Miscellany

#
#!/bin/bash
#
# Script de Firewall
#
IPT=/usr/sbin/iptables
PPPIF="ppp0"
EXTIF="eth2"
INTIF="eth0"

#####################################
#
### Passo 1: Primeiro vamos arrumar a casa :) ###
#
#####################################
#
# Limpando as Regras
#
$IPT -F INPUT
$IPT -F OUTPUT
$IPT -F FORWARD
$IPT -F
$IPT -t nat -F
#
# Definindo a Politica Default das Cadeias
#
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD DROP
#
######################################
#
### Passo 2: Antes de Servir, vamos nos proteger ! ###
#
######################################
#
# Desabilitando o trafego IP Entre as Placas de Rede
#
echo "0" > /proc/sys/net/ipv4/ip_forward
#
# Configurando a Protecao anti-spoofing
#
echo "Setting anti-spoofing .....[ OK ]"
for spoofing in /proc/sys/net/ipv4/conf/*/rp_filter; do
        echo "1" > $spoofing
done
#
#######################################
#
### Passo 3: Carregando os modulos do iptables ###
#
#######################################
#
/sbin/depmod -a
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_MASQUERADE
echo "Setting rules .............[ OK ]"
#
#######################################
#
### Passo 4: Agora, vamos definir o que pode passar e o que nao ###
#
#######################################
#
# Qualquer pacote IP que venha do localhost, Ok.
#
$IPT -A INPUT -i lo -j ACCEPT
#
# REDE INTERNA LIBERADA
#
$IPT -A INPUT -i $INTIF -j ACCEPT
$IPT -A INPUT -i $PPPIF -m state --state ESTABLISHED,RELATED -j ACCEPT
#
#LIBERANDO PORTAS
$IPT -A INPUT -i $INTIF -p udp -m udp --dport 137 -j ACCEPT
$IPT -A INPUT -i $INTIF -p udp -m udp --dport 138 -j ACCEPT
$IPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
$IPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
# No iptables, temos de dizer quais sockets sao validos em uma conexao
$IPT -A FORWARD -p udp --dport 53 -j ACCEPT
$IPT -A FORWARD -p tcp --dport 53 -j ACCEPT
$IPT -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
$IPT -A FORWARD -p tcp -m limit --limit 1/s -j ACCEPT
$IPT -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
$IPT -A FORWARD --protocol tcp --tcp-flags ALL SYN,ACK -j DROP
#
# Primeiro, ativar o mascaramento (nat).
#
$IPT -t nat -F POSTROUTING
$IPT -t nat -A POSTROUTING -o $PPPIF -j MASQUERADE
#
#libera email para os computadores
#
$IPT -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 25 -j ACCEPT
$IPT -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 110 -j ACCEPT
#
# Redireciona porta 80 para 3128 (squid)
#
$IPT -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
#
########################################
#
### Finalmente, podemos "Ligar" o foward (clientes) :) ###
#
########################################
#
# Habilitando o trafego Ip, entre as Interfaces de rede
#
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "Firewall OK ...............[ OK ]"