Firewall bloqueando internet [RESOLVIDO]

xlinux
(usa Ubuntu)

Enviado em 01/10/2013 - 20:36h

boa noite a todos,


To com um probleminha aqui fiz algumas mudanças no meu firewall, não está compartilhando a net não sei onde estou errando....

vejam abaixo o script...

#!/bin/sh
# Start/stop/restart the iptables.

# Start firewall:
firewall_start() {
echo "Starting iptables"

## CARREGAR MODULOS DE FIREWALL ##

modprobe ip_nat_ftp
modprobe ip_tables

## LIMPANDO TABELAS ##

/sbin/iptables -t filter -F INPUT
/sbin/iptables -t filter -F FORWARD
/sbin/iptables -t filter -F OUTPUT

/sbin/iptables -t nat -F PREROUTING
/sbin/iptables -t nat -F POSTROUTING
/sbin/iptables -t nat -F OUTPUT

/sbin/iptables -t mangle -F PREROUTING
/sbin/iptables -t mangle -F INPUT
/sbin/iptables -t mangle -F FORWARD
/sbin/iptables -t mangle -F OUTPUT
/sbin/iptables -t mangle -F POSTROUTING


## DEFININDO POLITICA PADRÃO ##

/sbin/iptables -t filter -P INPUT DROP
/sbin/iptables -t filter -P FORWARD DROP
/sbin/iptables -t filter -P OUTPUT ACCEPT

/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT

/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT

# REGRAS ##

IPTABLES="/sbin/iptables"

IFNET="eth0"
IFLAN="eth1"
#IFVPN="tun0"

## LIBERA LOOPBACK ##

$IPTABLES -t filter -A INPUT -j ACCEPT -i lo

## LIBERA RETORNO DE PACOTES ##

$IPTABLES -t filter -A INPUT -j ACCEPT -i $IFNET -m state --state ESTABLISHED,RELATED
$IPTABLES -t filter -A INPUT -j ACCEPT -i $IFLAN -m state --state ESTABLISHED,RELATED
$IPTABLES -t filter -A FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED

## LIBERA PARA LAN O ENVIO DE PING PARA WAN ##

$IPTABLES -t filter -A FORWARD -j ACCEPT -i $IFLAN -o $IFNET -p icmp

## LIBERA ACESSO AO DNS SERVER PARA LAN##

$IPTABLES -t filter -A INPUT -j ACCEPT -i $IFLAN -s 192.168.1.0/24 -d 8.8.8.8 -p udp --dport 53
$IPTABLES -t filter -A INPUT -j ACCEPT -i $IFLAN -s 192.168.1.0/24 -d 8.8.4.4 -p udp --dport 53



$IPTABLES -t nat -A PREROUTING -p tcp -i eth1 -p tcp --dport 80 -j REDIRECT --to port 3128
$IPTABLES -t nat -A POSTROUTING -o eth1 -j MASQUERADE



}
# Stop firewall:
firewall_stop() {
/sbin/iptables -t filter -F INPUT
/sbin/iptables -t filter -F FORWARD
/sbin/iptables -t filter -F OUTPUT
/sbin/iptables -t nat -F PREROUTING
/sbin/iptables -t nat -F POSTROUTING
/sbin/iptables -t nat -F OUTPUT

/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT

/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
}

# Restart firewall:
firewall_restart() {
firewall_stop
sleep 1
firewall_start
}

case "$1" in
'start')
firewall_start
;;
'stop')
firewall_stop
;;
'restart')
firewall_restart
;;
*)
echo "usage $0 start|stop|restart"
esac


obrigado

andrecanhadas
(usa Debian)

Enviado em 01/10/2013 - 20:50h

Vc definiu a politica padrão como forward DROP então deve liberar o forward para as portas que precisa acessar como 80,443,110,587 etc...

xlinux
(usa Ubuntu)

Enviado em 01/10/2013 - 20:59h

Ficaria assim?

#LIBERAÇÃO DE PORTAS##

$IPTABLES -A FORWARD -j ACCEPT -i $IFNET -o $IFLAN -s 0/0 -d 192.168.1.0 -p tcp --dport 8080
$IPTABLES -A FORWARD -j ACCEPT -i $IFNET -o $IFLAN -s 0/0 -d 192.168.1.0 -p tcp --dport 443
$IPTABLES -A FORWARD -j ACCEPT -i $IFNET -o $IFLAN -s 0/0 -d 192.168.1.0 -p tcp --dport 110
$IPTABLES -A FORWARD -j ACCEPT -i $IFNET -o $IFLAN -s 0/0 -d 192.168.1.0 -p tcp --dport 587



att

andrecanhadas
(usa Debian)

Enviado em 01/10/2013 - 21:08h

Apenas assim:

# Libera o acesso a clientes de email, pop e smtp

iptables -A FORWARD -p tcp -m multiport --dports 25,110,143,993,995 -j ACCEPT



# Libera o acesso a http https FTP

iptables -A FORWARD -p tcp -m multiport --dports 21,80,443,8080 -j ACCEPT

 

xlinux
(usa Ubuntu)

Enviado em 02/10/2013 - 08:29h

beleza brow funfou na boa....


Agora to com outro pepino aqui o firewal+squid transparent não bloqueia os sites que estão na regra pra bloqueio de jeito nenhum...


Alguém poderia dar uma força????


Obrigado