lclementino18
(usa Debian)
Enviado em 26/07/2017 - 17:30h
LSSilva escreveu:
lclementino18 escreveu:
Fala ai turma,
Estou com um problema há tempos no meu Firewall Debian.
Atualmente tenho um Debian com squid e squid guard, além do iptables.
O que acontece é que após alguns dias (as vezes 1 semana) de uso a internet que tenho de 14MB dedicados cai drasticamente (para 4MB), e dou um reboot, após reiniciar ele fica normal por mais alguns dias. Me dá impressão que conforme vai usando, vai enchendo memória, ou algo assim e fica lento, já tentei alguns comandos para limpar a memória, porém sem sucesso sempre.
Alguma sugestão de teste, ou algum palpite do que possa ser?
Quando você nota essa lentidão, você já testou se acontece somente na rede local ou no servidor também?
Posta as configs de firewall e o squid.conf pra gente dar uma olhada.
####FW PRINCIPAL####
iniciar () {
#!/bin/sh
### BEGIN INIT INFO
# Provides: Fw-EMPRESA
# Required-Start:
# REquired-Stop:
# Default-Start: 2
# Default-Stop: 0 1 6
# Short-Description: Start daemon at boot time
# Description: Enable service provide by daemon
### END INIT INFO
#VARIAVEIS DEFINEM CONFIGURAÇÕES DE REDE
#QUANDO MUDAR QUALQUER ENDEREÇO DE IP NÂO ESQUECER DE MUDAR TAMBEM NO (/etc/squid/squid.conf) POIS LA TEMOS UMA REFERENCIA A ESTES ENDEREÇOS
#TELECOM1#
IP0=192.168.14.2
GW0=192.168.14.1
NET0=192.168.14.0/24
BCAST0=192.168.14.255
IFACE0=eth0
#EMBRATEL#
IP1=809.700.8.6
GW1=809.700.8.5
NET1=809.700.8.4/28
BCAST1=201.72.18.63
IFACE1=eth1
#REDE LOCAL#
IP2=192.168.1.1
NET2=192.168.1.1/24
BCAST2=192.168.1.255
IFACE2=eth2
#DESCOMENTAR set -x PARA DEPURAR O SCRIPT
set -x
#ZERA AS CONFIGURACOES DO FIREWALL#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle -X
#DEFINE POLITICAS PADRÂO DO FIREWALL
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
#CARREGA OS MODULOS NECESSARIOS AO IPTABLES
modprobe ip_tables
modprobe iptable_nat
modprobe iptable_mangle
modprobe ip_conntrack
#NOVA CHAIN PARA O SCRIPT QUE BLOQUEIA ULTRASURF
#iptables -t filter -N fdenyall
#iptables -t filter -I FORWARD 1 -j fdenyall
#ATIVA REPASSE DE PACOTE POSSIBILANDO ROTEAMENTO ENTRE INTERFACES
echo "1" > /proc/sys/net/ipv4/ip_forward
##LIBERA ACESSO A REDE LOCAL##
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i 127.0.0.1 -j ACCEPT
##MASCARAMENTO DOS PACOTES##
#todos os pacotes depois de serem roteados recebem o endereco da interface dee saida
iptables -t nat -A POSTROUTING -o $IFACE0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o $IFACE1 -j MASQUERADE
#LIBERA RESPOSTA "PONG" QUANDO SOLICITADO PELO SERVIDOR FIREWALL "PING"
#UTILIZADO SCRIPT FAILOVER PARA TESTAR A CONEXÂO
iptables -A INPUT -p icmp --icmp-type pong -j ACCEPT
#COLETORES LIBERAR O PROXY, POREM NO PROXY SOMENTE PARA SERVIDOR TOTVS
for IP in $(cat /etc/coletores); do
iptables -A INPUT -s $IP -d 192.168.1.1 -j ACCEPT
done
#BLOQUEIA TODOS OS IPS QUE NÂO ESTÂO EM USO E OU QUE NÂO DEVEM ACESSAR A INTERNET
for IP in $(cat /etc/ips_banidos_fw); do
iptables -A INPUT -s $IP -j DROP
done
##ABRE CONSULTA DNS NO SERVIDOR LOCAL E NAS OUTRAS REDES LOCAIS##
iptables -A INPUT -s 192.168.1.0/24 -i $IFACE2 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -i $IFACE2 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.2.0/24 -i $IFACE2 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.2.0/24 -i $IFACE2 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.3.0/24 -i $IFACE2 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.3.0/24 -i $IFACE2 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.4.0/24 -i $IFACE2 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.4.0/24 -i $IFACE2 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.8.0/24 -i $IFACE2 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.8.0/24 -i $IFACE2 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.7.0/24 -i $IFACE2 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.7.0/24 -i $IFACE2 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.9.0/24 -i $IFACE2 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.9.0/24 -i $IFACE2 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.10.0/24 -i $IFACE2 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.10.0/24 -i $IFACE2 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.12.0/24 -i $IFACE2 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.12.0/24 -i $IFACE2 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --sport 53 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
