OK, abaixo script completo, novamente dizendo funciona bem no 98 mas no XP ele nao permite navegar nos
sites liberados!!Será que alguem tem alguma ideia
?
Diego S. Oliveira
INT_INT="eth0"
EXT_INT="eth1"
EXT_IP="200.100.100.100" 'ip
ficticio
LANNET="192.168.1.0/255.255.255.0"
ANY="0.0.0.0/0"
if [ -z $EXT_IP ]; then
echo "Pegando IP externo na Interface
$EXT_INT"
EXT_IP="`ifconfig $EXT_INT 2> /dev/null | grep 'inet end' | awk
'{print $3}'`"/32
fi
# Ativa modulos
MODULOS="ip_tables ip_conntrack ip_conntrack_ftp iptable_nat ip_nat_ftp"
for a in $(echo $MODULOS)
do
if lsmod | grep ^$a > /dev/null;
then
echo "Modulo $a Ativo!"
else
echo "Ativando modulo $a ..."
insmod $a
fi
done
# Elimina Chains anteriores
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -P
INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD
ACCEPT
iptables -t nat -F
#exit
# Cria regra default para Chains
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD
ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING
ACCEPT
iptables -t nat -P OUTPUT ACCEPT
# Seta Kernel Flags
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" >
/proc/sys/net/ipv4/tcp_syncookies
echo "1" >
/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "1" >
/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
for f in
/proc/sys/net/ipv4/conf/*/rp_filter;do
echo 1 > $f
done
for f in
/proc/sys/net/ipv4/conf/*/accept_redirects;do
echo 0 > $f
done
for f
in /proc/sys/net/ipv4/conf/*/send_redirects;do
echo 0 >$f
done
for f
in /proc/sys/net/ipv4/conf/*/accept_source_route;do
echo 0 >
$f
done
for f in /proc/sys/net/ipv4/conf/*/log_martians;do
echo 0 >
$f
done
###IPS liberados
iptables -A FORWARD -s
192.168.1.20/255.255.255.255 -d ${ANY} -j ACCEPT
iptables -A
FORWARD -s 192.168.1.22/255.255.255.255 -d ${ANY} -j
ACCEPT
iptables -A FORWARD -s 192.168.1.32/255.255.255.255
-d ${ANY} -j ACCEPT
###IPS liberados (parcialmente) ( regras que nao
funcionam no XP)
iptables -A FORWARD -s ${LANNET} -d
200.154.55.0/24 -j ACCEPT
###bloqueia todo o resto
iptables -A FORWARD -s
${LANNET} -d ${ANY} -j REJECT
# Libera Rede Interna / dialin
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i ${INT_INT} -s
${LANNET} -j ACCEPT
iptables -A INPUT -i ${EXT_INT} -s ${LANNET} -j
ACCEPT
# Ativando reenvio de pacotes
iptables -t nat -A POSTROUTING -o
${EXT_INT} -j SNAT --to ${EXT_IP}
# LIBERA PORTAS
# PROXY (3128-tcp)
iptables -A INPUT -i ${EXT_INT} -p tcp --dport 3128 -m
state --state NEW -j LOG --log-prefix "Permite PROXY:"
for a in $(echo
$SUPORTE)
do
iptables -A INPUT -i ${EXT_INT} -p tcp -s $a --dport 3128 -m
state --state NEW,ESTABLISHED -j ACCEPT
done
iptables -t nat -A PREROUTING -p tcp --dport 1723 -j DNAT --to
192.168.1.230
iptables -t nat -A PREROUTING -p gre -j DNAT --to
192.168.1.230
iptables -A INPUT -p tcp -d ${EXT_IP} --dport 1723 -j
ACCEPT
iptables -A INPUT -p gre -j ACCEPT
# SMTP (25-tcp)
iptables -A INPUT -i ${EXT_INT} -p tcp --dport 25 -m state --state
NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i ${EXT_INT} -p tcp --sport 25
-m state --state NEW,ESTABLISHED -j ACCEPT
# WWW (80-tcp)
iptables -A INPUT -i ${EXT_INT} -p tcp --dport 80 -m state
--state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i ${EXT_INT} -p tcp
--sport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
# Portas de
Saida
iptables -A INPUT -i ${EXT_INT} -p tcp --sport 8080 --dport ${APORTAS}
-m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i ${EXT_INT} -p
tcp --sport 443 --dport ${APORTAS} -m state --state NEW,ESTABLISHED -j
ACCEPT
# Proibe portas restantes
iptables -A INPUT -i ${EXT_INT} -j
DROP
