maninhx
(usa Slackware)
Enviado em 19/06/2009 - 11:54h
#Limpar Regras
iptables -F #Limpa todas a regras da tabela filter
iptables -X #Deleta todas as cadeias da tabela filter
iptables -Z #Zera o contador de tabela filter
iptables -t nat -F #Limpa todas as regras da tabela NAT
iptables -t nat -X #Deleta todas as cadeias da tabela NAT
iptables -t nat -Z #Zera os contadores da tabela NAT
iptables -t mangle -F
iptables -t mangle -X
# Adicionando modulos do iptables (OBS: remova o serviço de iptables e ipchains na inicialização)
modprobe ip_tables
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe iptable_nat
modprobe ip_nat_ftp
WAN=eth0
LAN=eth1
RINTERNA=192.168.5.0/24
#ENDREMOTO="192.168.1.199"
#UP_PORTS=1024:
#D_PORTS=:1024
##### Protecao contra IP Spoofing #####
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 >$i
done
##### Ativamos o redirecionamento de pacotes (requerido para NAT) #####
echo "1" >/proc/sys/net/ipv4/ip_forward
##liberar OUTPUT e FORWARD
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
##### Chain INPUT #####
#liberar SSH na LAN
iptables -A INPUT -i $LAN -p tcp --dport 22 -j ACCEPT
# Aceita todo o trafego vindo do loopback e indo pro loopback
iptables -A INPUT -i lo -j ACCEPT
# Todo trafego vindo da rede interna tambem aceito
iptables -A INPUT -s $RINTERNA -i $WAN -j ACCEPT
# Liberacao de PING (ICMP) na Interface Externa com certa limitacao
iptables -A INPUT -i $LAN -p icmp -m limit --limit 2/s -j ACCEPT
#liberar ping para internet
iptables -A FORWARD -p icmp --icmp-type ping -s $RINTERNA -i $LAN -d 0/0 -o $WAN -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type ping -s 0/0 -i $WAN -d $RINTERNA -o $LAN -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 0 -s $RINTERNA -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 8 -s $RINTERNA -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 0 -i $WAN -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 8 -i $WAN -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type 8 -i $WAN -j ACCEPT
# Bloqueia qualquer tentativa de nova conexao de fora para esta maquina
iptables -A INPUT -i $LAN -m state --state ! ESTABLISHED,RELATED -j LOG --log-level 6 --log-prefix "FIREWALL: IN "
iptables -A INPUT -i $LAN -m state --state ! ESTABLISHED,RELATED -j DROP
# Qualquer outro tipo de trafego aceito
iptables -A INPUT -i $LAN -j ACCEPT
#Bloqueio de ataque SSH de forca bruta
iptables -N SSH-BRUT-FORCE
iptables -A INPUT -i $WAN -p tcp --dport 22 -j SSH-BRUT-FORCE
iptables -A SSH-BRUT-FORCE -m limit --limit 2/s --limit-burst 4 -j RETURN
iptables -A SSH-BRUT-FORCE -j DROP
#Bloqueio Anti-Spoofing
iptables -A INPUT -s 192.168.1.0/8 -i $WAN -j DROP
#Liberar POP3
iptables -A INPUT -p tcp --sport 1024: --dport 25 -i $WAN -j ACCEPT
#Bloqueio de Scanners ocultos (Shealt Scan)
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK, FIN, -m limit --limit 1/s -j ACCEPT
#######################################################
# Tabela nat #
#######################################################
##### Chain PREROUTING #####
# Redirecionando Porta 80 para SQUID (somente para proxy transparente)
iptables -t nat -A PREROUTING -p tcp -i $WAN --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -p udp -i $WAN --dport 80 -j REDIRECT --to-port 3128
# Masquerade
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
#Bloquear MSN
iptables -A FORWARD -s $RINTERNA -p tcp --dport 1863 -j REJECT
iptables -A FORWARD -s $RINTERNA -d loginnet.passport.com -j REJECT
#Protecao contra Worms
iptables -A FORWARD -p tcp --dport 135 -i $WAN -j DROP
#Protecao contra Syn-Flood
iptables -A FORWARD -p tcp --syn -m limit --limit 2/s -j ACCEPT
#Protecao contra ping da morte
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
#Fecha o resto
iptables -A INPUT -p tcp --syn -j DROP
iptables -A INPUT -j DROP
#iptables -t filter -P INPUT -j DROP
#Bloqueia pacotes danificados (atques DOS?)
#iptables -A FORWARD -m unclean -j DROP