##ATIVAR O PROXY TRANSPARENTE##TESTES COM PROXY AUTENTICADO
#iptables -t nat -A PREROUTING -i $IFACE2 -p tcp -d 0/0 --dport 80 -j REDIRECT --to-port 3128
#iptables -t nat -A PREROUTING -i $IFACE2 -p tcp -d 0/0 --dport 8080 -j REDIRECT --to-port 3128
iptables -A INPUT -i $IFACE2 -p tcp --dport 3128 -j ACCEPT
iptables -A INPUT -i $IFACE0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i $IFACE1 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i $IFACE0 -p tcp --sport 8080 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i $IFACE1 -p tcp --sport 8080 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i $IFACE0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i $IFACE1 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
##NFE PASSAR DIRETO SEM PROXY
iptables -A FORWARD -p tcp -i $IFACE2 -s 192.168.1.201 --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.201 --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 -s 192.168.1.201 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.201 --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 -s 192.168.1.210 --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.210 --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 -s 192.168.1.210 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.210 --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 -s 192.168.3.3 --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.3.3 --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 -s 192.168.3.3 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.3.3 --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 -s 192.168.3.2 --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.3.2 --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 -s 192.168.3.2 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.3.2 --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 -s 192.168.1.99 --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.99 --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 -s 192.168.1.99 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.99 --sport 80 -m state --state ESTABLISHED -j ACCEPT
#####################################################################################################
#LIBERA PORTAS PARA E_MAIL (POP e SMTP e IMAP)
iptables -A FORWARD -p tcp -i $IFACE2 --dport 110 -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 --dport 26 -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 --dport 995 -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 --dport 465 -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 --dport 587 -j ACCEPT
iptables -A FORWARD -p tcp -i $IFACE2 --dport 993 -j ACCEPT
iptables -A FORWARD -p tcp --sport 995 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 465 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 587 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 993 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 110 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 26 -m state --state ESTABLISHED -j ACCEPT
#SERVIDOR TRES LAGOAS
#GERAL
iptables -A FORWARD -s 187.50.122.30 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 200.242.179.18 -m state --state ESTABLISHED -j ACCEPT
#SSH
iptables -A FORWARD -s 192.168.1.207 -p tcp --dport 22 -j ACCEPT
iptables -A FORWARD -s 192.168.1.217 -p tcp --dport 22 -j ACCEPT
iptables -A FORWARD -s 192.168.1.16 -p tcp --dport 22 -j ACCEPT
iptables -A FORWARD -s 192.168.1.26 -p tcp --dport 22 -j ACCEPT
#NTOP
iptables -A FORWARD -s 192.168.1.207 -p tcp --dport 32000 -j ACCEPT
#WEB
iptables -A FORWARD -s 192.168.1.207 -p tcp --dport 57680 -j ACCEPT
