rendered paste body#!/bin/bash
# chkconfig: 3456 30 90
# description: rc.firewall
# Otimizacoes de kernel
/etc/init.d/kernel-optimize start
# Declarando Variaveis
IF_EXT="eth1"
IF_INT="eth0"
IF_DMZ="eth2"
IPTABLES="/sbin/iptables"
LOG_OPTIONS="--log-tcp-sequence --log-ip-options --log-tcp-options --log-level info"
LOG_LIMIT="-m limit --limit 4/s"
# carrega alguns modulos do conntrack
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp
NETBIOS="135 137:139 445"
REDE_INTERNA="
192.168.10.0/24
"
REDE_DMZ="
10.0.0.0/8
"
LIBERA_SSH="
200.103.31.14
201.88.73.100
192.168.10.0/24
10.0.0.0/8
"
LIBERA_REMOTE_TS="
192.168.10.0/24
10.0.0.0/8
"
# Matriz 200.103.31.14
# Matriz novo 201.88.73.100
# Rota66 200.193.231.129
# luiz 201.34.243.243
LIBERA_ACESSOS_EXT="
201.88.73.100
"
EXCECOES="
$LIBERA_ACESSOS_EXT
192.168.10.70
192.168.10.71
192.168.10.101
192.168.10.120
192.168.10.200
192.168.10.220
192.168.10.30
192.168.10.31
192.168.10.132
"
############################################################
# PORTAS MICROSIGA => 5024 6767 6768 6869 7024 #
############################################################
LIBERA_FORWARD_TCP="21 22 23 25 53 110 123 143 515 1234 1455 1999 2631 3389 5024 6767 6768 6869 8080 8443 7024 3650 3663 4550 5550"
LIBERA_FORWARD_UDP="20 22 23 25 53 110 123 143 515 1234 1455 1999 2631 3389 5024 6767 6768 6869 8080 8443 7024 3650 3663 4550 5550"
LIBERA_INPUT_TCP="53 80 135 137 138 139 445 1082 3389 3663"
LIBERA_INPUT_UDP="53 80 135 137 138 139 445 1082 3389 3663"
DNS="
201.10.128.3
201.10.120.3
200.103.31.14
201.88.73.100
201.88.73.97
201.88.73.105
"
case "$1" in
start)
# vamos comecar ....
# limpando regras
$IPTABLES -F
$IPTABLES -Z
$IPTABLES -X
# setando regras padrao
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT ACCEPT
#INPUT
# libera interface loopback
$IPTABLES -A INPUT -i lo -j ACCEPT
#$IPTABLES -N bloq_netbios
# vamos dropar pacotes NetBIOS
#for i in $NETBIOS; do
# $IPTABLES -A bloq_netbios -p tcp --sport $i -j DROP
# $IPTABLES -A bloq_netbios -p tcp --dport $i -j DROP
# $IPTABLES -A bloq_netbios -p udp --sport $i -j DROP
# $IPTABLES -A bloq_netbios -p udp --dport $i -j DROP
#done
# bloqueando qualquer tipo de BROADCAST IP
#$IPTABLES -A INPUT -m pkttype --pkt-type broadcast -j DROP
# bloqueando qualquer tipo de MULTICAST IP
#$IPTABLES -A INPUT -m pkttype --pkt-type multicast -j DROP
# jogando fora conexoes tcp/113 ( AUTH )
$IPTABLES -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset
# aplicando bloqueio NetBIOS
#$IPTABLES -A INPUT -j bloq_netbios
# liberando a volta de conexoes dos servidores DNS
for i in $DNS; do
$IPTABLES -A INPUT -p tcp --sport 53 -s $i -j ACCEPT
$IPTABLES -A INPUT -p udp --sport 53 -s $i -j ACCEPT
done
# liberando porta SSH para alguns IPs
for i in $LIBERA_SSH; do
$IPTABLES -A INPUT -p tcp --dport 22 -s $i -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 22 -s $i -j ACCEPT
done
# bloqueando o resto das conexoes na porta SSH
#$IPTABLES -A INPUT -p tcp --dport 22 -j LOG $LOG_OPTIONS $LOG_LIMIT --log-prefix "bloq_conexao_ssh: "
$IPTABLES -A INPUT -p tcp --dport 22 -j REJECT --reject-with tcp-reset
#Contra ping of death
$IPTABLES -A INPUT -p ICMP --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
# Bloqueia ICMP Type 8
#$IPTABLES -A INPUT -p icmp --icmp-type 8 -i $IF_EXT -j LOG --log-prefix "Dropped ICMP Ping"
$IPTABLES -A INPUT -p icmp --icmp-type 8 -i $IF_EXT -j DROP
# fazendo bloqueio de alguns IPs
#for i in $BLACKLIST; do
# $IPTABLES -A INPUT -p tcp -s $i -j LOG $LOG_OPTIONS $LOG_LIMIT --log-prefix "bloq_blacklist: "
# $IPTABLES -A INPUT -p tcp -s $i -j REJECT --reject-with tcp-reset
#done
# liberando portas TCP para algumas redes
for i in $LIBERA_INPUT_TCP; do
$IPTABLES -A INPUT -s $REDE_INTERNA -p tcp --dport $i -j ACCEPT
