Compartilhando a Internet com Iptables [Shell Script]

Compartilhando a Internet com Iptables

Publicado por Rafael Augusto Cucharo 14/10/2004

[ Hits: 8.293 ]

Download script

0 0

Denuncie Favoritos Indicar

Após muito tempo de estudo,
livros, tutoriais, e horas de
sono, achei uma maneira eficaz e
simples de compartilhar a net com
o tables...
Coloque este script em seu
rc.local para ser iniciado junto
com o sistema e faça as
comificações necessárias...
Valew....

Esconder código-fonte

REDE=10.0.0.0/24

####### MODULOS DO KERNEL ######
/sbin/modprobe iptable_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_tables
################################

### ZERANDO AS REGRAS ###
/usr/sbin/iptables -F OUTPUT
/usr/sbin/iptables -F INPUT
/usr/sbin/iptables -F FORWARD
/usr/sbin/iptables -t nat --flush
#########################

######## REGRAS DE POLICIAMENTO ########
#/usr/sbin/iptables -P INPUT ACCEPT
#/usr/sbin/iptables -P FORWARD ACCEPT
#/usr/sbin/iptables -P OUTPUT ACCEPT
########################################

######## LOOP BACK #######
/usr/sbin/iptables -A INPUT -i lo -j ACCEPT
/usr/sbin/iptables -A OUTPUT -o lo -j ACCEPT
/usr/sbin/iptables -A OUTPUT -s 127.0.0.1 -j ACCEPT
##########################

/usr/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/usr/sbin/iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
/usr/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

########## HABILITAR NO KERNEL ############
echo 1 > /proc/sys/net/ipv4/ip_forward
###########################################

/usr/sbin/iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE
/usr/sbin/iptables -A FORWARD -o eth1 -m state --state NEW,INVALID -j DROP
/usr/sbin/iptables -A FORWARD -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
/usr/sbin/iptables -A FORWARD -i eth1 -s $REDE -j ACCEPT
#iptables -A FORWARD -j DROP
#iptables -A INPUT -j DROP

#echo "Funcionar o OUTLOOK"
/usr/sbin/iptables -A FORWARD -p udp -s $REDE -d 0/0 --dport 53 -j ACCEPT
/usr/sbin/iptables -A FORWARD -p udp -s 0/0 --sport 53 -d $REDE -j ACCEPT
#echo "Feito!"
#echo "Liberando o acesso ao SMTP e POP dos clientes de email..."
/usr/sbin/iptables -A FORWARD -p tcp --dport 25 -j ACCEPT
/usr/sbin/iptables -A FORWARD -p tcp --dport 110 -j ACCEPT
/usr/sbin/iptables -A FORWARD -p tcp --sport 25 -j ACCEPT
/usr/sbin/iptables -A FORWARD -p tcp --sport 110 -j ACCEPT
#echo "Feito!"

/usr/sbin/iptables -A FORWARD -p tcp -s 0/0 --dport 22 -j ACCEPT
/usr/sbin/iptables -A FORWARD -p tcp -s 0/0 --dport 10000 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp -s 0/0 --dport 10000 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp -s 0/0 --dport 22 -j ACCEPT

############## PROXY TRANSPARENTE #############
#iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT
#--to-ports 3128
###############################################

Scripts recomendados

Backup via rede

Relatório minuto a minuto de todas as conexões do servidor

TCPDump do Dia

Firewall completo com iptables

Administração de Usuários

Comentários

[1] Comentário enviado por isaacson em 01/05/2005 - 18:12h

se voce estiver usandor um servidor de radio ele tem duas placas de rede então o placa eth0 ele é o ip valido e a outra placa eth1 pois o prox transparente não funciona desta forma:
############## PROXY TRANSPARENTE #############
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT
--to-ports 3128

e sim desta

############## PROXY TRANSPARENTE #############
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT
--to-ports 3128

0 0