#Liberar acesso de itu para TS Tres Lagoas(SRVPRINT), e WEBPRINT
iptables -A FORWARD -p tcp -d 200.242.179.18 --dport 3389 -j ACCEPT
iptables -A FORWARD -p tcp -d 200.242.179.18 --dport 5050 -j ACCEPT
## LIBERA AS PORTAS PARA COMUNICAO COM O SERASA ##
iptables -I FORWARD -p tcp -s 192.168.1.4 --dport 10000 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.1.4 --sport 10000 -m state --state ESTABLISHED -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.1.18 --dport 10000 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.1.18 --sport 10000 -m state --state ESTABLISHED -j ACCEPT
##08-06-2017 - PORTAS DE COMUNICACAO COM O SERASA - SERVIDOR TOTVS##
iptables -I FORWARD -p tcp -s 192.168.1.210 --dport 10000 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.1.210 --sport 10000 -m state --state ESTABLISHED -j ACCEPT
iptables -I FORWARD -p tcp -s 192.168.1.210 --dport 8676 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.1.210 --sport 8676 -m state --state ESTABLISHED -j ACCEPT
##PORTAL LIBERADAS PARA ISCAS PORTSENTRY - BLOQUEAR SCANNERS DE REDE ######
iptables -I INPUT -p tcp --dport 79 -j ACCEPT
iptables -I INPUT -p tcp --dport 1523 -j ACCEPT
iptables -I INPUT -p tcp --dport 27655 -j ACCEPT
iptables -I INPUT -p tcp --dport 48724 -j ACCEPT
############################################################################
#############################################################################
##PERMITE CONEXÔES SERVIÇOS ADMNISTRAÇÂO SERVIDOR##
#NTOP
iptables -A INPUT -i $IFACE2 -s 192.168.1.207 -p tcp --dport 3000 -j ACCEPT
#SSH
iptables -A INPUT -i $IFACE2 -s 192.168.1.207 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i $IFACE2 -s 192.168.1.242 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i $IFACE2 -s 192.168.1.217 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i $IFACE2 -s 192.168.1.26 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i $IFACE0 -p tcp --dport 22 -j DROP
iptables -A INPUT -i $IFACE1 -p tcp --dport 22 -j DROP
#SMNP
iptables -A INPUT -s 192.168.1.242 -i $IFACE2 -p udp --dport 161 -j ACCEPT
iptables -A INPUT -i $IFACE0 -p udp --dport 161 -j DROP
iptables -A INPUT -i $IFACE1 -p udp --dport 161 -j DROP
#LIBERA CONSULTA DE HORA TODOS SERVIDORES
iptables -A INPUT -i $IFACE2 -p udp --dport 123 -j ACCEPT
iptables -A INPUT -p udp --dport 123 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i $IFACE2 -p icmp -s 192.168.1.211 --dport 445 -j ACCEPT
iptables -A INPUT -i $IFACE2 -p icmp -s 192.168.1.213 --dport 445 -j ACCEPT
iptables -A INPUT -i $IFACE2 -p udp -s 192.168.1.211 -j ACCEPT
iptables -A INPUT -i $IFACE2 -p udp -s 192.168.1.213 -j ACCEPT
iptables -A INPUT -i $IFACE2 -p tcp -s 192.168.1.211 -j ACCEPT
iptables -A INPUT -i $IFACE2 -p tcp -s 192.168.1.213 -j ACCEPT
#LIBERA PING NAGIOS
iptables -A INPUT -i $IFACE2 -p icmp -s 192.168.1.242 -j ACCEPT
## LIBERAR ACESSO AO BANCO DE DADOS BASE PARA O SNORT Dh-EMPRESA 192.168.1.242
iptables -A INPUT -i $IFACE2 -p tcp -s 192.168.1.242 --dport 3306 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i $IFACE2 -p tcp -s 192.168.1.242 --sport 3306 -m state --state ESTABLISHED -j ACCEPT
########## PRIORIDADES NO ACESSO #####################################
#COLOCA PRIORIDADE 16 NOS ACESSOS DENISE AO BRADESCO
#iptables -t mangle -A OUTPUT -d 200.155.86.35 -j TOS --set-tos 16
#iptables -t mangle -A OUTPUT -d 200.155.86.38 -j TOS --set-tos 16
#iptables -t mangle -A OUTPUT -d 200.155.86.46 -j TOS --set-tos 16
#COLOCA PRIORIDADE 16 MAXIMA ACESSO TOTVS TL
#ENTRADA#
iptables -t mangle -A PREROUTING -i $IFACE0 -p tcp --sport 5234 -j TOS --set-tos 16
iptables -t mangle -A PREROUTING -i $IFACE1 -p tcp --sport 5234 -j TOS --set-tos 16
iptables -t mangle -A PREROUTING -i $IFACE2 -p tcp --sport 5234 -j TOS --set-tos 16
iptables -t mangle -A PREROUTING -i $IFACE0 -p tcp --sport 9234 -j TOS --set-tos 16
iptables -t mangle -A PREROUTING -i $IFACE1 -p tcp --sport 9234 -j TOS --set-tos 16
iptables -t mangle -A PREROUTING -i $IFACE2 -p tcp --sport 9234 -j TOS --set-tos 16
#FORWARD#
