Perguntas & Respostas

Duvida no Script de Firewall

Bem minha duvida e a seguinte, fiz um scrip aki em casa com Debian 4 mas o problema e o seguinte, eu quero que para sair da Interna para Externa; mas tenha que ter uma regra liberando, entao eu fiz o seguinte neguei no final do Firewall tudo que sai da Interna para Externa mas mesmo assim tudo que sai da Interna para Externa esta Liberado, mesmo que eu negue a saida; Por Exenplo; Esta comentado a linha de saida do WTS ou 3389 mas ainda sim sai sem problemas.
ALGUEM PODE ME AJUDAR,

#!/bin/bash
# REGRAS DE FIREWALL PROXY ;SQUID ;APACHE ;SARG ;DHCP3-SERVER ;BIND ;ARGUS
#########################################################################
# #
# Função do Script: FIREWALL #
# Versão: 1.0 #
# #
# #
# #
# #
#########################################################################
#
EXTERNAL=eth0
INTERNAL=eth1
IP=10.1.0.0/24
#FTP=10.1.0.6
#
flush_rules()
{
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -Z
}
#
add_rules()
{
######################Habilitando o roteamento e bloqueando alguns de pacotes
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
#
######################CARREGANDO MODULOS
/sbin/modprobe iptable_nat
/sbin/modprobe ip_tables
/sbin/modprobe ipt_state
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ipt_multiport
/sbin/modprobe ip_nat_ftp
/sbin/modprobe iptable_mangle
/sbin/modprobe ipt_tos
/sbin/modprobe ipt_limit
#
######################Liberacao do Loopback
iptables -A INPUT -i lo -j ACCEPT
#
######################Allow incoming port 3128 (squid) connections on LAN interface
iptables -A INPUT -i $INTERNAL -p tcp --destination-port 3128 -m state
--state NEW -j ACCEPT
#
#####################Allow rede interna Apache
iptables -A INPUT -i $INTERNAL -p tcp --destination-port 80 -m state
--state NEW -j ACCEPT
#
#####################Allow rede interna Argus-Server
iptables -A INPUT -i $INTERNAL -p tcp --destination-port 561 -m state
--state NEW -j ACCEPT
#
#####################Allow rede interna Dhcp3-server
iptables -A INPUT -i $INTERNAL -p tcp --destination-port 67 -m state
--state NEW -j ACCEPT
#
#####################Allow rede interna Bind-server
iptables -A INPUT -i $INTERNAL -p tcp --destination-port 53 -m state
--state NEW -j ACCEPT
#
iptables -A INPUT -i $INTERNAL -p udp --destination-port 53 -m state
--state NEW -j ACCEPT
#
######################REDIRECIONANDO PROXY TRANSPARENTE
iptables -t nat -A PREROUTING -i $INTERNAL -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A POSTROUTING -o $EXTERNAL -j MASQUERADE
#
######################Mascaramento
iptables -t nat -A POSTROUTING -s $IP -d 0/0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s $IP -o $EXTERNAL -j MASQUERADE
#
######################LIBERANDO SSH
iptables -A INPUT -i $INTERNAL -p tcp --dport 22 -j ACCEPT
#iptables -A INPUT -s 200.195.1.114 -p tcp --dport 22 -j ACCEPT
#iptables -A INPUT -i $EXTERNAL -p tcp --dport 22 -j ACCEPT
#
######################OUTLOOK
iptables -I POSTROUTING -j MASQUERADE -t nat -s $IP -p tcp --dport 25 -o $EXTERNAL
iptables -I POSTROUTING -j MASQUERADE -t nat -s $IP -p tcp --dport 110 -o $EXTERNAL
#
#####################DNS
#iptables -I POSTROUTING -j MASQUERADE -t nat -s $IP -p udp --dport 53 -o $EXTERNAL
#iptables -I POSTROUTING -j MASQUERADE -t nat -s $IP -p tcp --dport 53 -o $EXTERNAL
