AleXerTecH

#!/bin/sh###### Firewall & Compartir Internet# Autor: Alex Barrios #	 alex@alexertech.com ## Ultima Revision: 30/08/2006# ### #### Localhost#LO_IFACE="lo"LO_IP="127.0.0.1"#### Red Local#LAN_IP="192.168.2.1"LAN_IP_RANGE="192.168.2.0/24"LAN_BCAST="192.168.2.255"LAN_IFACE="eth0"#### Internet 1#INET_IP="10.00.00.00"INET_IFACE="eth1"#### Internet 2#INET_IP_2="200.11.11.111"INET_IFACE_2="eth2"#### Localizacion de iptables.#IPTABLES="/sbin/iptables"#### Borra las reglas anteriores#echo "Borrando reglas anteriores ..."$IPTABLES -F$IPTABLES -X$IPTABLES -Z$IPTABLES -t nat -F#### Cargando modulos necesarios#modprobe ip_conntrack_ircmodprobe ip_conntrack_ftpmodprobe ip_nat_ftpmodprobe ip_nat_irc#### Politicas Predeterminadas de INPUT, FORWARD y OUTPUT#$IPTABLES -P INPUT DROP$IPTABLES -P OUTPUT ACCEPT$IPTABLES -P FORWARD ACCEPT#### NAT enmascarado, para compartir internet y redireccion interna#$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -s $LAN_IP_RANGE -j MASQUERADE$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE_2 -s $LAN_IP_RANGE -j MASQUERADE#### Activa forwarding de paquetes (Linux no lo hace por default)#echo "1" > /proc/sys/net/ipv4/ip_forward#### Redireccionamiento de paquetes#$IPTABLES -t nat -A PREROUTING -p tcp -i $LAN_IFACE --dport 80 -j REDIRECT --to-ports 8080$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE_2 --dport 7880 -j DNAT --to 192.168.2.6:80$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE_2 --dport 8780 -j DNAT --to 192.168.2.10:80$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE_2 --dport 7822 -j DNAT --to 192.168.2.10:7822#### ICMP (pings) - Regla icmp_packets#$IPTABLES -N icmp_packets$IPTABLES -A icmp_packets -p ICMP --icmp-type echo-request -j ACCEPT$IPTABLES -A icmp_packets -p ICMP --icmp-type time-exceeded -j ACCEPT$IPTABLES -A icmp_packets -p ICMP --icmp-type echo-reply -j ACCEPT#### Reglas INPUT#$IPTABLES -A INPUT -i $LO_IFACE -j ACCEPT$IPTABLES -A INPUT -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT$IPTABLES -A INPUT -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT$IPTABLES -A INPUT -i $INET_IFACE_2 -m state --state ESTABLISHED,RELATED -j ACCEPT$IPTABLES -A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT$IPTABLES -A INPUT -p ICMP -j icmp_packets$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "#### Reglas del renvio de paquetes#$IPTABLES -A FORWARD -i $LAN_IFACE -s $LAN_IP_RANGE -m state --state ESTABLISHED,RELATED -j ACCEPT$IPTABLES -A FORWARD -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT$IPTABLES -A FORWARD -i $INET_IFACE_2 -m state --state ESTABLISHED,RELATED -j ACCEPT$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "#### Reglas OUTPUT#$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "#### Imprime que arranco el script#echo "Iptfwall -> by alex... done"