iptables -t mangle -A FORWARD -p tcp --dport 5234 -j TOS --set-tos 16
iptables -t mangle -A FORWARD -p tcp --sport 5234 -j TOS --set-tos 16
iptables -t mangle -A FORWARD -p tcp --dport 9234 -j TOS --set-tos 16
iptables -t mangle -A FORWARD -p tcp --sport 9234 -j TOS --set-tos 16
#SAIDA#
iptables -t mangle -A OUTPUT -o $IFACE0 -p tcp --dport 5234 -j TOS --set-tos 16
iptables -t mangle -A OUTPUT -o $IFACE1 -p tcp --dport 5234 -j TOS --set-tos 16
iptables -t mangle -A OUTPUT -o $IFACE2 -p tcp --dport 5234 -j TOS --set-tos 16
iptables -t mangle -A OUTPUT -o $IFACE0 -p tcp --dport 9234 -j TOS --set-tos 16
iptables -t mangle -A OUTPUT -o $IFACE1 -p tcp --dport 9234 -j TOS --set-tos 16
iptables -t mangle -A OUTPUT -o $IFACE2 -p tcp --dport 9234 -j TOS --set-tos 16
########################################################################
###################### REDIRECIONAMENTO DE PORTAS #################################
##PROTHEUS11-OFICIAL (192.168.1.210:5234 )
iptables -t nat -A PREROUTING -p tcp --dport 5234 -j LOG --log-prefix "TOTVS-RMT"
iptables -t nat -A PREROUTING -p tcp --dport 5234 -j DNAT --to-destination 192.168.1.210:5234
iptables -A FORWARD -p tcp --dport 5234 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 5234 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.1.210 -p tcp --dport 5234 -o $IFACE2 -j SNAT --to $IP2
iptables -A FORWARD -p tcp --dport 5234 -j ACCEPT
##PROTHEUS11-OFICIAL RH (192.168.1.220:9234 )
iptables -t nat -A PREROUTING -p tcp --dport 9234 -j LOG --log-prefix "TOTVS_RH"
iptables -t nat -A PREROUTING -p tcp --dport 9234 -j DNAT --to-destination 192.168.1.210:8234
iptables -A FORWARD -p tcp --dport 9234 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 9234 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --dport 8234 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 8234 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.1.210 -p tcp --dport 8234 -o $IFACE2 -j SNAT --to $IP2
iptables -A FORWARD -p tcp --dport 9234 -j ACCEPT
iptables -A FORWARD -p tcp --dport 8234 -j ACCEPT
##PROTHEUS11-BASE TESTE PROTHEUS (192.168.1.210:4434 )
iptables -t nat -A PREROUTING -p tcp --dport 4434 -j LOG --log-prefix "TOTVS-BASE_TESTE"
iptables -t nat -A PREROUTING -p tcp --dport 4434 -j DNAT --to-destination 192.168.1.210:4434
iptables -A FORWARD -p tcp --dport 4434 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 4434 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.1.210 -p tcp --dport 4434 -o $IFACE2 -j SNAT --to $IP2
iptables -A FORWARD -p tcp --dport 4434 -j ACCEPT
##PABX## (192.168.1.100 porta 987)
iptables -t nat -A PREROUTING -p tcp --dport 987 -j DNAT --to-destination 192.168.1.100:987
iptables -A FORWARD -p tcp --dport 987 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 987 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.1.100 -p tcp --dport 987 -o $IFACE2 -j SNAT --to $IP2
iptables -A FORWARD -p tcp --dport 987 -j ACCEPT
##VNC## (192.168.1.210 porta 32853)
#LOGAR ENTRADAS DE FORA NO VNC
iptables -t nat -A PREROUTING -p tcp --dport 32853 -j LOG --log-prefix "VNC"
iptables -t nat -A PREROUTING -p tcp --dport 32853 -j DNAT --to-destination 192.168.1.210:32853
iptables -A FORWARD -p tcp --dport 32853 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 32853 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.1.210 -p tcp --dport 32853 -o $IFACE2 -j SNAT --to $IP2
iptables -A FORWARD -p tcp --dport 32853 -j ACCEPT
##PORTAL## (192.168.1.243 porta 8087 - Proativa)
iptables -t nat -A PREROUTING -p tcp --dport 8087 -j LOG --log-prefix "PORTAL-PROATIVA"
iptables -t nat -A PREROUTING -p tcp --dport 8087 -j DNAT --to-destination 192.168.1.243:8087
iptables -A FORWARD -p tcp --dport 8087 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 8087 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.1.243 -p tcp --dport 8087 -o $IFACE2 -j SNAT --to $IP2
iptables -A FORWARD -p tcp --dport 8087 -j ACCEPT
##DVR## (192.168.1.212 porta 2005)
iptables -t nat -A PREROUTING -p tcp --dport 2005 -j DNAT --to-destination 192.168.1.212:2005