$IPTABLES -A INPUT -s $REDE_DMZ -p tcp --dport $i -j ACCEPT
$IPTABLES -A INPUT -s $LIBERA_ACESSOS_EXT -p tcp --dport $i -j ACCEPT
done
# liberando portas UDP para algumas redes
for i in $LIBERA_INPUT_UDP; do
$IPTABLES -A INPUT -s $REDE_INTERNA -p udp --dport $i -j ACCEPT
$IPTABLES -A INPUT -s $REDE_DMZ -p udp --dport $i -j ACCEPT
$IPTABLES -A INPUT -s $LIBERA_ACESSOS_EXT -p udp --dport $i -j ACCEPT
done
# Configurando proxy transparente
LIBERA_CAIXA="
200.201.173.68
200.201.174.0/24
"
for i in $LIBERA_CAIXA; do
$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.0/24 -d ! $i -p TCP --dport 80 -j REDIRECT --to-ports 1082
$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.0/24 -d ! $i -p UDP --dport 80 -j REDIRECT --to-ports 1082
$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.0/24 -d ! $i -p TCP --dport 443 -j REDIRECT --to-ports 1082
$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.0/24 -d ! $i -p UDP --dport 443 -j REDIRECT --to-ports 1082
done
#for i in $LIBERA_CAIXA; do
#$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.200 -d ! $i -p TCP --dport 80 -j REDIRECT --to-ports 1082
#$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.200 -d ! $i -p UDP --dport 80 -j REDIRECT --to-ports 1082
#$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.200 -d ! $i -p TCP --dport 443 -j REDIRECT --to-ports 1082
#$IPTABLES -t nat -A PREROUTING -i $IF_INT ! -s 192.168.10.200 -d ! $i -p UDP --dport 443 -j REDIRECT --to-ports 1082
#done
# REDIRECIONANDO PORTA 1234 REQUISITADA DA REDE INTERNA PARA REDE DMZ
for i in $REDE_INTERNA; do
$IPTABLES -t nat -A PREROUTING -i $IF_INT -s $i -d $REDE_DMZ -p TCP --dport 1234 -j DNAT --to 10.0.0.2:1234
$IPTABLES -t nat -A PREROUTING -i $IF_INT -s $i -d $REDE_DMZ -p UDP --dport 1234 -j DNAT --to 10.0.0.2:1234
$IPTABLES -t nat -A PREROUTING -i $IF_INT -s $i -d $REDE_DMZ -p TCP --dport 7024 -j DNAT --to 10.0.0.2:7024
$IPTABLES -t nat -A PREROUTING -i $IF_INT -s $i -d $REDE_DMZ -p UDP --dport 7024 -j DNAT --to 10.0.0.2:7024
done
# REDIRECIONAMENTO DAS PORTAS PARA FUNCIONAMENTO DO REMOTE ADMIN
for i in $LIBERA_REMOTE_TS; do
# $IPTABLES -t nat -A PREROUTING -i $IF_EXT -s $i -p TCP --dport 48991 -j DNAT --to 192.168.10.220:4899
# $IPTABLES -t nat -A PREROUTING -i $IF_EXT -s $i -p TCP --dport 3650 -j DNAT --to 192.168.10.220:3650
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s $i -p TCP --dport 48992 -j DNAT --to 192.168.10.200:4899
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s $i -p TCP --dport 48995 -j DNAT --to 10.0.0.2:4899
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s $i -p TCP --dport 3389 -j DNAT --to 10.0.0.2:3389
# $IPTABLES -t nat -A PREROUTING -i $IF_EXT -s $i -p TCP --dport 48993 -j DNAT --to 192.168.10.31:4899
# $IPTABLES -t nat -A PREROUTING -i $IF_EXT -s $i -p TCP --dport 48994 -j DNAT --to 192.168.10.32:4899
done
# #################################################################################################################
# DESATIVADO #
# #
# REDIRECIONAMENTO DAS PORTAS PARA FUNCIONAMENTO DO SISTEMAS DE CAMERAS - PICO #
# $IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p TCP --dport 1999 -j DNAT --to 192.168.10.220:1999 #
# #################################################################################################################
# #################################################################################################################
# #
# ATIVANDO SISTEMA DE CAMERAS GEOVISION #
# #
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p TCP --dport 8080 -j DNAT --to 192.168.10.220:8080
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p TCP --dport 6550 -j DNAT --to 192.168.10.220:6550
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p TCP --dport 4550 -j DNAT --to 192.168.10.220:4550
