Nao consigo bloquear rede toda [RESOLVIDO]
1. Nao consigo bloquear rede toda [RESOLVIDO]
persaud
(usa Ubuntu)
Enviado em 14/11/2011 - 14:30h
Ola pessoal to com uma duvida eu quero bloquear a rede e liberar somente alguns ips eu andei pesquisando algumas coisas na net mas nao ta dando certo, eu liberei os ips q quero com forward e no final da linha eu dei um DROP no forward, quando eu mudo o ip manualmente pra algum q nao esteja na lista eu nao consigo pindar um site mas eu acesso normal.. quer dizer na verdade eu soh to acessando sites http, to vendo q pode ser a linha do proxy transparente..se puderem me ajudar!
vou passar pra vc's meu firewall
#!/bin/sh
echo "Ativando regras modificadas"
REDE_INTERNA="192.168.0.0/24"
#Limpa tudo
iptables -F FACEBOOK
iptables -F FORWARD
iptables -X FACEBOOK
iptables -F
iptables -t nat -F
# Carrega os modulos
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ip_tables
modprobe iptable_nat
# LIBERAR ACESSO A INTERNET POR MAQUINA
iptables -A FORWARD -s 192.168.0.5 -j ACCEPT #Servidor de Dominio
iptables -A FORWARD -s 192.168.0.87 -j ACCEPT #Note Charles
iptables -A FORWARD -s 192.168.0.100 -j ACCEPT #TI002
iptables -A FORWARD -s 192.168.0.101 -j ACCEPT #Notebook_Ronylton
iptables -A FORWARD -s 192.168.0.102 -j ACCEPT #TI001
iptables -A FORWARD -s 192.168.0.103 -j ACCEPT #TI003
iptables -A FORWARD -s 192.168.0.105 -j ACCEPT #RECEPCAO_OFIC01
iptables -A FORWARD -s 192.168.0.106 -j ACCEPT #RECEPCAO_OFIC02
iptables -A FORWARD -s 192.168.0.115 -j ACCEPT #GARANTIA001
iptables -A FORWARD -s 192.168.0.125 -j ACCEPT #GER_SERVICO01
iptables -A FORWARD -s 192.168.0.126 -j ACCEPT #GER_SERVICO02
iptables -A FORWARD -s 192.168.0.135 -j ACCEPT #APONTADOR001
iptables -A FORWARD -s 192.168.0.136 -j ACCEPT #ESTOQUEPECAS
iptables -A FORWARD -s 192.168.0.137 -j ACCEPT #Pecas
iptables -A FORWARD -s 192.168.0.138 -j ACCEPT #CAIXA
iptables -A FORWARD -s 192.168.0.155 -j ACCEPT #Vendas01
iptables -A FORWARD -s 192.168.0.156 -j ACCEPT #Vendas02
iptables -A FORWARD -s 192.168.0.157 -j ACCEPT #Vendas03
iptables -A FORWARD -s 192.168.0.158 -j ACCEPT #Vendas04
iptables -A FORWARD -s 192.168.0.159 -j ACCEPT #Vendas05
iptables -A FORWARD -s 192.168.0.170 -j ACCEPT #telefonista
iptables -A FORWARD -s 192.168.0.171 -j ACCEPT #Assistente_Financeiro
iptables -A FORWARD -s 192.168.0.172 -j ACCEPT #AuxiliarDiretoria
iptables -A FORWARD -s 192.168.0.175 -j ACCEPT #GerenteFinanceiro
iptables -A FORWARD -s 192.168.0.176 -j ACCEPT #GerFinanceiro
iptables -A FORWARD -s 192.168.0.195 -j ACCEPT #NETTAI_SHOWROOM
iptables -A FORWARD -s 192.168.0.196 -j ACCEPT #Nettai_TI
# Bloqueando tudo
iptables -A FORWARD -j DROP
# Compartilhando internet
# placa de rede eth1=rede de internet
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
# Proxy Transparente - Redireciona todo trafego da porta 80 pra porta 3128
# placa de rede eth0=rede interna
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
#Bloqueando Facebook por https
iptables -N FACEBOOK
iptables -I FORWARD -s $REDE_INTERNA -j FACEBOOK
for i in `cat /etc/facebook.txt`;do
iptables -A FACEBOOK -d $i -j REJECT
#Liberando o bloqueio do Facebook pros pcs abaixo
iptables -I FORWARD -s 192.168.0.100 -d $i -j ACCEPT #TI002
iptables -I FORWARD -s 192.168.0.102 -d $i -j ACCEPT #TI001
iptables -I FORWARD -s 192.168.0.101 -d $i -j ACCEPT #Notebook Ronnylton
iptables -I FORWARD -s 192.168.0.139 -d $i -j ACCEPT #Iphone Ronnylton
done