iptables -A FORWARD -p tcp --dport 2005 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 2005 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.1.212 -p tcp --dport 2005 -o $IFACE2 -j SNAT --to $IP2
iptables -A FORWARD -p tcp --dport 2005 -j ACCEPT
##DVR## (192.168.1.212 porta 9000)
iptables -t nat -A PREROUTING -p tcp --dport 9000 -j DNAT --to-destination 192.168.1.212:9000
iptables -A FORWARD -p tcp --dport 9000 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 9000 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.1.212 -p tcp --dport 9000 -o $IFACE2 -j SNAT --to $IP2
iptables -A FORWARD -p tcp --dport 9000 -j ACCEPT
iptables -t mangle -A PREROUTING -i $IFACE2 -p tcp -s 192.168.1.221 -j MARK --set-mark 6
iptables -t mangle -A OUTPUT -p tcp -s 192.168.1.221 -j MARK --set-mark 6
iptables -t mangle -A PREROUTING -p tcp -d 192.168.1.221 -j MARK --set-mark 6
iptables -t mangle -A OUTPUT -p tcp -d 192.168.1.221 -j MARK --set-mark 6
## TESTE MARCAÇÂO DE PACOTES
#iptables -t mangle -A OUTPUT -j MARK --set-mark 6
#Modulo configurações secundarias
/root/mod_iptables
#Acesso servidor WEB (8443)
/root/mod_iptables_web Liberar
#LIBERAR PORTAS DE 8050 até 8064
#TESTE COM MEU NOTEBOOK
for IP in $(seq 50 64); do
iptables -A FORWARD -p tcp -s 200.242.179.18 --sport 80$IP -d 192.168.1.207 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -s 192.168.1.108 -d 200.242.179.18 --dport 80$IP -j ACCEPT
done
#desktop
for IP in $(seq 50 64); do
iptables -A FORWARD -p tcp -s 200.242.179.18 --sport 80$IP -d 192.168.1.108 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -s 192.168.1.16 -d 200.242.179.18 --dport 80$IP -j ACCEPT
done
##################################################################################################
#UTILIZEI MARCACAO NOS PACOTES QUE SAEM DO SERVIDOR UTILIZANDO PROTOCOLO ICMP
#(PING) PARA QUE O PING SEMPRE UTILIZE A ROTA CORRETA AJUDANDO O SCRIPT DE
#FAILOVER SENDO MARCACAO SWTELECOM=6 EMBRATEL=2
iptables -t mangle -A OUTPUT -p icmp -o $IFACE0 -j MARK --set-mark 6
iptables -t mangle -A OUTPUT -p icmp -o $IFACE1 -j MARK --set-mark 2
exit 0
}
parar(){
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
}
case "$1" in
"start") iniciar ;;
"stop") parar ;;
"restart") parar; iniciar ;;
*) echo "Use os parametros start ou stop"
esac
####FW AUXILIAR####
set -x
iptables -A INPUT -s 186.14.10.123 -j DROP
iptables -A INPUT -s 94.43.237.163 -j DROP
iptables -A INPUT -s 123.97.235.189 -j DROP
iptables -A INPUT -s 188.129.132.40 -j DROP
iptables -A INPUT -s 220.134.103.206 -j DROP
iptables -A INPUT -s 78.189.108.139 -j DROP
iptables -A INPUT -s 110.189.105.65 -j DROP
iptables -A INPUT -s 118.122.95.214 -j DROP
iptables -A INPUT -s 124.226.61.231 -j DROP
iptables -A INPUT -s 61.221.93.36 -j DROP
iptables -A INPUT -s 114.35.23.141 -j DROP
iptables -A INPUT -s 218.85.231.32 -j DROP
iptables -A INPUT -s 204.93.180.13 -j DROP
iptables -A INPUT -s 154.35.32.10 -j DROP
iptables -A INPUT -s 154.35.32.12 -j DROP
iptables -A INPUT -s 204.93.180.12 -j DROP
iptables -A INPUT -s 154.35.32.12 -j DROP
iptables -A INPUT -s 154.35.32.11 -j DROP
iptables -A INPUT -s 154.35.32.16 -j DROP
iptables -A INPUT -s 204.93.180.12 -j DROP
iptables -A INPUT -s 204.93.154.194 -j DROP
iptables -A INPUT -s 204.93.154.202 -j DROP
iptables -A INPUT -s 204.93.154.203 -j DROP
iptables -A INPUT -s 204.93.154.198 -j DROP
iptables -A INPUT -s 204.93.180.6 -j DROP
iptables -A INPUT -s 204.93.154.201 -j DROP
iptables -A INPUT -s 204.93.154.199 -j DROP
iptables -A INPUT -s 204.93.180.13 -j DROP
iptables -A INPUT -s 204.93.154.207 -j DROP
iptables -A INPUT -s 71.6.167.142 -j DROP
iptables -A INPUT -s 198.20.70.114 -j DROP
iptables -A INPUT -s 204.93.154.218 -j DROP
iptables -A INPUT -s 204.93.154.219 -j DROP
iptables -A INPUT -s 71.6.167.142 -j DROP
iptables -A INPUT -s 66.240.192.138 -j DROP
iptables -A INPUT -s 82.221.105.6 -j DROP
iptables -A INPUT -s 82.221.105.7 -j DROP
iptables -A INPUT -s 204.93.154.208 -j DROP
iptables -A INPUT -s 154.35.32.243 -j DROP
