rendered paste body#!/bin/bash
#Establenciendo Políticas por defecto, eliminando reglas (si es que existen) y reseteado contadores
/sbin/iptables -F INPUT && /sbin/iptables -F OUTPUT && /sbin/iptables -F FORWARD && /sbin/iptables -F -t nat
/sbin/iptables -Z
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -t filter -A FORWARD -p tcp -j LOG --log-level debug
# Todo lo que pase por "lo" es válido
/sbin/iptables -t filter -A INPUT -i lo -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -o lo -j ACCEPT
#Permitiendo los Pings
/sbin/iptables -t filter -A INPUT -p icmp --icmp-type 0 -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
/sbin/iptables -t filter -A INPUT -p icmp --icmp-type 8 -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -p icmp --icmp-type 0 -j ACCEPT
#permitiendo que los los resolves hacia los DNS de cantv (eso es para que pueda usar URL)
/sbin/iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
/sbin/iptables -t filter -A INPUT -p udp --sport 53 -j ACCEPT
#Permitiendo la navegación web
/sbin/iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -t filter -A INPUT -p tcp --sport 80 -j ACCEPT
#Permitiendo entrar a sitios "seguros"
/sbin/iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT
/sbin/iptables -t filter -A INPUT -p tcp --sport 443 -j ACCEPT
# IRC
#/sbin/iptables -t filter -A OUTPUT -p tcp --dport 6667 -j ACCEPT
#/sbin/iptables -t filter -A INPUT -p tcp --sport 6667 -j ACCEPT
# SSH
/sbin/iptables -t filter -A INPUT -s 192.168.1.3 -m mac --mac-source 00:09:6B:60:23:E7 -p tcp -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -d 192.168.1.3 -p tcp -j ACCEPT
#webmin
/sbin/iptables -t filter -A INPUT -s 192.168.1.3 -m mac --mac-source 00:09:6B:60:23:E7 -p tcp -j ACCEPT
/sbin/iptables -t filter -A INPUT -p tcp -i eth0 -m mac --mac-source 00:09:6B:60:23:E7 --dport 10000 -j ACCEPT
/sbin/iptables -t filter -A OUTPUT -p tcp -o eth0 --sport 10000 -j ACCEPT
# A PARTIR DE AQUÍ NO PUEDO HACER FUNCIONAR LA BIEN EL FIREWALL
## REGLAS FORWARD
/sbin/iptables -t filter -A FORWARD -s 192.168.1.0/24 -i eth1 -p tcp --dport 80 -j ACCEPT
/sbin/iptables -t filter -A FORWARD -s 192.168.1.0/24 -i eth1 -p tcp --dport 443 -j ACCEPT
# Aceptamos que consulten los DNS
/sbin/iptables -t filter -A FORWARD -s 192.168.1.0/24 -i eth1 -p tcp --dport 53 -j ACCEPT
/sbin/iptables -t filter -A FORWARD -s 192.168.1.0/24 -i eth1 -p udp --dport 53 -j ACCEPT
#Enmascarar
/sbin/iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "Hecho"
------------------------
LA COMPUTADORA CLIENTE AQUE NO HACE UN COÑO
rodilla @ root -> /home/agm # ifconfig
eth0 Link encap:Ethernet HWaddr 00:E0:7D:F9:EA:6D
inet addr:192.168.1.2 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::2e0:7dff:fef9:ea6d/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:259268 errors:0 dropped:1376235 overruns:0 frame:1376235
TX packets:207465 errors:0 dropped:0 overruns:0 carrier:0
collisions:27885 txqueuelen:1000
RX bytes:96405707 (91.9 MiB) TX bytes:167486436 (159.7 MiB)
Interrupt:11 Base address:0xec00
rodilla @ root -> /home/agm # route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
rodilla @ root -> /home/agm # ping google.com
rodilla @ root -> /home/agm # ping 192.168.1.1 (FIREWALL)
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=1.09 ms
--- 192.168.1.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.096/1.096/1.096/0.000 ms