Firewall/Proxy (solução completa)

# Variáveis
LAN1="eth0"
WAN1="eth1"
GW="200.x.x.1"
IP_EXT="200.x.x.7"
REDE="10.0.0.0/32"
P_PX="28021" # Porta do Proxy
IP_DIRETOR1="10.0.0.25"
IP_DIRETOR2="10.0.0.27"

# Flush nas Chains
iptables -F
iptables -t nat -F
iptables -X
iptables -Z

# Política padrão
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT


# Habilita o roteamento
echo "1" > /proc/sys/net/ipv4/ip_forward

# Regras de entrada
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 110 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 563 -j ACCEPT
iptables -A INPUT -i $LAN1 -p tcp --dport $P_PX -j ACCEPT
iptables -A INPUT -i $WAN1 -p tcp --dport $P_PX -j DROP

# Regras de repasse
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -d $REDE -i $WAN1 -o $LAN1 -j ACCEPT
iptables -A FORWARD -s $REDE -i $LAN1 -o $WAN1 -j ACCEPT
iptables -A FORWARD -d $GW -s $REDE -j ACCEPT
iptables -A FORWARD -i $LAN1 -d smtp.terra.com.br -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -i $LAN1 -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -i $LAN1 -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -i $LAN1 -d pop.terra.com.br -p tcp --dport 110 -j ACCEPT
iptables -A FORWARD -i $LAN1 -p tcp --dport $P_PX -j ACCEPT
iptables -A FORWARD -s $IP_DIRETOR1 -d 0.0.0.0/0 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s $IP_DIRETOR2 -d 0.0.0.0/0 -p tcp --dport 80 -j ACCEPT

# Barro qualquer comunicação com a porta 80
iptables -A FORWARD -i $LAN1 -p tcp --dport 80 -j DROP

# Tudo que for proveniente da rede local e for para
# internet tem seu endereço alterado
iptables -t nat -A POSTROUTING -d 0.0.0.0/0 -s $REDE -j SNAT --to $IP_EXT

# Regras de segurança

# Contra Syn-flood
iptables -A FORWARD -p tcp -m limit --limit 1/s -j ACCEPT

# Contra Ping da Morte
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

# Contra nmap
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

# iptables -A FORWARD -p tcp -tcp-flags SYN,ACK -j DROP

# Logando os pacotes
# Logando pacotes bloqueados vindo da internet
iptables -A INPUT -p tcp -i $LAN1 -j LOG --log-level DEBUG --log-prefix "Pacote tcp : "
iptables -A INPUT -p icmp -i $LAN1 -j LOG --log-level DEBUG --log-prefix "Pacote icmp : "

iptables -A FORWARD -m unclean -j DROP