iptables -A INPUT -s 198.20.99.130 -j DROP
iptables -A INPUT -s 198.20.69.98 -j DROP
iptables -A INPUT -s 154.35.32.145 -j DROP
iptables -A INPUT -s 204.93.154.207 -j DROP
iptables -A INPUT -s 66.240.192.138 -j DROP
iptables -A INPUT -s 204.93.154.221 -j DROP
iptables -A INPUT -s 82.221.105.7 -j DROP
iptables -A INPUT -s 82.221.105.6 -j DROP
iptables -A INPUT -s 82.221.105.6 -j DROP
iptables -A INPUT -s 66.240.192.138 -j DROP
iptables -A INPUT -s 204.93.154.221 -j DROP
iptables -A INPUT -s 82.221.105.7 -j DROP
iptables -A INPUT -s 82.221.105.6 -j DROP
iptables -A INPUT -s 82.221.105.6 -j DROP
iptables -A INPUT -s 66.240.192.138 -j DROP
iptables -A INPUT -s 66.240.236.119 -j DROP
iptables -A INPUT -s 198.20.69.98 -j DROP
iptables -A INPUT -s 204.93.154.222 -j DROP
iptables -A INPUT -s 204.93.154.214 -j DROP
iptables -A INPUT -s 204.93.154.194 -j DROP
iptables -A INPUT -s 204.93.154.204 -j DROP
iptables -A INPUT -s 204.93.180.6 -j DROP
iptables -A INPUT -s 204.93.154.209 -j DROP
iptables -A INPUT -s 204.93.154.217 -j DROP
iptables -A INPUT -s 198.20.99.130 -j DROP
iptables -A INPUT -s 71.6.167.142 -j DROP
iptables -A INPUT -s 204.93.154.218 -j DROP
iptables -A INPUT -s 204.93.154.219 -j DROP
iptables -A INPUT -s 198.20.70.114 -j DROP
iptables -A INPUT -s 66.240.192.138 -j DROP
iptables -A INPUT -s 71.6.167.142 -j DROP
iptables -A INPUT -s 198.20.69.98 -j DROP
iptables -A INPUT -s 82.221.105.7 -j DROP
iptables -A INPUT -s 71.6.167.142 -j DROP
iptables -A INPUT -s 71.6.165.200 -j DROP
iptables -A INPUT -s 46.19.136.229 -j DROP
iptables -A INPUT -s 82.221.105.6 -j DROP
iptables -A INPUT -s 71.6.135.131 -j DROP
iptables -A INPUT -s 198.20.70.114 -j DROP
iptables -A INPUT -s 66.240.236.119 -j DROP
iptables -A INPUT -s 82.221.105.6 -j DROP
iptables -A INPUT -s 71.6.135.131 -j DROP
iptables -A INPUT -s 188.138.9.50 -j DROP
iptables -A INPUT -s 71.6.135.131 -j DROP
iptables -A INPUT -s 85.25.43.94 -j DROP
iptables -A INPUT -s 188.138.9.50 -j DROP
iptables -A INPUT -s 66.240.236.119 -j DROP
#BLOQUEAR IPV6
ip6tables -A INPUT -j DROP
ip6tables -A FORWARD -j DROP
ip6tables -A OUTPUT -j DROP
#Liberar autenticacao do squid no samba PDC e liberar acessos a internet#############################
iptables -A INPUT -i eth2 -p tcp -s 192.168.1.205 --sport 139 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth2 -p udp -s 192.168.1.205 --sport 139 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth2 -p udp -s 192.168.1.205 --sport 138 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth2 -p tcp -s 192.168.1.205 --sport 138 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth2 -p tcp -s 192.168.1.205 --sport 137 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth2 -p udp -s 192.168.1.205 --sport 137 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth2 -p tcp -s 192.168.1.205 --sport 445 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth2 -p udp -s 192.168.1.205 --sport 445 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d 192.168.1.205 --dport 139 -j ACCEPT
iptables -A OUTPUT -p udp -d 192.168.1.205 --dport 139 -j ACCEPT
iptables -A OUTPUT -p udp -d 192.168.1.205 --dport 138 -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 --dport 139 -j DROP
iptables -A INPUT -p ucp -s 0/0 --dport 139 -j DROP
iptables -A INPUT -p tcp -s 0/0 --dport 138 -j DROP
iptables -A INPUT -p tcp -s 0/0 --dport 137 -j DROP
##Portas para liberar comunicao interna firewall
iptables -A FORWARD -p tcp --dport 13000 -j ACCEPT
iptables -A FORWARD -p tcp --dport 13000 -j ACCEPT
######################################################################################################
#LIBERAR IP SERVIDORES INTERNOS
iptables -A INPUT -p tcp -s 192.168.1.1 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.242 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.205 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.239 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.243 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.201 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.130 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.131 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.210 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.3.2 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.3.5 -m state --state ESTABLISHED -j ACCEPT