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p TCP --dport 5550 -j DNAT --to 192.168.10.220:5550
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p UDP --dport 8080 -j DNAT --to 192.168.10.220:8080
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p UDP --dport 6550 -j DNAT --to 192.168.10.220:6550
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p UDP --dport 4550 -j DNAT --to 192.168.10.220:4550
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p UDP --dport 5550 -j DNAT --to 192.168.10.220:5550
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 192.168.10.4/0 -p TCP --dport 3650 -j DNAT --to 192.168.10.220:3650
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p UDP --dport 3650 -j DNAT --to 192.168.10.220:3650
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p TCP --dport 3663 -j DNAT --to 192.168.10.220:3663
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p TCP --dport 3550 -j DNAT --to 192.168.10.220:3550
$IPTABLES -t nat -A PREROUTING -i $IF_EXT -s 0.0.0.0/0 -p UDP --dport 3550 -j DNAT --to 192.168.10.220:3550
# #
##################################################################################################################
# permitindo conexoes estabelecidas
$IPTABLES -A INPUT -m state --state ! NEW -j ACCEPT
# liberando ICMP
$IPTABLES -A INPUT -p icmp -j ACCEPT
# bloqueio total
#$IPTABLES -A INPUT -j LOG $LOG_OPTIONS $LOG_LIMIT --log-prefix "bloq_final_INPUT: "
$IPTABLES -A INPUT -p tcp -j REJECT --reject-with tcp-reset
$IPTABLES -A INPUT -p ! tcp -j REJECT
#FORWARD
# liberando ICMP
$IPTABLES -A FORWARD -p icmp -j ACCEPT
# libera interface loopback
$IPTABLES -A FORWARD -i lo -j ACCEPT
# MASQUERADE DA REDE INTERNA PARA INTERNET
$IPTABLES -t nat -A POSTROUTING -s $REDE_INTERNA -o $IF_EXT -j MASQUERADE
# MASQUERADE DA REDE DMZ PARA REDE INTERNA
$IPTABLES -t nat -A POSTROUTING -s $REDE_DMZ -d $REDE_INTERNA -o $IF_INT -j MASQUERADE
# liberando portas TCP com permissao pra todo mundo
for i in $LIBERA_FORWARD_TCP; do
$IPTABLES -A FORWARD -p tcp --dport $i -j ACCEPT
done
# liberando portas UDP com permissao pra todo mundo
for i in $LIBERA_FORWARD_UDP; do
$IPTABLES -A FORWARD -p udp --dport $i -j ACCEPT
done
# liberando portas altas para algumas maquinas
for i in $EXCECOES; do
$IPTABLES -A FORWARD -s $i -p tcp --dport 80 -j ACCEPT
$IPTABLES -A FORWARD -s $i -p tcp --dport 443 -j ACCEPT
$IPTABLES -A FORWARD -s $i -p tcp --dport 1024:65535 -j ACCEPT
done
# liberando portas altas para algumas maquinas
for i in $EXCECOES; do
$IPTABLES -A FORWARD -s $i -p udp --dport 80 -j ACCEPT
$IPTABLES -A FORWARD -s $i -p udp --dport 137 -j ACCEPT
$IPTABLES -A FORWARD -s $i -p udp --dport 443 -j ACCEPT
$IPTABLES -A FORWARD -s $i -p udp --dport 1024:65535 -j ACCEPT
done
# permitindo conexoes estabelecidas
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# bloqueio total
#$IPTABLES -A FORWARD -j LOG $LOG_OPTIONS $LOG_LIMIT --log-prefix "bloq_final_FORWARD: "
$IPTABLES -A FORWARD -p tcp -j REJECT --reject-with tcp-reset
$IPTABLES -A FORWARD -p ! tcp -j REJECT
;;
stop)
$IPTABLES -t filter -F
$IPTABLES -t filter -Z
$IPTABLES -t nat -F
$IPTABLES -t nat -Z
$IPTABLES -X
#POLICY
$IPTABLES -t filter -P INPUT ACCEPT
$IPTABLES -t filter -P FORWARD ACCEPT
$IPTABLES -t filter -P OUTPUT ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
;;
status)
$IPTABLES -t filter -L -v
$IPTABLES -t nat -L -v
;;
panic)
$IPTABLES -t filter -F
$IPTABLES -t filter -Z
$IPTABLES -t nat -F
$IPTABLES -t nat -Z
$IPTABLES -X
#POLICY
$IPTABLES -t filter -P INPUT DROP
$IPTABLES -t filter -P FORWARD DROP
$IPTABLES -t filter -P OUTPUT DROP
$IPTABLES -t nat -P POSTROUTING DROP
$IPTABLES -t nat -P PREROUTING DROP
$IPTABLES -t nat -P OUTPUT DROP
;;
*)
echo $0 'start||stop|status|panic'
esac
exit 0