Minha configura��o do iptables eu colei abaixo. O rc.firewall completo, as linhas que coloquei est�o na parte de PREROUTING. estou colando ela abaixo. Bom, essa linha est� mais do que batida pela internet, eu tudo que � documenta��o aparece essa mesma linha... O que quero � o seguinte, tudo que for da rede, e n�o seja do IP 192.168.1.57 ( Squid ) envie para o SQUID.
Onde aparece SPEEDY � o ip fixo do Speedy que nem rola eu publicar na rede... :P
$IPTABLES -t nat -I PREROUTING -s ! 192.168.1.57 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.57:3128
Bom, coloquei na parte do script respons�vel pela CHAIN de PREROUTING, por�m sem sucesso. Alg�em tem alguma luz? :(
Valeu !
Fernando Lujan
A tabela de roteamento da m�quina segue:
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
SPEEDY * 255.255.255.192 U 40 0 0 eth0
192.168.1.0 * 255.255.255.0 U 40 0 0 eth1
192.168.0.0 * 255.255.255.0 U 40 0 0 eth2
127.0.0.0 * 255.0.0.0 U 40 0 0 lo
default SPEEDY 0.0.0.0 UG 40 0 0 eth0
Script Firewall:
#!/bin/sh
LAN_IP_RANGE="192.168.1.0/255.255.255.0" LAN_IP="192.168.1.1/255.255.255.0" LAN_BCAST_ADRESS="192.168.1.255/255.255.255.0" LOCALHOST_IP="127.0.0.1/255.255.255.0" STATIC_IP="IP DO SPEEDY/255.255.255.0"
INET_IFACE="eth0" LAN_IFACE="eth1" DMZ_IFACE="eth2" DMZ_IP="192.168.0.100"
IPTABLES="/usr/sbin/iptables"
######### # Load all required IPTables modules #
# # Needed to initially load modules # /sbin/depmod -a
# # Adds some iptables targets like LOG, REJECT and MASQUARADE. # /sbin/modprobe ipt_LOG /sbin/modprobe ipt_REJECT /sbin/modprobe ipt_MASQUERADE
# # Support for owner matching # /sbin/modprobe ipt_owner
# # Support for connection tracking of FTP and IRC. # /sbin/modprobe ip_conntrack_ftp #/sbin/modprobe ip_conntrack_irc
#CRITICAL: Enable IP forwarding since it is disabled by default. # echo "1" > /proc/sys/net/ipv4/ip_forward
# Dynamic IP users:
#
# If you get your IP address dynamically from SLIP, PPP, or DHCP, enable this
# option. This enables dynamic-ip address hacking in IP MASQ, making the connection
# with Diald and similar programs much easier.
#
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
# Enable simple IP FORWARDing and Masquerading # # NOTE: The following is an example for an internal LAN, where the lan # runs on eth1, and the Internet is on eth0. # # Please change the network devices to match your own configuration. #
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -o $DMZ_IFACE -j MASQUERADE
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "
# # set default policies for the INPUT, FORWARD and OUTPUT chains #
#$IPTABLES -P INPUT DROP #$IPTABLES -P OUTPUT DROP #$IPTABLES -P FORWARD DROP
# # Create separate chains for ICMP, TCP and UDP to traverse #
$IPTABLES -N icmp_packets $IPTABLES -N tcp_packets $IPTABLES -N udpincoming_packets
# # the allowed chain for TCP connections # # This chain will be utilised if someone tries to connect to an allowed # port from the internet. If they are opening the connection, or if it's # already established we ACCEPT the packages, if not we fuck them. This is # where the state matching is performed also, we allow ESTABLISHED and # RELATED packets.
$IPTABLES -N allowed $IPTABLES -A allowed -p TCP --syn -j ACCEPT $IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A allowed -p TCP -j DROP
# # ICMP rules #
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 0 -j ACCEPT $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 3 -j ACCEPT $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 5 -j ACCEPT $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
# # TCP rules #
#$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 143 -j allowed $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 5432 -j allowed $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 8080 -j allowed $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 139 -j allowed
#$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 2121 -j allowed
# # UDP ports # #dns #$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT #ntp #$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 123 -j ACCEPT #???? #$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 2074 -j ACCEPT #???? #$IPTABLES -A udpincoming_packets -p UDP -s 0/0 --source-port 4000 -j ACCEPT
#
# PREROUTING chain.
#
# Do some checks for obviously spoofed IP's
#
#Squid
$IPTABLES -t nat -I PREROUTING -s ! 192.168.1.57 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.57:3128
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 192.168.0.0/16 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 10.0.0.0/8 -j DROP $IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 172.16.0.0/12 -j DROP
# # INPUT chain # # establish the basic INPUT chain and filter the packets onto the correct # chains. #
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets $IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets $IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udpincoming_packets
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_BCAST_ADRESS -j ACCEPT
$IPTABLES -A INPUT -p ALL -d $LOCALHOST_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -d $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -d $STATIC_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "
# # OUTPUT chain # # establish the basic OUTPUT chain and filter them onto the correct chain #
$IPTABLES -A OUTPUT -p ALL -s $LOCALHOST_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $STATIC_IP -j ACCEPT
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "
/sbin/modprobe ip_nat_ftp -- GUS-BR - Grupo de Usuarios Slackware - BR http://www.slackwarebrasil.org/ http://www.linuxmag.com.br/mailman/listinfo/slack-users
