 -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -i $IFINT -p tcp --dport 80 -j REDIRECT --to-port 3128
echo "Gerando log HTTPS"
# iptables -t nat -A PREROUTING -i $IFINT -s 192.168.20.53 -p tcp -m tcp --dport 443 -j LOG --log-devel 4 --log-prefix "log_https"
iptables -A FORWARD -p tcp --dport 443 -j LOG --log-level 4 --log-prefix "log_https"
echo "Liberando MAC Servidores"
for Srv in $ListaServidores ; do
iptables -A FORWARD -d $ALL -m mac --mac-source $Srv -j ACCEPT
iptables -t nat -A PREROUTING -m mac --mac-source $Srv -i $IFINT -j ACCEPT
done
echo " Fim Liberando gerencia "
echo "Encaminhando porta TS para DC01"
iptables -t nat -A PREROUTING -p tcp --dport 3382 -j DNAT --to-dest 192.168.20.20:3389
iptables -A FORWARD -p tcp -d 192.168.20.20 --dport 3389 -j ACCEPT
echo "Encaminhando porta TS para SRV-SBSWEB"
iptables -t nat -A PREROUTING -p tcp --dport 3383 -j DNAT --to-dest 192.168.20.22:3389
iptables -A FORWARD -p tcp -d 192.168.20.22 --dport 3389 -j ACCEPT
echo "Encaminhando porta TS para SRV-SBSWEB-HOMOLOG"
iptables -t nat -A PREROUTING -p tcp --dport 3384 -j DNAT --to-dest 192.168.20.23:3389
iptables -A FORWARD -p tcp -d 192.168.20.23 --dport 3389 -j ACCEPT
echo "Encaminhando porta TS para SRV-SBS2K3"
iptables -t nat -A PREROUTING -p tcp --dport 3385 -j DNAT --to-dest 192.168.20.24:3389
iptables -A FORWARD -p tcp -d 192.168.20.24 --dport 3389 -j ACCEPT
echo "Encaminhando porta TS para SRV-SBS"
iptables -t nat -A PREROUTING -p tcp --dport 3386 -j DNAT --to-dest 192.168.20.55:3389
iptables -A FORWARD -p tcp -d 192.168.20.55 --dport 3389 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 5700:5704 -j ACCEPT
iptables -A INPUT -p tcp --dport 9099 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 5700 -j DNAT --to-dest 192.168.20.20:5700
iptables -A FORWARD -p tcp -d 192.168.20.20 --dport 5700 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 9099 -j DNAT --to-dest 192.168.20.20:9099
iptables -A FORWARD -p tcp -d 192.168.20.20 --dport 9099 -j ACCEPT
echo "Liberando TODOS Computadores para acesso sem proxy Apenas em emergencia"
iptables -A FORWARD -s $REDE -d $ALL -p tcp --dport 0:65000 -j ACCEPT
iptables -A FORWARD -s $REDE -d $ALL -p udp --dport 0:65000 -j ACCEPT
echo "Fim"