##Liberar Comunicacao com o PowerChute
iptables -A INPUT -p tcp -i eth2 --dport 6547 -j ACCEPT
iptables -A INPUT -p tcp -i eth2 --dport 3052 -j ACCEPT
#############TESTE OPENVPN
iptables -t nat -A PREROUTING -p tcp --dport 1194 -j LOG --log-prefix "OPENVPN"
iptables -t nat -A PREROUTING -p tcp --dport 1194 -j DNAT --to-destination 192.168.1.215:1194
iptables -A FORWARD -p tcp --dport 1194 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 1194 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.1.215 -p tcp --dport 1194 -o eth2 -j SNAT --to 192.168.1.1
iptables -A FORWARD -p tcp --dport 1194 -j ACCEPT
#LIBERACAO SITE CLAUDECIR SOLICITADO POR CHAMADO 17/03/2016 N CHAMADO 2188
iptables -A FORWARD -p tcp -i eth2 -s 192.168.1.5 --dport 8083 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.5 --sport 8083 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -i eth2 -s 192.168.1.8 -d 200.148.135.180 --dport 12 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.8 -s 200.148.135.180 --sport 12 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -i eth2 -s 192.168.1.8 -d 200.148.135.180 --dport 82 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.8 -s 200.148.135.180 --sport 82 -m state --state ESTABLISHED -j ACCEPT
#Porta da receita federal
iptables -A FORWARD -p tcp -s 192.168.1.2 --dport 3456 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.2 --sport 3456 -m state --state ESTABLISHED -j ACCEPT
##########
iptables -A FORWARD -p tcp -s 192.168.1.207 --dport 465 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.207 --sport 465 -m state --state ESTABLISHED -j ACCEPT
################### PORTA ADICIONADA NO SQUID E NA REGRA ABAIXO, LIBERAR SITE EUCATUR
iptables -A FORWARD -p tcp -s 192.168.1.8 --dport 8085 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.8 --sport 8085 -m state --state ESTABLISHED -j ACCEPT
##VPN
iptables -t nat -A PREROUTING -p udp --dport 1701 -j LOG --log-prefix "1701VPN"
iptables -t nat -A PREROUTING -p udp --dport 500 -j LOG --log-prefix "500VPN"
iptables -t nat -A PREROUTING -p udp --dport 4500 -j LOG --log-prefix "4500VPN"
iptables -t nat -A PREROUTING -p udp --dport 1701 -j DNAT --to-destination 192.168.1.215:1701
iptables -t nat -A PREROUTING -p udp --dport 500 -j DNAT --to-destination 192.168.1.215:500
iptables -t nat -A PREROUTING -p udp --dport 4500 -j DNAT --to-destination 192.168.1.215:4500
iptables -A FORWARD -p udp --dport 1701 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p udp --sport 1701 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p udp --dport 500 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p udp --sport 500 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p udp --dport 4500 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p udp --sport 4500 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.1.215 -p udp --dport 1701 -o eth2 -j SNAT --to 192.168.1.1
iptables -t nat -A POSTROUTING -d 192.168.1.215 -p udp --dport 500 -o eth2 -j SNAT --to 192.168.1.1
iptables -t nat -A POSTROUTING -d 192.168.1.215 -p udp --dport 4500 -o eth2 -j SNAT --to 192.168.1.1
iptables -A FORWARD -p udp --dport 1701 -j ACCEPT
iptables -A FORWARD -p udp --dport 500 -j ACCEPT
iptables -A FORWARD -p udp --dport 4500 -j ACCEPT
####### VNC DO SERVIDOR EGA ################################################################################
##TOTVS-FINSP (MEUIP:5237 ) SERVIDOR 192.168.1.210 TOTVS
iptables -t nat -A PREROUTING -p tcp --dport 5237 -j LOG --log-prefix "TOTVS-SP"
iptables -t nat -A PREROUTING -p tcp --dport 5237 -j DNAT --to-destination 192.168.1.210:5237
iptables -A FORWARD -p tcp --dport 5237 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 5237 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.1.210 -p tcp --dport 5237 -o eth2 -j SNAT --to 192.168.1.1
