muga
(usa Debian)
Enviado em 16/12/2014 - 07:58h
Amigos,
Estou com os seguinte problemas: Configurei as regras para o iptables (Centos 5.5) mas ele não esta restaurando, dá o seguinte erro:
root@debian:/home/muga# iptables-restore </etc/iptables
iptables-restore: line 8 failed
Daí o firewall carrega regras de um outro arquivo que não consigo localizar nem a porrete!!
Alguém pode me ajudar?
Meu arquivo de regras:
#! /bin/sh
# description: Inicializacao do iptables
#
# chkconfig: 2345 80 30
# processname: iptables
# pidfile: /var/run/iptabless.pid
./etc/rc.d/init.d/functions
./etc/sysconfig/network
if [ ${NETWORKING} = "no" ]
then
exit 0
fi
case "$1" in
start)
echo "Iniciando o serviçde %s: " "IPtables"
# CARREGANDO OS MODULOS
# ---------------------
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_nat_ftp
# Limpando as regras
iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -t nat -F
iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING
iptables -X
# Politica padrão
# ---------------
iptables -P INPUT DROP
# Regras para INPUT
# -----------------
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT
iptables -A INPUT -p tcp --dport 5901 -j ACCEPT
iptables -A INPUT -p udp --dport 5901 -j ACCEPT
iptables -A INPUT -p tcp --dport 10000 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -p ICMP -j ACCEPT
# Regras de OUTPUT
# ----------------
# Regras de FORWARD
# -----------------
# Squid
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -A PREROUTING -s ! 192.168.1.0/24 -p tcp --dport 3128 -j DROP
# srv-oracle (banco de dados)
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5901 -j DNAT --to 192.168.0.159:5901
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5902 -j DNAT --to 192.168.0.159:5902
# Cameras de segurança
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 9090 -j DNAT --to 192.168.0.150:9090
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 37777 -j DNAT --to 192.168.0.150:37777
# TS1 2008 R2
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 3388 -j DNAT --to 192.168.0.193:3389
# TS2 2008 R2
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 3389 -j DNAT --to 192.168.0.253:3389
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 3390 -j DNAT --to 192.168.0.253:3390
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 1050 -j DNAT --to 192.168.0.253:1050
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 8080 -j DNAT --to 192.168.0.253:8080
# UltraVnc
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5900 -j DNAT --to 192.168.0.200:5900
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5904 -j DNAT --to 192.168.0.204:5900
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5905 -j DNAT --to 192.168.0.205:5900
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5909 -j DNAT --to 192.168.0.209:5900
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5912 -j DNAT --to 192.168.0.212:5900
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5914 -j DNAT --to 192.168.0.214:5900
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5917 -j DNAT --to 192.168.0.217:5900
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5919 -j DNAT --to 192.168.0.219:5900
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5921 -j DNAT --to 192.168.0.221:5900
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5922 -j DNAT --to 192.168.0.222:5900
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5923 -j DNAT --to 192.168.0.223:5900
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5924 -j DNAT --to 192.168.0.224:5900
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 5925 -j DNAT --to 192.168.0.225:5900
# Regras de nat MASQUERADE
# ------------------------
iptables -t nat -A POSTROUTING -s 10.0.0.2 -o eth1 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
echo
echo 1 > /proc/sys/net/ipv4/ip_forward
;;
stop)
echo "Parando o serviçde %s: " "IPtables"
echo
iptables -F
iptables -X
iptables -Z
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
echo 0 > /proc/sys/net/ipv4/ip_forward
;;
*)
echo "Uso: iptables (start|stop)"
echo
;;
esac
exit 0
Abraços.