All pastes #635052 Raw Edit

Untitled

public text v1 · immutable
#635052 ·published 2007-07-26 20:19 UTC
rendered paste body
*nat
:PREROUTING ACCEPT [151838:7386149]
:POSTROUTING ACCEPT [179:10924]
:OUTPUT ACCEPT [185:11612]
-A PREROUTING -i eth1 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 172.16.1.2:3389 
-A PREROUTING -i eth1 -p tcp -m tcp --dport 1433 -j DNAT --to-destination 172.16.1.2:1433 
-A PREROUTING -i eth0 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 172.16.1.2:3389
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1433 -j DNAT --to-destination 172.16.1.2:1433

##Bloqueo del YahooMessenger


-A PREROUTING -i eth0 -p tcp -m tcp --dport 5050 -j DNAT --to-destination 172.16.3.2:5050



#DIRECCIONES CON MSN BLOQUEADO

-A PREROUTING -p tcp -s 172.16.1.22 --dport 1863 -j DNAT --to-destination 172.16.3.1:1863
-A PREROUTING -p tcp -s 172.16.1.23 --dport 1863 -j DNAT --to-destination 172.16.3.1:1863
-A PREROUTING -p tcp -s 172.16.1.24 --dport 1863 -j DNAT --to-destination 172.16.3.1:1863
-A PREROUTING -i eth0 -p tcp --dport 80 -s 172.16.1.0/24 -j REDIRECT --to-port 3128
-A PREROUTING -i eth0 -p tcp --dport 80 -s 172.16.1.0/24 -j REDIRECT --to-port 3128

-A POSTROUTING -o eth1 -j MASQUERADE 
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Thu Apr  7 10:51:21 2005
# Generated by iptables-save v1.2.11 on Thu Apr  7 10:51:21 2005
*mangle
:PREROUTING ACCEPT [290122:40417204]
:INPUT ACCEPT [42106:11059147]
:FORWARD ACCEPT [247019:29226914]
:OUTPUT ACCEPT [40490:14059728]
:POSTROUTING ACCEPT [169199:37601969]
COMMIT
# Completed on Thu Apr  7 10:51:21 2005
# Generated by iptables-save v1.2.11 on Thu Apr  7 10:51:21 2005
*filter
:INPUT ACCEPT [42106:11059147]
:FORWARD ACCEPT [108291:19937362]
:OUTPUT ACCEPT [40490:14059728]
:ipac~fi - [0:0]
:ipac~fo - [0:0]
:ipac~i - [0:0]
:ipac~o - [0:0]
-A INPUT -j ipac~o 
-A INPUT -j ipac~o 
-A INPUT -j ipac~o 
-A INPUT -j ipac~o 
-A INPUT -j ipac~o 
-A INPUT -j ipac~o 
-A FORWARD -j ipac~fi 
-A FORWARD -j ipac~fo 
-A FORWARD -j ipac~fi 
-A FORWARD -j ipac~fo 
-A FORWARD -j ipac~fi 
-A FORWARD -j ipac~fo 
-A FORWARD -j ipac~fi 
-A FORWARD -j ipac~fo 
-A FORWARD -j ipac~fi 
-A FORWARD -j ipac~fo 
-A FORWARD -j ipac~fi 
-A FORWARD -j ipac~fo 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 23 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 80 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 21 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 25 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 110 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 143 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 119 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 1853 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 20 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 443 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 8357 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 1024 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 6667 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 8353 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 1853 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 4665 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 4661 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 4672 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 6901 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 6667 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 8080 -j ACCEPT
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 8016 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 22 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 5000 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 5001 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 6000 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 6891 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 46910 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 1433 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 3389 -j ACCEPT
#-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 1863 -j DROP
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 15779 -j ACCEPT
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 8666 -j ACCEPT
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 5901 -j ACCEPT
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 47198 -j ACCEPT
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 6346 -j ACCEPT
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 9400 -j ACCEPT
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 1082 -j ACCEPT
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 8081 -j ACCEPT


#Para transmisión de video 20060908
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 1082 -j ACCEPT

#Transmision de video de reporteros
-A FORWARD -s 172.16.1.141/255.255.255.0 -i eth0 -o eth1 -p udp -m udp --dport 33000 -j ACCEPT
-A FORWARD -s 172.16.1.141/255.255.255.0 -i eth0 -o eth1 -p udp -m udp --dport 33001 -j ACCEPT
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p tcp -m tcp --dport 8666 -j ACCEPT
-A FORWARD -d 200.78.127.215 -i eth0 -o eth1 -j ACCEPT 
-A FORWARD -s 172.16.1.0/255.255.255.0 -i eth0 -o eth1 -p icmp -j ACCEPT 
-A FORWARD -s 172.16.1.186/255.255.255.0 -i eth0 -o eth1 -j ACCEPT

#Acceso servidor DotNET
-A FORWARD -s 172.16.1.2 -i eth0 -o eth1 -j ACCEPT 

#Para quitar todas las restricciones
#-A FORWARD -i eth0 -o eht1 -j ACCEPT

###ESTA LINEA ES PARA LAS COMPUTADORAS QUE REQUIERAN VIDEO EN MSN
-A FORWARD -s 172.16.1.56 -i eth0 -o eth1 -j ACCEPT
-A FORWARD -s 172.16.1.38 -i eth0 -o eth1 -j ACCEPT

#Bloqueos de internet
-I FORWARD -i eth0 -o eth1 -m iprange --src-range 172.16.1.237-172.16.1.254 -j DROP
-I FORWARD -i eth0 -o eth1 -m iprange --dst-range 172.16.1.237-172.16.1.254 -j DROP
-I INPUT -m iprange --src-range 172.16.1.237-172.16.1.254 -j DROP

#Bloquear una maquina en particular
#-I FORWARD -s 172.16.1.185 -i eth0 -o eth1 -j DROP

#-A INPUT -s 172.16.1.113 -j DROP
-A INPUT -s 172.16.1.13 -j DROP
-A INPUT -s 172.16.1.14 -j DROP
-A INPUT -s 172.16.1.15 -j DROP
-A INPUT -s 172.16.1.16 -j DROP
-A INPUT -s 172.16.1.17 -j DROP
-A INPUT -s 172.16.1.18 -j DROP
-A INPUT -s 172.16.1.19 -j DROP
-A INPUT -s 172.16.1.20 -j DROP
-A INPUT -s 172.16.1.12 -j DROP
-A INPUT -s 172.16.1.11 -j DROP
-A INPUT -s 172.16.1.10 -j DROP
-A INPUT -s 172.16.1.9 -j DROP
-A INPUT -s 172.16.1.8 -j DROP


#-A INPUT -s 172.16.1.54 -j DROP Estaba viendo pornografia


#Oliver se la pasa bajando cosas todos los dias

#Todo lo que no este dentro de las reglas bloquearlo
-A FORWARD -i eth0 -o eth1 -j DROP 

-A OUTPUT -j ipac~i 
-A OUTPUT -j ipac~i 
-A OUTPUT -j ipac~i 
-A OUTPUT -j ipac~i 
-A OUTPUT -j ipac~i 
-A OUTPUT -j ipac~i 
COMMIT