IPTABLES
1. IPTABLES
memeve
(usa Ubuntu)
Enviado em 22/11/2018 - 07:11h
Bom dia Pessoal,Meu firewall está bloqueando acesso OUTPUT (saida) pela TS (Porta 3389), alguém pode me ajudar?
function start () {
modprobe iptable_nat
modprobe ip_nat_pptp
iptables -F
iptables -t nat -F
echo 1 > /proc/sys/net/ipv4/ip_forward
# echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
# Regras tabela NAT
iptables -t nat -A POSTROUTING -o $iface_Cwnet -j MASQUERADE
iptables -t nat -A POSTROUTING -o $iface_Net -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp --dport 3335 -j DNAT --to-destination 'Remoto 1'
iptables -t nat -A PREROUTING -p tcp --dport 3336 -j DNAT --to-destination 'Remoto 2'
iptables -t nat -A PREROUTING -i $iface_Cwnet -p tcp --dport 80 -j DNAT --to-destination 'Remoto 2:80'
iptables -t nat -A PREROUTING -i $iface_Net -p tcp --dport 80 -j DNAT --to-destination 'Remoto 2':80
iptables -t nat -A PREROUTING -p tcp --dport 4520 -j DNAT --to-destination 'Remoto 2':4520
iptables -t nat -A PREROUTING -p tcp --dport 1723 -j DNAT --to-destination 'Remoto 2':1723
# Regras tabela Filter
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Chain INPUT
iptables -A INPUT -s $rede_local -p tcp -m multiport --dports 3128 -j ACCEPT
iptables -A INPUT -s $ip_admin -m multiport -p tcp --dports 80,443,1890,1895,3389 -j ACCEPT
iptables -A INPUT -s 127.0.0.1 -m multiport -p tcp --dports 3350,5910 -j ACCEPT
iptables -A INPUT -s 127.0.0.1 -p udp --dport 68 -j ACCEPT
# iptables -A INPUT -s $ip_server -m multiport -p tcp --dports 80,1890,1895 -j ACCEPT
# Chain FORWARD
iptables -A FORWARD -s $rede_local -p icmp -j ACCEPT
iptables -A FORWARD -s $rede_local -p udp -m multiport --dports 53,123 -j ACCEPT
iptables -A FORWARD -d $ip_de_acesso_remoto -p tcp -m multiport --dports 80,1723,3389,4520 -j ACCEPT
iptables -A FORWARD -s $rede_local -p tcp -m multiport --dports $ports1 -j ACCEPT
iptables -A FORWARD -s $rede_local -p tcp -m multiport --dports $ports2 -j ACCEPT
iptables -A FORWARD -s $rede_local -p tcp -m multiport --dports $ports3 -j ACCEPT
iptables -A FORWARD -s $rede_local -p tcp -m multiport --dports $mvPorts1 -j ACCEPT
iptables -A FORWARD -s $rede_local -p tcp -m multiport --dports $mvPorts2 -j ACCEPT
iptables -A FORWARD -s $ip_admin -p tcp -m multiport --dports 80,443,444,1890,1895 -j ACCEPT
iptables -A FORWARD -s $ip_vpn_tomo -p tcp -m multiport --dports 80,123 -j ACCEPT
iptables -A FORWARD -s $ip_vpn_tomo -p udp -m multiport --dports 4500,500 -j ACCEPT
iptables -A FORWARD -s $ip_painel -p udp --dport 5000 -j ACCEPT
iptables -A FORWARD -s $ip_reunioes -p tcp -m multiport --dports 80,443 -j ACCEPT
# Chain OUTPUT
iptables -A OUTPUT -p udp -m multiport --dports 53,67,68,123 -j ACCEPT
iptables -A OUTPUT -m multiport -p tcp --dports 22,80,443,444,1890,2083,2096,3350,3389,5910,8010,8020,8080,8082,8086,8088 -j ACCEPT
iptables -A OUTPUT -m multiport -p tcp --dports 38453 -j ACCEPT
iptables -A OUTPUT -m multiport -p tcp --dports 1885,8245 -j ACCEPT
iptables -A OUTPUT -m multiport -p tcp --dports $mvPorts1 -j ACCEPT
iptables -A OUTPUT -m multiport -p tcp --dports $mvPorts2 -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
}
function stop () {
modprobe iptable_nat
modprobe ip_nat_pptp
iptables -F
iptables -t nat -F
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o $iface_Cwnet -j MASQUERADE
iptables -t nat -A POSTROUTING -o $iface_Net -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp --dport 3335 -j DNAT --to-destination 'Remoto 1':3389
iptables -t nat -A PREROUTING -p tcp --dport 3336 -j DNAT --to-destination 'Remoto 2':3389
iptables -t nat -A PREROUTING -i $iface_Cwnet -p tcp --dport 80 -j DNAT --to-destination 'Remoto 2':80
iptables -t nat -A PREROUTING -i $iface_Net -p tcp --dport 80 -j DNAT --to-destination 'Remoto 2':80
iptables -t nat -A PREROUTING -p tcp --dport 4520 -j DNAT --to-destination 'Remoto 2':4520
iptables -t nat -A PREROUTING -p tcp --dport 1723 -j DNAT --to-destination 'Remoto 2':1723
}
case $1 in
start)
start
;;
stop)
stop
;;
Ignorem onde está escrito 'Remoto 1,2' no script está o endereço IP do server.