iptables no mandriva2006
1. iptables no mandriva2006
mbtec
(usa Ubuntu)
Enviado em 01/02/2006 - 17:40h
Caros Amigos,Tenho tentado resolver o problema com o Mandriva2006, em relação ao
envio de emails pela rede local através dos clientes windows com
outlook, mas até o momento não consegui, mesmo com as dicas do pessoal
da lista.
Provavelmente, limitação de meus conhecimentos e entendimentos ainda no mundo linux.
Mesmo assim, recorro novamente a paciência de todos para mais algumas dicas para tentar resolver o referido problema.
Aparentemente o problema está se dando no iptables. Tentei adaptá-lo à
minhas necessidades de liberação de portas tais como pop (110), smtp
(25) ,ssh(23) e ftp(21) mas obtive mensagens de erro após startar o
serviço.
Segue descrição do iptables que está em uso para que alguém possa me
dar alguma ajuda.
Obrigado.
Mário
....
#======= iptables =======#
#!/bin/sh
#
# Startup script to implement /etc/sysconfig/iptables pre-defined rules.
#
# chkconfig: 2345 03 92
#
# description: Automates a packet filtering firewall with iptables.
#
# by bero@redhat.com, based on the ipchains script:
# Script Author: Joshua Jensen <joshua@redhat.com>
# -- hacked up by gafton with help from notting
# modified by Anton Altaparmakov <aia21@cam.ac.uk>:
# modified by Nils Philippsen <nils@redhat.de>
#
# config: /etc/sysconfig/iptables
# Source 'em up
. /etc/init.d/functions
IPTABLES_CONFIG=/etc/sysconfig/iptables
if [ ! -x /sbin/iptables ]; then
exit 0
fi
KERNELMAJ=`uname -r | sed -e 's,\..*,,'`
KERNELMIN=`uname -r | sed -e 's,[^\.]*\.,,' -e 's,\..*,,'`
if [ "$KERNELMAJ" -lt 2 ] ; then
exit 0
fi
if [ "$KERNELMAJ" -eq 2 -a "$KERNELMIN" -lt 3 ] ; then
exit 0
fi
if /sbin/lsmod 2>/dev/null |grep -q ipchains ; then
# Don't do both
exit 0
fi
iftable() {
if fgrep -qsx $1 /proc/net/ip_tables_names; then
iptables -t "$@"
fi
}
check() {
if [ -n "$1" ]; then
rm -f /lib/iptables
ln -s /lib/iptables.d/${1} /lib/iptables
iftable nat -N __T__${1##*-}__ >/dev/null 2>&1
iftable nat -A __T__${1##*-}__ -j MASQUERADE >/dev/null 2>&1
res=$?
iftable nat -F __T__${1##*-}__ >/dev/null 2>&1
iftable nat -X __T__${1##*-}__ >/dev/null 2>&1
return $res
else
/sbin/modprobe ipt_MASQUERADE >/dev/null 2>&1
kmajor=`uname -r`
kminor=${kmajor#*.}
kminor=${kminor%%.*}
kmajor=${kmajor%%.*}
for i in /lib/iptables.d/linux-$kmajor.$kminor-*; do
check ${i##*/} && break
done
/sbin/modprobe -r ipt_MASQUERADE >/dev/null 2>&1
fi
}
start() {
# don't do squat if we don't have the config file
if [ -f $IPTABLES_CONFIG ]; then
# We do _not_ need to flush/clear anything when using iptables-restore
gprintf "Applying iptables firewall rules: \n"
grep -v "^[[:space:]]*#" $IPTABLES_CONFIG | grep -v '^[[:space:]]*$' |
/sbin/iptables-restore -c && \
success "Applying iptables firewall rules" || \
failure "Applying iptables firewall rules"
echo
touch /var/lock/subsys/iptables
fi
}
stop() {
chains=`cat /proc/net/ip_tables_names 2>/dev/null`
for i in $chains; do iptables -t $i -F; done && \
success "Flushing all chains:" || \
failure "Flushing all chains:"
for i in $chains; do iptables -t $i -X; done && \
success "Removing user defined chains:" || \
failure "Removing user defined chains:"
gprintf "Resetting built-in chains to the default ACCEPT policy:"
iftable filter -P INPUT ACCEPT && \
iftable filter -P OUTPUT ACCEPT && \
iftable filter -P FORWARD ACCEPT && \
iftable nat -P PREROUTING ACCEPT && \
iftable nat -P POSTROUTING ACCEPT && \
iftable nat -P OUTPUT ACCEPT && \
iftable mangle -P PREROUTING ACCEPT && \
iftable mangle -P OUTPUT ACCEPT && \
success "Resetting built-in chains to the default ACCEPT policy" || \
failure "Resetting built-in chains to the default ACCEPT policy"
echo
rm -f /var/lock/subsys/iptables
}
case "$1" in
start)
check
start
;;
stop)
stop
;;
restart|reload)
# "restart" is really just "start" as this isn't a daemon,
# and "start" clears any pre-defined rules anyway.
# This is really only here to make those who expect it happy
start
;;
condrestart)
[ -e /var/lock/subsys/iptables ] && start
;;
status)
tables=`cat /proc/net/ip_tables_names 2>/dev/null`
for table in $tables; do
gprintf "Table: %s\n" "$table"
iptables -t $table --list
done
;;
panic)
gprintf "Changing target policies to DROP: "
iftable filter -P INPUT DROP && \
iftable filter -P FORWARD DROP && \
iftable filter -P OUTPUT DROP && \
iftable nat -P PREROUTING DROP && \
iftable nat -P POSTROUTING DROP && \
iftable nat -P OUTPUT DROP && \
iftable mangle -P PREROUTING DROP && \
iftable mangle -P OUTPUT DROP && \
success "Changing target policies to DROP" || \
failure "Changing target policies to DROP"
echo
iftable filter -F INPUT && \
iftable filter -F FORWARD && \
iftable filter -F OUTPUT && \
iftable nat -F PREROUTING && \
iftable nat -F POSTROUTING && \
iftable nat -F OUTPUT && \
iftable mangle -F PREROUTING && \
iftable mangle -F OUTPUT && \
success "Flushing all chains:" || \
failure "Flushing all chains:"
iftable filter -X INPUT && \
iftable filter -X FORWARD && \
iftable filter -X OUTPUT && \
iftable nat -X PREROUTING && \
iftable nat -X POSTROUTING && \
iftable nat -X OUTPUT && \
iftable mangle -X PREROUTING && \
iftable mangle -X OUTPUT && \
success "Removing user defined chains:" || \
failure "Removing user defined chains:"
;;
save)
gprintf "Saving current rules to %s: " "$IPTABLES_CONFIG"
touch $IPTABLES_CONFIG
chmod 600 $IPTABLES_CONFIG
/sbin/iptables-save -c > $IPTABLES_CONFIG 2>/dev/null && \
success "Saving current rules to %s" "$IPTABLES_CONFIG" || \
failure "Saving current rules to %s" "$IPTABLES_CONFIG"
echo
;;
check)
check
;;
*)
gprintf "Usage: %s
{start|stop|restart|condrestart|status|panic|save|check}\n" "$0"
exit 1
esac
exit 0
...
A maior comunidade GNU/Linux da América Latina! Artigos, dicas, tutoriais, fórum, scripts e muito mais. Ideal para quem busca auto-ajuda.
Site hospedado por:
