Iptables + Iproute (2 links + balanceamento)
1. Iptables + Iproute (2 links + balanceamento)
supzica
(usa Debian)
Enviado em 29/05/2013 - 17:08h
Meus caros.Estou levando um surra para testar/implementar um ambiente, e gostaria de ajuda da comunidade.
Tenho 1 firewall com GNU/Linux Debian 6, operando sem problemas.
Agora tenho a necessidade de adicionar um 2º link, na qual desejo utilizar somente para um protocolo especifico (RDP - TCP 3389), para acessar um aplicação de um fornecedor.
Sendo assim, terei 1 Link (GVT) para produção (e-mail, navegação e etc.).
E o 2º Link, exclusivo para acesso RDP (TCP/3389) em uma aplicação externa.
Desta forma toda a produção irá utilizar o link da GVT como já vem sendo realizado.
E o link da OI vai ficar exclusivo para a utilização para acesso ao sistema.
Cenário:
Rede Local:
Rede: 192.168.0.0/24
eth0: 192.168.0.254
Link GVT:
Rede: 10.1.1.0/24
eth1: 10.1.1.1
gw: 10.1.1.253
Link OI:
Rede 172.0.0.0/24
eth2: 172.0.0.2
gw: 172.0.0.1
Já alterei o arquivo "/etc/iproute2/rt_tables", ficando da seguinte forma:
255 local
254 main
253 default
0 unspec
250 gvt
251 oi
Segue abaixo o modelo do meu script firewall em produção:
OBS: Ainda não foi alterado, pois não sei como marcar os pacotes e etc.
#!/bin/bash
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
case "$1" in
start)
################################## tabela filter #######################################
##### flush #####
/sbin/iptables -F
##### apaga todas as user chains #####
/sbin/iptables -X
##### politicas padrão #####
/sbin/iptables -P INPUT DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -P OUTPUT DROP
##### chain INPUT #####
### stateful ###
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
### regras para redes que não fazem parte da internet ###
/sbin/iptables -A INPUT -p ALL -i eth0 -d 192.168.0.255 -j ACCEPT
/sbin/iptables -A INPUT -p ALL -i lo -s 127.0.0.1 -j ACCEPT
/sbin/iptables -A INPUT -p ALL -i lo -s 10.1.1.1 -j ACCEPT
/sbin/iptables -A INPUT -p ALL -i lo -s 192.168.0.254 -j ACCEPT
/sbin/iptables -A INPUT -p ALL -i eth0 -s 192.168.0.0/24 -j ACCEPT
# Limitar resposta do ping a 1 por segundo
/sbin/iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
### ssh ###
/sbin/iptables -A INPUT -i eth0 -s 192.168.0.0/24 -d 192.168.0.254 -p tcp -m multiport --dport 2244 -j ACCEPT
/sbin/iptables -A INPUT -i eth1 -p tcp -m multiport --dport 2244 -j ACCEPT
### squid ###
/sbin/iptables -A INPUT -p tcp -i eth0 -s 192.168.0.0/24 -d 192.168.0.254 --dport 3128 -j ACCEPT
### Publica Servidor WEB / SARG ###
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
##### chain forward #####
### stateful ###
/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
### spoofing ###
# ext #
/sbin/iptables -A FORWARD -o eth1 -d 192.168.0.0/24 -j DROP
/sbin/iptables -A FORWARD -i eth1 -s 192.168.0.0/24 -j DROP
# int #
/sbin/iptables -A FORWARD -o eth0 ! -d 192.168.0.0/24 -j DROP
/sbin/iptables -A FORWARD -i eth0 ! -s 192.168.0.0/24 -j DROP
### ICMP ###
/sbin/iptables -A FORWARD -p icmp -j ACCEPT
# Acesso remoto RDP - SERVIDOR -> 192.168.0.254
/sbin/iptables -A FORWARD -p tcp --dport 4100 -d 192.168.0.254 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp --dport 4100 -s 192.168.0.254 -j ACCEPT
### ftp, smtp, smtps, pop, pops, imap, imaps ###
/sbin/iptables -A FORWARD -i eth0 -s 192.168.0.0/24 -o eth1 -p tcp -m multiport --dport 21,25,465,110,995,143,993 -j ACCEPT
### dns ###
/sbin/iptables -A FORWARD -p udp -i eth0 -s 192.168.0.0/24 -o eth1 --dport 53 -j ACCEPT
/sbin/iptables -A FORWARD -p tcp -i eth0 -s 192.168.0.0/24 -o eth1 --dport 53 -j ACCEPT
### squid ###
/sbin/iptables -A FORWARD -p tcp -i eth0 -s 192.168.0.0/24 -o eth1 --dport 3128 -j ACCEPT
### RDP ###
/sbin/iptables -A FORWARD -p tcp -i eth0 -s 192.168.0.0/24 -o eth1 --dport 3389 -j ACCEPT
### Libera Conectividade Social ###
/sbin/iptables -A FORWARD -i eth0 -s 192.168.0.0/24 -o eth1 -d 200.201.174.204 -p tcp -m multiport --dport 443,2631 -j ACCEPT
##### chain OUTPUT #####
/sbin/iptables -A OUTPUT -p ALL -s 127.0.0.1 -j ACCEPT
/sbin/iptables -A OUTPUT -p ALL -s 10.1.1.1 -j ACCEPT
/sbin/iptables -A OUTPUT -p ALL -s 192.168.0.254 -j ACCEPT
/sbin/iptables -A OUTPUT -p icmp -j ACCEPT
############################## Tabela NAT ##################################
##### Flush #####
/sbin/iptables -t nat -F
##### apaga todas as user chains #####
/sbin/iptables -t nat -X
##### politicas padrão #####
##### cria chains usuario #####
##### regras chains usuario #####
##### chain PREROUTING #####
##### Redireciona acesso RDP 4100 - SERVIDOR -> 192.168.0.254 #####
/sbin/iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4100 -j DNAT --to-destination 192.168.0.254:4100
##### chain POSTROUTING #####
/sbin/iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth1 -j MASQUERADE
##### chain OUTPUT #####
############################### tabela mangle #################################
##### flush #####
/sbin/iptables -t mangle -F
##### apaga todas as user chains #####
/sbin/iptables -t mangle -X
/sbin/iptables -t mangle -A OUTPUT -o eth1 -p tcp --dport 80 -j TOS --set-tos 16
/sbin/iptables -t mangle -A OUTPUT -o eth1 -p tcp --dport 443 -j TOS --set-tos 16
;;
stop)
### restaura as politicas default da tabela filter ###
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
### restaura as politicas default da tabela nat ###
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
### restaura as politicas default da tabela mangle ###
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
### Flush ###
/sbin/iptables -F
/sbin/iptables -t nat -F
/sbin/iptables -t mangle -F
### apaga todas as user chains ###
/sbin/iptables -X
/sbin/iptables -t nat -X
/sbin/iptables -t mangle -X
;;
status)
echo ""
echo "TABELA FILTER"
echo ""
/sbin/iptables -L -n
echo ""
echo "TABELA NAT"
echo ""
/sbin/iptables -t nat -L -n
echo ""
echo "TABELA MANGLE"
echo ""
/sbin/iptables -t mangle -L -n
;;
restart)
$0 stop
$0 start
;;
*)
echo $"Usage: $0 {start|stop|status|restart|}"
exit 1
;;
esac
exit $?
Fico grato pela ajuda de todos.