Olha pessoal, alguma coisa não faz as regras iptables funcionar, instalei o squid e esta funcionando pela porta 3128, mas mesmo dando
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -s 192.168.1.0/24 -j REDIRECT --to 3128 não funciona :( Em 11 de agosto de 2014 14:38, Rudimar <[email protected]> escreveu: > > na verdade é 255.255.255.248 , eu ja tinha testado e voltei para padrão, > voltei para .248 e teste e nada... > > outra coisa na interface > network xxx.xxx.xxx.184/29 > é valido por assim essa configuração? é a minha rede. > > > eu havia instalado o webmin e removi, pode ter ficado algum configuração? > > > > > > > > > > > > > > > > > > Em 11 de agosto de 2014 14:15, Anderson Eckhardt <[email protected]> > escreveu: > > Tem certeza que sua netmask é 255.255.255.0? Me parece muito para IP >> válido... >> >> Em 11/08/2014, às 14:10, Rudimar <[email protected]> escreveu: >> >> >> bom galera, tentei as dicas mas não foi, não sei o que pode ser, >> >> >> vou postar meu script fica mais fácil, >> >> >> >> #!/bin/bash >> modprobe iptable_nat >> modprobe iptable_filter >> modprobe ipt_LOG >> modprobe ipt_state >> modprobe ipt_limit >> >> echo 1 > /proc/sys/net/ipv4/ip_forward >> echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts >> >> IPT="/sbin/iptables" >> REDE="192.168.1.0/24" >> LAN="eth1" >> WAN="eth0" >> >> IP1="x.186" >> IP2="x.187" >> IP3="x.188" >> IP4="x.189" >> >> >> # Seta IPs nas interfaces virtuais >> ifconfig eth0:0 x.186 netmask 255.255.255.0 >> ifconfig eth0:1 x.187 netmask 255.255.255.0 >> ifconfig eth0:2 x.188 netmask 255.255.255.0 >> ifconfig eth0:2 x.189 netmask 255.255.255.0 >> >> # Arquivos de portas liberadas >> PT_TCP="/etc/squid/PT_TCP" >> PT_UDP="/etc/squid/PT_UDP" >> >> # Limpando Regras existentes >> $IPT -F >> $IPT -Z >> >> $IPT -t nat -F >> $IPT -t mangle -F >> $IPT -t filter -F >> $IPT -t nat -Z >> $IPT -t mangle -Z >> $IPT -t filter -Z >> >> echo "Regras Zeradas." >> >> # Definindo Politicas Padrão >> $IPT -P INPUT DROP >> $IPT -P FORWARD DROP >> $IPT -P OUTPUT ACCEPT >> >> # Habilitanto NAT >> $IPT -t nat -A POSTROUTING -o $WAN -j MASQUERADE >> >> # Liberando Input loopback >> $IPT -A INPUT -i lo -j ACCEPT >> >> >> >> # Ativa Proxy Transparente >> $IPT -t nat -A PREROUTING -i $LAN -s $REDE -p tcp --dport 80 -j REDIRECT >> --to-port 3128 >> # Forca o uso do proxy >> #$IPT -t nat -A PREROUTING -i $LAN -p tcp --dport 80 -j DNAT --to >> 192.168.0.253:80 >> >> # Liberando Conexoes Estabelecidas pela LAN >> $IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT >> $IPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT >> >> >> # Libera Resposta a ping WAN >> $IPT -A INPUT -p icmp -i $WAN -j ACCEPT >> >> ######### Libera Acessos