rendered paste body#!/bin/bash
# Firewall
# LAN1 & LAN2
# to Internet. No traffic among lans
# constants
#
INT_INTERFACE="eth2"
LOOPBACK_INTERFACE="lo"
LAN_INTERFACE1="eth0"
LAN_INTERFACE2="eth1"
# Direccion de la interfaz a INTERNET
#
DIR_PUBLICA="200.76.188.51"
DIR_LAN1="192.168.16.254"
DIR_LAN2="192.168.17.254"
LOOPBACK="127.0.0.1"
BROADCAST_SRC="0.0.0.0"
BROADCAST_DEST="255.255.255.255"
CLASS_D_MULTICAST="224.0.0.0/4"
CLASS_E_RESERVED_NET="240.0.0.0/5"
RED1="192.168.16.0/24"
BROADCAST1="192.168.16.255"
RED2="192.168.17.0/24"
BROADCAST2="192.168.17.255"
PTOS_PRIV="0:1023"
PTOS_N_PRIV="1024:65535"
SERVIDOR="192.168.17.1"
VIDEO="192.168.17.61"
# Habilita la proteccion contra icmp broadcast echo
# (Proteccion vs. ecos de icmp de regreso)
#
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#
# Deshabilita los paquetes ruteados desde la direccion
# origen
#
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
echo 0 > $f
done
#
# Habilita la proteccion vs. inundacion de TCP SYN
#
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
#
# Deshabilita aceptacion de redirecciones de rutas
#
for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
echo 0 > $f
done
#
# Elimina paquetes cuya direccion de origen pertenezca
# a otra interface
#
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 0 > $f
done
#
# Graba en el log los paquetes que llegan con
# direcciones imposibles como en las redes 0 o 127
#
for f in /proc/sys/net/ipv4/conf/*/log_martians; do
echo 0 > $f
done
# Habilita el ip_forwarding requerido por los sevicios
# ofrecidos a INTERNET
#
echo 1 > /proc/sys/net/ipv4/ip_forward
#
# Remueve reglas en todas las cadenas
#
/sbin/iptables -A OUTPUT -j LOG
/sbin/iptables -A INPUT -j LOG
/sbin/iptables -A FORWARD -j LOG
/sbin/iptables --flush
/sbin/iptables -t nat --flush
/sbin/iptables -t mangle --flush
#
# Acepta el trafico de loopback y de las redes al firewall
#
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT
/sbin/iptables -A INPUT -i $LAN_INTERFACE1 -j ACCEPT
/sbin/iptables -A OUTPUT -o $LAN_INTERFACE1 -j ACCEPT
/sbin/iptables -A INPUT -i $LAN_INTERFACE2 -j ACCEPT
/sbin/iptables -A OUTPUT -o $LAN_INTERFACE2 -j ACCEPT
/sbin/iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE
echo "1" > /proc/sys/net/ipv4/ip_forward
#
#
# Establece la politica de las cadenas
#
/sbin/iptables --policy INPUT DROP
/sbin/iptables --policy OUTPUT DROP
/sbin/iptables --policy FORWARD DROP
/sbin/iptables -t nat --policy PREROUTING ACCEPT
/sbin/iptables -t nat --policy OUTPUT ACCEPT
/sbin/iptables -t nat --policy POSTROUTING ACCEPT
/sbin/iptables -t mangle --policy PREROUTING ACCEPT
/sbin/iptables -t mangle --policy OUTPUT ACCEPT
#
# Habilita el masquerading para los servicios que
# tiene acceso la red area local
/sbin/iptables -t nat -A POSTROUTING -o $INT_INTERFACE -j MASQUERADE
## 82 -253 restringido
#/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p udp \
# -s $DIR_PUBLICA --sport $PTOS_N_PRIV \
# --dport 53 -j ACCEPT
#/sbin/iptables -A INPUT -i $INT_INTERFACE -p udp \
# --sport 53 \
# -d $DIR_PUBLICA --dport $PTOS_N_PRIV -j ACCEPT
# Habilita la salida de los JEFES
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.1 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.1 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.20 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.20 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.21 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.21 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.22 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.22 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.23 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.23 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.24 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.24 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.25 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.25 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.26 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.26 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.27 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.27 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.28 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.28 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.29 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.29 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.30 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.30 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.31 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.31 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.32 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.32 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.33 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.33 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.34 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.34 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.35 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.35 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.36 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.36 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.37 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.37 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.38 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.38 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.39 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.39 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.40 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.40 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.41 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.41 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.42 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.42 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.43 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.43 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.44 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.44 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.45 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.45 