Liberar Tudo Para um Determinado IP [RESOLVIDO]

asparion
(usa Ubuntu)

Enviado em 30/03/2015 - 20:12h

# CONFIGURACAO INICIAL DO SQUID

http_port 3128 transparent

visible_hostname srv-firewall

cache_mgr suporte.asparion@gmail.com

error_directory /usr/share/squid/errors/pt-br



# CONFIGURACOES DE CACHE

hierarchy_stoplist cgi-bin ?

cache_mem 32 MB

maximum_object_size_in_memory 64 KB

maximum_object_size 100 MB

cache_dir ufs /var/spool/squid 2048 16 256



refresh_pattern ^ftp:                  360     20%     10080

refresh_pattern -i (/cgi-bin/|\?)      0       0%      0

refresh_pattern .                      0       20%     4320



access_log /var/log/squid/access.log



# ACLs PARA A REDE LOCAL

acl localhost src 127.0.0.1/32

acl localnet src 192.168.1.0/24



acl manager proto cache_object

http_access allow manager localhost

http_access deny manager



acl purge method PURGE

http_access allow purge localhost

http_access deny purge



# ACLs PARA LIBERACAO DE PORTAS

acl Safe_ports port 20 # caixa

acl Safe_ports port 21 # ftp

acl Safe_ports port 70 # gopher

acl Safe_ports port 80 # http

acl Safe_ports port 210 # wais

acl Safe_ports port 280 # http-mgmt

acl Safe_ports port 443 # https

acl Safe_ports port 465 # outlook smtp

acl Safe_ports port 488 # gss-http

acl Safe_ports port 563 # nntps-outlook

acl Safe_ports port 591 # filemaker

acl Safe_ports port 631 # cups

acl Safe_ports port 777 # multiling http

acl Safe_ports port 873 # rsync

acl Safe_ports port 901 # swat

acl Safe_ports port 1025-65535 # unregistered ports

http_access deny !Safe_ports



# ACLs PARA LIBERACAO DE PORTAS SSL

acl connect method CONNECT

acl SSL_ports port 443 # https

http_access deny connect !SSL_ports



# ACLs PARA LIBERACAO TOTAL POR MAC

acl liberados_mac arp "/etc/squid/rules/liberados_mac"

http_access allow liberados_mac



# ACLs LIBERACAO TOTAL NA HORA DESEJADA

acl LAUNCH_TIME time S M T W H F A 12:00-13:12

http_access allow LAUNCH_TIME



# ACLs PARA BLOQUEIO DE DOMINIOS

acl dominios dstdom_regex "/etc/squid/rules/dominios"

http_access deny dominios



# ACLs PARA PALAVRAS

acl palavras_bloqueadas url_regex -i "/etc/squid/rules/palavras_bloqueadas"

http_access deny palavras_bloqueadas



# ACLs PARA EXTENCOES

acl extencoes url_regex -i "/etc/squid/rules/extencoes"

http_access deny extencoes



# CONFIGURACOES GERAIS PARA A REDE LOCAL E DEMAIS

http_access allow localhost

http_access allow localnet

http_access deny all

 

#!/bin/bash

# -------------------------------  Tabela Nat ------------------------------------------- #

*nat

:PREROUTING ACCEPT [4:312]

:POSTROUTING ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]



-A PREROUTING -i eth0 -s 192.168.1.0/255.255.255.0 -p tcp --dport 80 -j REDIRECT --to-port 3128

-A PREROUTING -i eth0 -d 192.168.0.254 -p tcp --dport 3389 -j DNAT --to-destination 192.168.0.10:3389

-A PREROUTING -i eth0 -d 192.168.0.254 -p tcp --dport 8080 -j DNAT --to-destination 192.168.0.253:80

-A PREROUTING -i eth0 -d 192.168.0.254 -p tcp --dport 8000 -j DNAT --to-destination 192.168.0.253:8000

-A PREROUTING -i eth0 -d 192.168.0.254 -p tcp --dport 2648 -j DNAT --to-destination 192.168.0.253:22



-A POSTROUTING -o eth0 -j MASQUERADE

COMMIT

# ---------------------------------------------------------------------------------------- #





# -----------------------------  Tabela Filter  ------------------------------------------ #

*filter

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

:OUTPUT ACCEPT [143:17688]

:PORTAS - [0:0]



# Cadeias da tabela Filter

-A INPUT -j PORTAS

-A FORWARD -j PORTAS

-A OUTPUT -j PORTAS



-A PORTAS -m state --state RELATED,ESTABLISHED -j ACCEPT

-A PORTAS -p icmp -j ACCEPT

-A PORTAS -i lo -j ACCEPT



# Ftp, Ssh

-A PORTAS -p tcp -m tcp --dport 21 -j ACCEPT

-A PORTAS -p tcp -m tcp --dport 22 -j ACCEPT



# Nagegadores

-A PORTAS -p tcp -m tcp --dport 80 -j ACCEPT

-A PORTAS -p tcp -m tcp --dport 443 -j ACCEPT



# Airtime Icecast

-A PORTAS -p tcp -m tcp --dport 8000 -j ACCEPT

-A PORTAS -p tcp -m tcp --dport 8080 -j ACCEPT



# Squid-Proxy para rede Local

-A PORTAS -s 192.168.1.0/255.255.255.0 -p tcp --dport 3128 -j ACCEPT



# Webmin Dns TS

-A PORTAS -p udp -m udp --dport 53 -j ACCEPT

-A PORTAS -p tcp -m tcp --dport 3389 -j ACCEPT

-A PORTAS -p tcp -m tcp --dport 10000 -j ACCEPT



# Portas e-Mail

-A PORTAS -p tcp -m tcp --dport 25 -j ACCEPT

-A PORTAS -p tcp -m tcp --dport 110 -j ACCEPT

-A PORTAS -p tcp -m tcp --dport 143 -j ACCEPT

-A PORTAS -p tcp -m tcp --dport 465 -j ACCEPT

-A PORTAS -p tcp -m tcp --dport 587 -j ACCEPT

-A PORTAS -p tcp -m tcp --dport 993 -j ACCEPT

-A PORTAS -p tcp -m tcp --dport 995 -j ACCEPT



# Portas Samba-Server

-A PORTAS -p tcp -m tcp --dport 137 -j ACCEPT

-A PORTAS -p udp -m udp --dport 139 -j ACCEPT

-A PORTAS -p tcp -m tcp --dport 445 -j ACCEPT



# Portas uTorrent

-A PORTAS -p tcp -m tcp --dport 6881 -j ACCEPT

-A PORTAS -p udp -m udp --dport 6881 -j ACCEPT

-A PORTAS -p udp -m udp --dport 5000 -j ACCEPT



# Bloqueio de Ping proibido

#-A PORTAS -j REJECT --reject-with icmp-host-prohibited

-A PORTAS -p tcp -m tcp --dport 15961 -j ACCEPT



COMMIT

# ------------------------------------------------------------------------------------------- #

 

asparion
(usa Ubuntu)

Enviado em 31/03/2015 - 09:28h

Carlos_Cunha
(usa Linux Mint)

Enviado em 31/03/2015 - 09:33h