iptables -A FORWARD -p tcp --dport 5237 -j ACCEPT
## ACESSOS SOLICITADOS PROJETO TOTVS LIBERADO EM 03/06/2014 LIBERADO TAMBEM SQUID.CONF ##
## SAIDA # #### VERIFICAR SE AINDA E USADO#
iptables -A FORWARD -p tcp -i eth2 -s 192.168.1.135 --dport 27220 -j ACCEPT
iptables -A FORWARD -p tcp -i eth2 -s 192.168.1.135 --dport 27500 -j ACCEPT
iptables -A FORWARD -p tcp -i eth2 -s 192.168.1.135 --dport 5024 -j ACCEPT
iptables -A FORWARD -p tcp -i eth2 -s 192.168.1.136 --dport 27220 -j ACCEPT
iptables -A FORWARD -p tcp -i eth2 -s 192.168.1.136 --dport 27500 -j ACCEPT
iptables -A FORWARD -p tcp -i eth2 -s 192.168.1.136 --dport 5024 -j ACCEPT
#Leo
iptables -A FORWARD -d 192.168.1.207 -j ACCEPT
iptables -A FORWARD -s 192.168.1.207 -j ACCEPT
iptables -A FORWARD -d 192.168.1.16 -j ACCEPT
iptables -A FORWARD -s 192.168.1.16 -j ACCEPT
iptables -A FORWARD -s 192.168.1.217 -j ACCEPT
iptables -A FORWARD -d 192.168.1.217 -j ACCEPT
#Lucas
iptables -A FORWARD -s 192.168.1.126 -j ACCEPT
iptables -A FORWARD -d 192.168.1.126 -j ACCEPT
#Regra Cel Jef
iptables -A FORWARD -s 192.168.1.218 -j ACCEPT
iptables -A FORWARD -d 192.168.1.218 -j ACCEPT
iptables -A FORWARD -s 192.168.1.172 -j ACCEPT
iptables -A FORWARD -d 192.168.1.172 -j ACCEPT
##################
iptables -t nat -A PREROUTING -p tcp --sport 1935 -j LOG --log-prefix "UPX"
iptables -t nat -A PREROUTING -p tcp --sport 1935 -j DNAT --to-destination 192.168.1.221:1935
iptables -A FORWARD -p tcp --dport 1935 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 1935 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.1.221 -p tcp --sport 1935 -o eth2 -j SNAT --to 192.168.1.1
iptables -A FORWARD -p tcp --dport 1935 -j ACCEPT
iptables -A FORWARD -p tcp --sport 1935 -j ACCEPT
iptables -t nat -A PREROUTING -p udp --sport 1935 -j LOG --log-prefix "UPX"
iptables -t nat -A PREROUTING -p udp --sport 1935 -j DNAT --to-destination 192.168.1.221:1935
iptables -A FORWARD -p udp --dport 1935 -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -p udp --sport 1935 -m state --state ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -d 192.168.1.221 -p udp --sport 1935 -o eth2 -j SNAT --to 192.168.1.1
iptables -A FORWARD -p udp --dport 1935 -j ACCEPT
iptables -A FORWARD -p udp --sport 1935 -j ACCEPT
#Modulo configuracoes TS
/root/TS_SRV
#PABX
iptables -A FORWARD -s 192.168.1.100 -j ACCEPT
iptables -A FORWARD -d 192.168.1.100 -j ACCEPT
#LEO 21/02/2016 -PORTAL EMPRESA
if [ -f /root/Scripts/PORTAL_LIBERADO ]; then
/root/Scripts/Portal Abrir $(cat /root/Scripts/PORTAL_LIBERADO)
fi
#LIBERACAO WHATSAPP PARA PORTARIA - AUTORIZADO DENISE 08-06-2017#
iptables -A FORWARD -p udp --dport 3478 -j ACCEPT
iptables -A FORWARD -p tcp --dport 5222 -j ACCEPT
iptables -A FORWARD -p tcp --dport 5223 -j ACCEPT
#IphonePedro
iptables -A FORWARD -d 192.168.1.42 -j ACCEPT
iptables -A FORWARD -s 192.168.1.42 -j ACCEPT
#Acessos Agenda Totvs IP - Consultores
http://erp.totvsip.com.br:81/agendaip/
iptables -A INPUT -p tcp --sport 8000 -m state --state ESTABLISHED -j ACCEPT
#Liberar Porta 80 Para Servidores e No-break
iptables -A INPUT -p tcp -s 192.168.3.0 -d 192.168.1.211 -j ACCEPT
iptables -A OUTPUT -p tcp -s 192.168.1.211 -d 192.168.3.0 -j ACCEPT
#ATRATI - Banco de Dados externo
iptables -A INPUT -p tcp --sport 3306 -m state --state ESTABLISHED -j ACCEPT
#Cameras TL
iptables -A INPUT -p tcp --sport 8000 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 8001 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 8002 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 8003 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 8158 -m state --state ESTABLISHED -j ACCEPT
#Rafael
iptables -A FORWARD -d 192.168.1.108 -j ACCEPT
iptables -A FORWARD -s 192.168.1.108 -j ACCEPT
iptables -A FORWARD -d 192.168.1.24 -j ACCEPT
iptables -A FORWARD -s 192.168.1.24 -j ACCEPT
iptables -A FORWARD -d 192.168.1.41 -j ACCEPT
iptables -A FORWARD -s 192.168.1.41 -j ACCEPT
iptables -A FORWARD -d 192.168.1.44 -j ACCEPT
iptables -A FORWARD -s 192.168.1.44 -j ACCEPT
