rubens_web
(usa Debian)
Enviado em 20/03/2012 - 14:49h
jocajuni escreveu:
iptables -A FOWARD -d 192.168.1.61 -p tcp --dport 80 -j ACCEPT
iptables -A FOWARD -s 192.168.1.61 -p tcp --sport 80 -j ACCEPT
iptables -A PREROUTING -t nat -d $ip_backup -p tcp --dport 80 -j DNAT --to 192.168.1.61
Iptables -A POSTROUTING -t nat -s 192.168.1.61 -p tcp --sport 80 -j SNAT --to $ip_backup
echo 1 > /proc/sys/net/ipv4/ip_foward
Aonde $ip_backup vc coloca o seu ip
[]s
Joca
Não deu certo amigo.
Segue o meu firewall.sh
#! /bin/sh
# chkconfig: 235 99 10
# description: Start or stop the Webmin server
#
### BEGIN INIT INFO
# Provides: webmin
# Required-Start: $network $syslog
# Required-Stop: $network
# Default-Start: 2 3 5
# Default-Stop: 0 1 6
# Description: Start or stop the Webmin server
### END INIT INFO
#! /bin/bash
#Variaveis
ifaceExt="eth0"; #acesso internet (offboard)
ifaceInt="eth1"; #acesso intranet (rede interna) (onboard)
LAN="192.168.1.0/24"; #rede local
WAN="XXX.XXX.XXX.XX"; #ip fixo radio
#Carrega modulos
/sbin/modprobe ip_nat
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_queue
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_nat
/sbin/modprobe iptable_mangle
/sbin/modprobe ipt_state
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_multiport
/sbin/modprobe ipt_mac
/sbin/modprobe ipt_string
/sbin/modprobe ipt_MASQUERADE
start(){
echo "Firewall iniciado ...................... [OK]";
#limpa as regras
iptables -F
iptables -X
iptables -Z
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z
#Politica padrao INPUT=DROP | OUTUPT=ACCEPT | FORWARD=DROP
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
#Bloquei ping externo para o servidor (ICMP)
iptables -A INPUT -i $ifaceExt -p icmp --icmp-type 8 -j DROP
#LIBERANDO PORTAS
#--------------------------------------------------------------------------------------------------------
#Libera porta ssh
iptables -A INPUT -p tcp --dport 22 -i $ifaceInt -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -i $ifaceExt -j ACCEPT
#Libera porta (HTTP)
iptables -A INPUT -s $LAN -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -s $LAN -p udp --dport 80 -j ACCEPT
#Libera porta (DNS)
iptables -A INPUT -s $LAN -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s $LAN -p udp --dport 53 -j ACCEPT
#Libera porta (SQUID)
iptables -A INPUT -s $LAN -p tcp --dport 3128 -j ACCEPT
#Libera portas (CAMERAS)
iptables -A FORWARD -p tcp --destination-port 3130 -j ACCEPT
iptables -A FORWARD -p tcp --destination-port 6036 -j ACCEPT
iptables -A FORWARD -p tcp --destination-port 6061 -j ACCEPT
iptables -A FORWARD -p tcp --destination-port 4551 -j ACCEPT
iptables -A FORWARD -p tcp --destination-port 5551 -j ACCEPT
#Libera portas (SAMBA)
iptables -A INPUT -s $LAN -p tcp --dport 139 -j ACCEPT
iptables -A INPUT -s $LAN -p udp --dport 139 -j ACCEPT
#Libera portas para acesso ao servidor (APACHE)=========================== OLHE AQUI - OLHE AQUI
iptables -A FORWARD -d 192.168.1.61 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s 192.168.1.61 -p tcp --sport 80 -j ACCEPT
iptables -A PREROUTING -t nat -d $WAN -p tcp --dport 80 -j DNAT --to 192.168.1.61
iptables -A POSTROUTING -t nat -s 192.168.1.61 -p tcp --sport 80 -j SNAT --to $WAN
#Libera IP (CLIPASNET)
#=====Estas linhas devem estar antes do redirecionamento para o squid (3128)
iptables -t nat -A PREROUTING -i $ifaceInt -p tcp --dport 80 -d 200.180.72.107 -j RETURN
iptables -t nat -A PREROUTING -i $ifaceInt -p tcp --dport 80 -d 200.247.221.35 -j RETURN
#--------------------------------------------------------------------------------------------------------
#Permite pacotes transmitidos atraves da interface de loopback (localhost)
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i $ifaceInt -j ACCEPT
iptables -A INPUT -i $ifaceExt -j ACCEPT
#Compartilha a conexao disponivel na interface de internet
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s $LAN -o $ifaceExt -j MASQUERADE
echo "Compartilhamento de rede ativo";
#Permitindo e filtrando conexao estabelecidas
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -s $LAN -o $ifaceExt -j ACCEPT
#Direciona trafego para squid
iptables -t nat -A PREROUTING -i $ifaceInt -p tcp --dport 80 -j REDIRECT --to-port 3128
echo "Trafego direcionado para SQUID";
#LIBERA ACESSO AS CAMERAS
#-----------------------------------------------------------------------------------------------
#DVR (Stand Alone)
iptables -t nat -A PREROUTING -p tcp -d $WAN --dport 3130 -j DNAT --to-destination 192.168.1.99
iptables -t nat -A PREROUTING -p tcp -d $WAN --dport 6036 -j DNAT --to-destination 192.168.1.99
#Servidor (GeoVision)
iptables -t nat -A PREROUTING -p tcp -d $WAN --dport 6061 -j DNAT --to-destination 192.168.1.66
iptables -t nat -A PREROUTING -p tcp -d $WAN --dport 4551 -j DNAT --to-destination 192.168.1.66
iptables -t nat -A PREROUTING -p tcp -d $WAN --dport 5551 -j DNAT --to-destination 192.168.1.66
#-----------------------------------------------------------------------------------------------
echo "Firewall ativado! ...................... [OK]";
}
stop(){
#limpa as regras
iptables -F
iptables -X
iptables -Z
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z
#Politica padrao
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
#Compartilha a conexao disponivel na interface de internet
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s $LAN -o $ifaceExt -j MASQUERADE
echo "Compartilhamento de rede ativo";
#Permitindo e filtrando conexao estabelecidas
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A FORWARD -s $LAN -o $ifaceExt -j ACCEPT
#Proxy squid
iptables -t nat -A PREROUTING -i $ifaceInt -p tcp --dport 80 -j REDIRECT --to-port 3128
echo "Firewall desativado! ................... [OK]";
}
case "$1" in
"start") start ;;
"stop") stop ;;
"reload") stop; start ;;
*)
echo "Use parametros start|stop|reload" ;;
esac