LAN_to_WAN ######### >> >> $IPT -A FORWARD -i $LAN -o $WAN -p icmp -j ACCEPT >> >> for i in `cat $PT_TCP`; do >> $IPT -A FORWARD -i $LAN -o $WAN -p tcp --dport $i -j ACCEPT >> done >> >> for i in `cat $PT_UDP`; do >> $IPT -A FORWARD -i $LAN -o $WAN -p udp --dport $i -j ACCEPT >> done >> >> # Bloqueia IPs >> #IPT -A INPUT -s 81.35.253.20 -j DROP >> >> # Libera Porta para fora >> #$IPT -A FORWARD -i $LAN -s 192.168.1.119 -o $WAN -p tcp --dport 5432 -j >> ACCEPT >> >> # Libera PC Acesso geral LAN_to_WAN >> #$IPT -A FORWARD -i $LAN -o $WAN -s 192.168.1.219 -j ACCEPT >> >> # Acessos LAN_to_Server >> $IPT -A INPUT -p icmp -i $LAN -s $REDE -j ACCEPT >> $IPT -A INPUT -p tcp --dport 53 -i $LAN -s $REDE -j ACCEPT >> $IPT -A INPUT -p udp --dport 53 -i $LAN -s $REDE -j ACCEPT >> $IPT -A INPUT -p tcp --dport 80 -i $LAN -s $REDE -j ACCEPT >> $IPT -A INPUT -p tcp --dport 3128 -i $LAN -s $REDE -j ACCEPT >> $IPT -A INPUT -p tcp --dport 2222 -i $LAN -s $REDE -j ACCEPT >> >> # Servicos WAN_to_Server >> $IPT -A INPUT -p tcp --dport 2222 -i $WAN -j ACCEPT >> $IPT -A INPUT -p tcp --dport 80 -i $WAN -j ACCEPT >> $IPT -A INPUT -p tcp --dport 3128 -i $WAN -j ACCEPT >> >> # Servicos WAN_to_LAN >> $IPT -A INPUT -p tcp --dport 3389 -i $WAN -j ACCEPT >> $IPT -A FORWARD -i $WAN -o $LAN -p tcp --dport 3389 -j ACCEPT >> >> $IPT -t nat -A PREROUTING -p tcp --dport 3389 -i $WAN -d $IP1 -j DNAT >> --to 192.168.1.2 >> $IPT -t nat -A PREROUTING -p tcp --dport 3389 -i $WAN -d $IP2 -j DNAT >> --to 192.168.1.3 >> $IPT -t nat -A PREROUTING -p tcp --dport 3389 -i $WAN -d $IP3 -j DNAT >> --to 192.168.1.4 >> $IPT -t nat -A PREROUTING -p tcp --dport 3389 -i $WAN -d $IP4 -j DNAT >> --to 192.168.1.5 >> >> >> #Redirect para Servidor PostgreSQL SERVIDOR NOVO >> $IPT -A INPUT -p tcp --dport 5432 -i $WAN -j ACCEPT >> $IPT -A FORWARD -i $WAN -o $LAN -p tcp --dport 5432 -j ACCEPT >> $IPT -t nat -A PREROUTING -p tcp --dport 5432 -i $WAN -d $IP2 -j DNAT >> --to 192.168.1.4 >> >> #Redirect para Servidor FTP >> $IPT -A INPUT -p tcp --dport 21 -i $WAN -j ACCEPT >> $IPT -A FORWARD -i $WAN -o $LAN -p tcp --dport 21 -j ACCEPT >> $IPT -t nat -A PREROUTING -p tcp --dport 21 -i $WAN -d $IP1 -j DNAT --to >> 192.168.1.2 >> >> # Redireciona acessos internos ao $IP1 para o 192.168.1.2 >> $IPT -A INPUT -p tcp --dport 84 -i $LAN -j ACCEPT >> $IPT -A FORWARD -i $LAN -p tcp --dport 84 -j ACCEPT >> $IPT -t nat -A PREROUTING -p tcp --dport 84 -i $LAN -d $IP1 -j DNAT --to >> 192.168.1.2 >> >> # Desabilitando Filtro martian source >> for eee in /proc/sys/net/ipv4/conf/*/rp_filter; do >> echo 0 > $eee >> done >> >> # Libera uso do FTP >> modprobe ip_conntrack_ftp >> modprobe ip_nat_ftp >> iptables -A OUTPUT -p tcp --dport 21 -m state --state >> NEW,ESTABLISHED,RELATED -j ACCEPT >> iptables -A INPUT -p tcp --sport 21 -m state --state >> ESTABLISHED,RELATED -j ACCEPT >> iptables -A INPUT -p tcp --sport 20 -m state --state >> ESTABLISHED,RELATED -j ACCEPT >> iptables -A OUTPUT -p tcp --dport 20 -m state --state >> ESTABLISHED -j ACCEPT >> iptables -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state >> ESTABLISHED -j ACCEPT >> iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state >> ESTABLISHED,RELATED -j ACCEPT >> >> echo "Fim do Firewall." >> >> >> >> >> Em 8 de agosto de 2014 18:38, paulo bruck <[email protected]> >> escreveu: >> >>> mais alguns pontos para vc verificar. o firewall antes de tudo é um >>> roteador. >>> vc setou o ip_forward ? >>> >>> De uma olhada no arquivo /etc/sysctl.conf que normalmente no debian esta >>> linha está comentada. >>> >>> reinicialize ioo seu firewall aos a modificação ou de o comando sysctl >>> -w ou algo assim , estou longe de um terminal... >>> >>> Aproveite e coloque no começo do seu script: >>> >>> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT >>> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT >>> iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT >>> >>> e aproveite para ler este doc que é o melhor que eu já ví até hoje sobre >>> iptables: >>> https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html >>> >>> []s >>> >>> >>> >>> Em 8 de agosto de 2014 14:48, Rudimar <[email protected]> escreveu: >>> >>> tentei, >>>> >>>> $IPT -A FORWARD -i $WAN -o $LAN -p tcp --dport 3389 -j ACCEPT >>>> >>>> $IPT -t nat -A PREROUTING -p tcp --dport 3389 -i $WAN -d $IP1 -j DNAT >>>> --to 192.168.1.2 >>>> $IPT -t filter -A FORWARD -p tcp --dport 3389 -i $WAN -d 192.168.1.2 -j >>>> ACCEPT >>>> >>>> isso certo? mesma coisa... >>>> >>>> >>>> >>>> Em 6 de agosto de 2014 19:35, paulo bruck <[email protected]> >>>> escreveu: >>>> >>>>> Toda regra de NAT obrigatoriamente tem que ter uma regra de FORWARD ( >>>>> se for entre redes....) >>>>> >>>>> $IPT -t nat -A PREROUTING -p tcp --dport 3389 -i $WAN -d $IP3 -j DNAT >>>>> --to 192.168.1.4 >>>>> $IPT -t filter -A FORWARD -p tcp --dport 3389 -i $WAN -d 192.168.1.4 >>>>> -j ACCEPT >>>>> >>>>> >>>>> outra coisa que vc está confundindo é INPUT com FORWARD abaixo: >>>>> # Servicos WAN_to_LAN >>>>> $IPT -A INPUT -p tcp --dport 3389 -i $WAN -j ACCEPT >>>>> $IPT -A FORWARD -i $WAN -o $LAN -p tcp --dport 3389 -j ACCEPT >>>>> >>>>> INPUT é usado quando vc quer acessar algum serviço NO firewall. >>>>> FORWARD é usado quando vc quer acessar serviço entre redes. >>>>> >>>>> >>>>> ats >>>>> >>>>> Paulo Ricardo Bruck >>>>> http://www.contatogs.com.br >>>>> http://www.protejasuarede.com.br >>>>> >>>>> >>>>> >>>>> >>>>> Em 6 de agosto