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.46 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.46 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.47 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.47 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.48 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.48 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.49 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.49 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.50 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.50 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.51 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.51 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.52 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.52 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.54 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.54 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.55 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.55 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.56 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.56 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.57 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.57 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.58 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.58 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.59 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.59 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.60 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.60 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.61 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.61 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.62 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.62 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.63 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.63 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.64 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.64 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.65 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.65 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.66 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.66 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.67 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.67 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.68 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.68 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.69 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.69 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.70 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.70 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.71 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.71 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.72 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.72 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.73 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.73 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.74 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.74 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.75 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.75 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.76 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.76 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.77 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.77 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.78 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.78 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.79 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.79 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.80 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.80 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.81 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.81 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.82 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.82 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.83 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.83 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.84 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.84 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 \
-d 192.168.17.85 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE \
-s 192.168.17.85 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.1 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.1 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.10 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.10 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.11 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.11 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.12 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.12 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.13 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.13 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.14 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.14 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.15 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.15 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.16 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.16 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.22 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.22 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.23 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.23 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.24 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.24 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.25 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.25 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.26 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.26 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.27 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.27 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.28 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.28 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.29 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.29 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.30 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.30 -j ACCEPT
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE2 \
-d 192.168.16.31 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE2 -o $INT_INTERFACE \
-s 192.168.16.31 -j ACCEPT
#
# Elimina paquetes de respuesta de TCP sobre
# paquetes con combinaciones ilegales de banderas
#
/sbin/iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
#/sbin/iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP
/sbin/iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
#/sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
/sbin/iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
#/sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
/sbin/iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
#/sbin/iptables -A FORWARD -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
/sbin/iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
#/sbin/iptables -A FORWARD -p tcp --tcp-flags ACK,FIN FIN -j DROP
/sbin/iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
#/sbin/iptables -A FORWARD -p tcp --tcp-flags ACK,PSH PSH -j DROP
/sbin/iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
#/sbin/iptables -A FORWARD -p tcp --tcp-flags ACK,URG URG -j DROP
#
# Elimina paquetes cuya direccion de origen coincide
# con la direccion publica asignada al equipo
#
/sbin/iptables -A INPUT -i $INT_INTERFACE -s $DIR_PUBLICA -j DROP
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -s $DIR_PUBLICA -j DROP
#
# Elimina paquetes que tengan como direccion origen loopbak
# pero ingrese por la interfaz de internet
#
/sbin/iptables -A INPUT -i $INT_INTERFACE -s $LOOPBACK -j DROP
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -s $LOOPBACK -j DROP
#
# Rehusa paquetes con direcciones de broadcast incorrectas
#
/sbin/iptables -A INPUT -i $INT_INTERFACE -s $BROADCAST_DEST -j LOG
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -s $BROADCAST_DEST -j LOG
/sbin/iptables -A INPUT -i $INT_INTERFACE -s $BROADCAST_DEST -j DROP
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -s $BROADCAST_DEST -j DROP
/sbin/iptables -A INPUT -i $INT_INTERFACE -d $BROADCAST_SRC -j LOG
/sbin/iptables -A INPUT -i $INT_INTERFACE -d $BROADCAST_SRC -j DROP
/sbin/iptables -A INPUT -i $INT_INTERFACE -d $RED1 -j DROP
/sbin/iptables -A INPUT -i $INT_INTERFACE -d $BROADCAST1 -j DROP
/sbin/iptables -A INPUT -i $INT_INTERFACE -d $RED2 -j DROP
/sbin/iptables -A INPUT -i $INT_INTERFACE -d $BROADCAST2 -j DROP
#
# Elimina paquetes que tiene direccion multicast, estas solamente
# son validas como direcciones destino y con protocolo udp
#
/sbin/iptables -A INPUT -i $INT_INTERFACE -s $CLASS_D_MULTICAST -j DROP
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -s $CLASS_D_MULTICAST -j DROP
/sbin/iptables -A INPUT -i $INT_INTERFACE -p ! udp -d $CLASS_D_MULTICAST -j DROP
/sbin/iptables -A INPUT -i $INT_INTERFACE -p udp -d $CLASS_D_MULTICAST -j ACCEPT
#
# Elimina paquetes de la red clase E reservada
#
/sbin/iptables -A INPUT -i $INT_INTERFACE -s $CLASS_E_RESERVED_NET -j DROP
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -s $CLASS_E_RESERVED_NET -j DROP
#
# Acceso como Servidor de DNS
#/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p udp \
# -s $DIR_PUBLICA --sport 53 \
# --dport $PTOS_N_PRIV -j ACCEPT
#/sbin/iptables -A INPUT -i $INT_INTERFACE -p udp \
# --sport $PTOS_N_PRIV -d $DIR_PUBLICA \
# --dport 53 -j ACCEPT
#/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp \
# -s $DIR_PUBLICA --sport 53 \
# --dport $PTOS_N_PRIV -j ACCEPT
#/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp \
# --sport $PTOS_N_PRIV -d $DIR_PUBLICA \
# --dport 53 -j ACCEPT
#
#
# DNS ( Acceso DNS Cliente)
#
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p udp \
-s $DIR_PUBLICA --sport $PTOS_N_PRIV \
--dport 53 -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p udp \
--sport 53 \
-d $DIR_PUBLICA --dport $PTOS_N_PRIV -j ACCEPT
#
# DNS ( Querys de cliente enviados por tcp)
#
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp \
-s $DIR_PUBLICA --sport $PTOS_N_PRIV \
--dport 53 -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp \
--sport 53 \
-d $DIR_PUBLICA --dport $PTOS_N_PRIV -j ACCEPT
#
# Servicios de WWW ( Cliente de SQUID)
#
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp \
-s $DIR_PUBLICA --sport $PTOS_N_PRIV \
--dport 80 -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp ! --syn \
--sport 80 \
-d $DIR_PUBLICA --dport $PTOS_N_PRIV -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp \
-s $DIR_PUBLICA --sport $PTOS_N_PRIV \
--dport 443 -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp ! --syn \
--sport 443 \
-d $DIR_PUBLICA --dport $PTOS_N_PRIV -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp \
-s $DIR_PUBLICA --sport $PTOS_N_PRIV \
--dport 143 -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp ! --syn \
--sport 143 \
-d $DIR_PUBLICA --dport $PTOS_N_PRIV -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp \
-s $DIR_PUBLICA --sport $PTOS_N_PRIV \
--dport 21 -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp ! --syn \
--sport 21 \
-d $DIR_PUBLICA --dport $PTOS_N_PRIV -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp \
-s $DIR_PUBLICA --sport $PTOS_N_PRIV \
--dport 20 -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp ! --syn \
--sport 20 \
-d $DIR_PUBLICA --dport $PTOS_N_PRIV -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp \
-s $DIR_PUBLICA --sport $PTOS_N_PRIV \
--dport 8080 -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp ! --syn \
--sport 8080 \
-d $DIR_PUBLICA --dport $PTOS_N_PRIV -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp \
-s $DIR_PUBLICA --sport $PTOS_N_PRIV \
--dport 8081 -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp ! --syn \
--sport 8081 \
-d $DIR_PUBLICA --dport $PTOS_N_PRIV -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp \
-s $DIR_PUBLICA --sport $PTOS_N_PRIV \
--dport 5052 -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp ! --syn \
--sport 5052 \
-d $DIR_PUBLICA --dport $PTOS_N_PRIV -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp \
-s $DIR_PUBLICA --sport $PTOS_N_PRIV \
--dport 5054 -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp ! --syn \
--sport 5054 \
-d $DIR_PUBLICA --dport $PTOS_N_PRIV -j ACCEPT
#
# Filtra y enruta los servicios publicos ofrecidos en SERVIDOR
# Servicios de DNS
#
#/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p udp \
# --sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport 53 \
# -j DNAT --to-destination $SERVIDOR:53
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p udp \
# --sport $PTOS_N_PRIV -d $SERVIDOR --dport 53 \
# -j ACCEPT
#/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p udp \
# -s $SERVIDOR --sport 53 --dport $PTOS_N_PRIV \
# -j ACCEPT
#
# Filtra y enruta los servicios publicos ofrecidos en SERVIDOR
# Servicios de DNS
#
#/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p tcp \
# --sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport 53 \
# -j DNAT --to-destination $SERVIDOR:53
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p tcp \
# --sport $PTOS_N_PRIV -d $SERVIDOR --dport 53 \
# -j ACCEPT
#/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p tcp \
# -s $SERVIDOR --sport 53 --dport $PTOS_N_PRIV \
# -j ACCEPT
#
# Filtra y enruta los servicios publicos ofrecidos en SERVIDOR
# Servicios de WWW
#
#/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p tcp \
# --sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport 80 \
# -j DNAT --to-destination $SERVIDOR:80
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p tcp \
# --sport $PTOS_N_PRIV -d $SERVIDOR --dport 80 \
# -j ACCEPT
#/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p tcp \
# -s $SERVIDOR --sport 80 --dport $PTOS_N_PRIV \
# -j ACCEPT
# Accesar webmin provisionalmente
#/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p tcp \
# --sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport 9501 \
# -j DNAT --to-destination $SERVIDOR:9501
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p tcp \
# --sport $PTOS_N_PRIV -d $SERVIDOR --dport 9501 \
# -j ACCEPT
#/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p tcp \
# -s $SERVIDOR --sport 9501 --dport $PTOS_N_PRIV \
# -j ACCEPT
#
# Filtra y enruta los servicios publicos ofrecidos en SERVIDOR
# Servicios de FTP
# (Conexiones Activas)
#/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p tcp \
# --sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport 20 \
# -j DNAT --to-destination $SERVIDOR:20
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p tcp \
# --sport $PTOS_N_PRIV -d $SERVIDOR --dport 20 \
# -j ACCEPT
#/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p tcp ! --syn #\
# -s $SERVIDOR --sport 20 --dport $PTOS_N_PRIV \
# -j ACCEPT
#
# Filtra y enruta los servicios publicos ofrecidos en SERVIDOR
# Servicios de FTP
# (Conexiones Pasivas)
#/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p tcp \
#--sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport $PTOS_N_PRIV \
# -j DNAT --to-destination $SERVIDOR:$PTOS_N_PRIV
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p tcp \
# --sport $PTOS_N_PRIV -d $SERVIDOR --dport $PTOS_N_PRIV \
# -j ACCEPT
#/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p tcp \
# -s $SERVIDOR --sport $PTOS_N_PRIV --dport $PTOS_N_PRIV \
# -j ACCEPT
#
# Filtra y enruta los servicios publicos ofrecidos en SERVIDOR
# Servicios de FTP
#
#/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p tcp \
# --sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport 21 \
# -j DNAT --to-destination $SERVIDOR:21
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p tcp \
# --sport $PTOS_N_PRIV -d $SERVIDOR --dport 21 \
# -j ACCEPT
#/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p tcp ! --syn #\
# -s $SERVIDOR --sport 21 --dport $PTOS_N_PRIV \
# -j ACCEPT
#
# Servicios de WWW (SSL)
#
#/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p tcp \
# --sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport 443 \
# -j DNAT --to-destination $SERVIDOR:443
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p tcp \
# --sport $PTOS_N_PRIV -d $SERVIDOR --dport 443 \
# -j ACCEPT
#/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p tcp \
# -s $SERVIDOR --sport 443 --dport $PTOS_N_PRIV \
# -j ACCEPT
#
# Servicios de correo (SMTP)
#
#/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p tcp \
# --sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport 25 \
# -j DNAT --to-destination $SERVIDOR:25
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p tcp \
# --sport $PTOS_N_PRIV -d $SERVIDOR --dport 25 \
# -j ACCEPT
#/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p tcp \
# -s $SERVIDOR --sport 25 --dport $PTOS_N_PRIV \
# -j ACCEPT
#
# Servicios de correo (POP3)
#
#/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p tcp \
# --sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport 110 \
# -j DNAT --to-destination $SERVIDOR:110
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p tcp \
# --sport $PTOS_N_PRIV -d $SERVIDOR --dport 110 \
# -j ACCEPT
#/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p tcp \
# -s $SERVIDOR --sport 110 --dport $PTOS_N_PRIV \
# -j ACCEPT
#
# Servicios de video
#
/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p tcp \
--sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport 5550 \
-j DNAT --to-destination $VIDEO:5550
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p tcp \
--sport $PTOS_N_PRIV -d $VIDEO --dport 5550 \
-j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p tcp \
-s $VIDEO --sport 5550 --dport $PTOS_N_PRIV \
-j ACCEPT
#
# Servicios de video
#
/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p tcp \
--sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport 4550 \
-j DNAT --to-destination $VIDEO:4550
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p tcp \
--sport $PTOS_N_PRIV -d $VIDEO --dport 4550 \
-j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p tcp \
-s $VIDEO --sport 4550 --dport $PTOS_N_PRIV \
-j ACCEPT
#
# Servicios de video
#
/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p tcp \
--sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport 5900 \
-j DNAT --to-destination $VIDEO:5900
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p tcp \
--sport $PTOS_N_PRIV -d $VIDEO --dport 5900 \
-j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p tcp \
-s $VIDEO --sport 5900 --dport $PTOS_N_PRIV \
-j ACCEPT
#
# Servicios de video
#
/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p tcp \
--sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport 9000 \
-j DNAT --to-destination $VIDEO:9000
/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p tcp \
--sport $PTOS_N_PRIV -d $VIDEO --dport 9000 \
-j ACCEPT
/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p tcp \
-s $VIDEO --sport 9000 --dport $PTOS_N_PRIV \
-j ACCEPT
#
# puerto de prepa virtual
#
#/sbin/iptables -t nat -A PREROUTING -i $INT_INTERFACE -p tcp \
# --sport $PTOS_N_PRIV -d $DIR_PUBLICA --dport 7800 \
# -j DNAT --to-destination $SERVIDOR:7800
#/sbin/iptables -A FORWARD -i $INT_INTERFACE -o $LAN_INTERFACE1 -p tcp \
# --sport $PTOS_N_PRIV -d $SERVIDOR --dport 7800 \
# -j ACCEPT
#/sbin/iptables -A FORWARD -i $LAN_INTERFACE1 -o $INT_INTERFACE -p tcp \
# -s $SERVIDOR --sport 7800 --dport $PTOS_N_PRIV \
# -j ACCEPT
#
# SSH.
# Habilita el cliente de SSH del servidor Bourbon
#
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp \
-s $DIR_PUBLICA --sport $PTOS_N_PRIV \
--dport 22 -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp ! --syn \
--sport 22 \
-d $DIR_PUBLICA --dport $PTOS_N_PRIV -j ACCEPT
#
# Habilita el acceso al servidor de SSH del servidor Bourbon
#
/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp \
--sport $PTOS_N_PRIV \
-d $DIR_PUBLICA --dport 22 -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp ! --syn \
-s $DIR_PUBLICA --sport 22 \
--dport $PTOS_N_PRIV -j ACCEPT
#
# Impide conexiones de/hacia INTERNET a XWINDOWS
#
XWINDOW_PORTS="6000:6063"
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp --syn \
--destination-port $XWINDOW_PORTS -j REJECT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp --syn \
--destination-port $XWINDOW_PORTS -j DROP
#
# Impide conexiones a servicios exclusivos de la intranet
#
NFS_PORT="2049"
SQUID_PORT="3128"
LOCKD_PORT="4045"
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p tcp \
-m multiport --destination-port $NFS_PORT,$SQUID_PORT \
--syn -j DROP
/sbin/iptables -A INPUT -i $INT_INTERFACE -p tcp \
-m multiport --destination-port $NFS_PORT,$SQUID_PORT \
--syn -j DROP
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p udp \
-m multiport --destination-port $NFS_PORT,$LOCKD_PORT \
-j REJECT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p udp \
-m multiport --destination-port $NFS_PORT,$LOCKD_PORT \
-j DROP
#
# Filtrado de mensajes ICMP y status messages
#
# Eliminar fragmentos de ICMP
#
/sbin/iptables -A INPUT -i $INT_INTERFACE --fragment -p icmp -j LOG \
--log-prefix "Fragmented ICMP:"
/sbin/iptables -A INPUT -i $INT_INTERFACE --fragment -p icmp -j DROP
#
# Habilita el control de flujo entre dos ruteadores permitiendo
# los tipos de mensajes 4,12 y 3
#
/sbin/iptables -A INPUT -i $INT_INTERFACE -p icmp \
--icmp-type source-quench -d $DIR_PUBLICA -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p icmp \
-s $DIR_PUBLICA --icmp-type source-quench -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p icmp \
--icmp-type parameter-problem -d $DIR_PUBLICA -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p icmp \
-s $DIR_PUBLICA --icmp-type parameter-problem -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p icmp \
--icmp-type destination-unreachable -d $DIR_PUBLICA -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p icmp \
-s $DIR_PUBLICA --icmp-type fragmentation-needed -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p icmp \
-s $DIR_PUBLICA --icmp-type destination-unreachable -j DROP
/sbin/iptables -A INPUT -i $INT_INTERFACE -p icmp \
--icmp-type time-exceeded -d $DIR_PUBLICA -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p icmp \
-s $DIR_PUBLICA --icmp-type echo-request -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p icmp \
--icmp-type echo-reply -d $DIR_PUBLICA -j ACCEPT
/sbin/iptables -A INPUT -i $INT_INTERFACE -p icmp \
--icmp-type echo-request -d $DIR_PUBLICA -j ACCEPT
/sbin/iptables -A OUTPUT -o $INT_INTERFACE -p icmp \
-s $DIR_PUBLICA --icmp-type echo-reply -j ACCEPT
# Inserta el modulo de nat para FTP
/sbin/modprobe ip_nat_ftp