#
######################Fecha fecha conexao squid por interface de rede
iptables -A INPUT -i $EXTERNAL -p tcp --dport 3128 -j DROP
#
######################Allow incoming LAN interface
iptables -A INPUT -i $INTERNAL -p udp --destination-port 4500 -m state
--state NEW -j ACCEPT
#
######################Allow incoming LAN interface
iptables -A INPUT -i $INTERNAL -p udp --destination-port 500 -m state
--state NEW -j ACCEPT
#
######################PORTAS LIBERADAS
#FTP
iptables -I POSTROUTING -j MASQUERADE -t nat -s $IP -p tcp --dport 21 -o $EXTERNAL
#iptables -I POSTROUTING -j MASQUERADE -t nat -s $IP -p udp --dport 20 -o $EXTERNAL
#
#HTTPS
iptables -I POSTROUTING -j MASQUERADE -t nat -s $IP -p tcp --dport 443 -o $EXTERNAL
#
#SSH
iptables -I POSTROUTING -j MASQUERADE -t nat -s $IP -p tcp --dport 22 -o $EXTERNAL
#
#VNC
#iptables -I POSTROUTING -j MASQUERADE -t nat -s $IP -p tcp --dport 5900 -o $EXTERNAL
#
#Terminal Server
#iptables -I POSTROUTING -j MASQUERADE -t nat -s $IP -p tcp --dport 3389 -o $EXTERNAL
#
######################REDIRECIONAMENTOS
#
#FTP
#iptables -t nat -A PREROUTING -i $EXTERNAL -p tcp --dport 21 -j DNAT --to $FTP
#IIS
#iptables -t nat -A PREROUTING -i $EXTERNAL -p tcp --dport 80 -j DNAT --to $IIS
#TS
#iptables -t nat -A PREROUTING -i $EXTERNAL -p tcp --dport 3389 -j DNAT --to $TS
#FTP
#iptables -t nat -A PREROUTING -i $EXTERNAL -p tcp --dport 21 -j DNAT --to $FTP
#
######################Bloqueando tracertroute
iptables -A INPUT -p udp -s 0/0 -i $EXTERNAL --dport 33435:33525 -j DROP
#
#Precaucao contra BUG's na traducao de enderecos de rede (NAT)
iptables -A OUTPUT -m state -p icmp --state INVALID -j DROP
#
#Bloqueia Pings vindo de fora
iptables -A INPUT -i $EXTERNAL -m state --state NEW -p icmp -j DROP
#
######################Protege contra pacotes danificados
#Portscanners, Ping of Death, ataques DoS, Syb-flood e Etc
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD --protocol tcp --tcp-flags ALL SYN,ACK -j DROP
iptables -A FORWARD -m unclean -j DROP
#
#Allow all connections OUT and only related ones IN
iptables -A FORWARD -i $EXTERNAL -o $INTERNAL -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $INTERNAL -o $EXTERNAL -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# LOG all other traffic
#iptables -A INPUT -i $EXTERNAL -p tcp -j LOG
#iptables -A INPUT -i $EXTERNAL -p udp -j LOG
iptables -A INPUT -i $INTERNAL -p tcp -j LOG
#
#Fecha portas
iptables -A INPUT -i $EXTERNAL -m state --state ! ESTABLISHED,RELATED -j DROP
iptables -A INPUT -i $INTERNAL -m state --state ! ESTABLISHED,RELATED -j DROP
#
#Ponto Chave do firewall! Se nao entrar em nenhuma regra acima rejeita tudo!
iptables -A INPUT -i $EXTERNAL -p tcp --syn -j DROP
iptables -A INPUT -i $INTERNAL -p tcp --syn -j DROP
#
# Mesmo assim fechar todas as portas abaixo de 32000
iptables -A INPUT -i $EXTERNAL -p tcp --dport :32000 -j DROP
}
case $1 in
start)
echo -n Starting Firewall...
add_rules
echo "Done"
;;
stop)
echo -n Stoping Firewall...
flush_rules
echo "Done"
;;
restart)
echo -n Restarting Firewall...
flush_rules
add_rules
echo "Done"
;;
status)
echo "============================ Firewall rules:"
iptables -L -n
echo "============================ Masquerade tables:"
iptables -t nat -L -n
echo "============================ Mangle table:"
iptables -t mangle -L -n
;;
*)
echo Usar: "$0 { status | start | stop | restart }"
;;
esac