de 2014 19:25, Rudimar <[email protected]> escreveu: >>>>> >>>>> Galera preciso de ajuda, >>>>>> >>>>>> estou tentando fazer um firewall para a rede aqui e preciso de uma >>>>>> ajuda. Para entender, esse é configuração do meu link (x é ip valido, >>>>>> logicamente ocultei botando x): >>>>>> >>>>>> Rede: x.184/29 >>>>>> x.184 - endereço da Rede >>>>>> x.185 - Gateway >>>>>> x.186 - livre para uso >>>>>> x.187 - livre para uso >>>>>> x.188 - livre para uso >>>>>> x.191 - Broadcast >>>>>> Máscara: 255.255.255.248 >>>>>> >>>>>> >>>>>> ---------------------------------- >>>>>> no /etc/network/interfaces botei assim: >>>>>> >>>>>> # Link >>>>>> # The primary network interface >>>>>> allow-hotplug eth0 >>>>>> iface eth0 inet static >>>>>> address x.186 >>>>>> netmask 255.255.255.248 >>>>>> network x.0 >>>>>> broadcast x.191 >>>>>> gateway x.185 >>>>>> >>>>>> #Rede local >>>>>> allow-hotplug eth1 >>>>>> iface eth1 inet static >>>>>> address 192.168.1.100 >>>>>> netmask 255.255.255.0 >>>>>> network 192.168.1.0 >>>>>> broadcast 192.168.1.255 >>>>>> >>>>>> -------------------------- >>>>>> >>>>>> quero direcionar ip/porta especifica para cada servidor, exemplo >>>>>> terminal service >>>>>> >>>>>> ... >>>>>> IPT="/sbin/iptables" >>>>>> REDE="192.168.1.0/24" >>>>>> LAN="eth1" >>>>>> WAN="eth0" >>>>>> IP1="x.186" >>>>>> IP2="x.187" >>>>>> IP3="x.188" >>>>>> >>>>>> >>>>>> ifconfig eth0:0 x.186 netmask 255.255.255.248 >>>>>> ifconfig eth0:1 x.187 netmask 255.255.255.248 >>>>>> ifconfig eth0:2 x.188 netmask 255.255.255.248 >>>>>> >>>>>> >>>>>> # Servicos WAN_to_LAN >>>>>> $IPT -A INPUT -p tcp --dport 3389 -i $WAN -j ACCEPT >>>>>> $IPT -A FORWARD -i $WAN -o $LAN -p tcp --dport 3389 -j ACCEPT >>>>>> >>>>>> # Direciona para cada Servidor >>>>>> $IPT -t nat -A PREROUTING -p tcp --dport 3389 -i $WAN -d $IP1 -j DNAT >>>>>> --to 192.168.1.2 >>>>>> $IPT -t nat -A PREROUTING -p tcp --dport 3389 -i $WAN -d $IP2 -j DNAT >>>>>> --to 192.168.1.3 >>>>>> $IPT -t nat -A PREROUTING -p tcp --dport 3389 -i $WAN -d $IP3 -j DNAT >>>>>> --to 192.168.1.4 >>>>>> >>>>>> ...... >>>>>> >>>>>> >>>>>> O que falta fazer? pois não funciona... >>>>>> >>>>>> se acessar os ips externamente todos caem no firewall... >>>>>> >>>>>> squid.conf é só saída certo? >>>>>> >>>>> >>>>> >>>>> >>>>> -- >>>>> Paulo Ricardo Bruck consultor >>>>> tel 011 3596-4881/4882 011 98140-9184 (TIM) >>>>> http://www.contatogs.com.br >>>>> http://www.protejasuarede.com.br >>>>> gpg AAA59989 at wwwkeys.us.pgp.net >>>>> >>>> >>>> >>> >>> >>> -- >>> Paulo Ricardo Bruck consultor >>> tel 011 3596-4881/4882 011 98140-9184 (TIM) >>> http://www.contatogs.com.br >>> http://www.protejasuarede.com.br >>> gpg AAA59989 at wwwkeys.us.pgp.net >>> >> >> >
