Scribd
Upload
4 views2 pages

Iptables Firewall Configuration Script

This script configures iptables firewall rules to allow access between internal networks and the internet, as well as port forwarding. It sets default policies to drop all INPUT, OUTPUT, and FORWARD traffic and adds rules to allow established connections and ping. It also defines NAT rules for internet access and port forwarding between internal and external IP addresses.

Uploaded by

Vitor Alves
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
4 views2 pages

Iptables Firewall Configuration Script

This script configures iptables firewall rules to allow access between internal networks and the internet, as well as port forwarding. It sets default policies to drop all INPUT, OUTPUT, and FORWARD traffic and adds rules to allow established connections and ping. It also defines NAT rules for internet access and port forwarding between internal and external IP addresses.

Uploaded by

Vitor Alves
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd

#!

/bin/bash
IPT=/sbin/iptables
LAN="[Link]/24"
FILIAL="[Link]/24"
CLI="1024:65535"
inicia() {
# define politica padrao
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP
# ativa tratamento de estados
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# libera ping local
$IPT -A OUTPUT \
-p icmp \
-s [Link] \
-d [Link] \
-j ACCEPT
# acesso LAN a Internet
$IPT -A FORWARD -m state --state NEW \
-p tcp -i eth1 -o eth0 \
-s $LAN --sport $CLI \
-d 0/0 --dport 80 \
-j ACCEPT
$IPT -A FORWARD -m state --state NEW \
-p tcp -i eth1 -o eth0 \
-s $LAN --sport $CLI \
-d 0/0 --dport 443 \
-j ACCEPT
# acesso FILIAL a Internet
$IPT -A FORWARD -m state --state NEW \
-p tcp -i eth2 -o eth0 \
-s $FILIAL --sport $CLI \
-d 0/0 --dport 80 \
-j ACCEPT
$IPT -A FORWARD -m state --state NEW \
-p tcp -i eth2 -o eth0 \
-s $FILIAL --sport $CLI \
-d 0/0 --dport 443 \
-j ACCEPT
# acesso das maquinas ao DCTF
$IPT -A FORWARD -m state --state NEW \
-p tcp -i eth1 -o eth0 \
-s $LAN --sport $CLI \
-d 0/0 --dport 4567 \
-j ACCEPT
# recibo de entrega do DCTF
$IPT -A FORWARD -m state --state NEW \
-p tcp -i eth0 -o eth1 \
-d [Link] --dport 20000:20019 \
-j ACCEPT
$IPT -A FORWARD -m state --state NEW \
-p tcp -i eth0 -o eth1 \
-d [Link] --dport 20000:20019 \
-j ACCEPT
# faz o NAT de saida dos acessos Internet
$IPT -t nat -A POSTROUTING \
-p tcp -o eth0 \
--dport 80 \
-j MASQUERADE
$IPT -t nat -A POSTROUTING \
-p tcp -o eth0 \
--dport 443 \
-j MASQUERADE
# faz o NAT de saida do DCTF
$IPT -t nat -A POSTROUTING \
-p tcp -o eth0 \
-s [Link] \
--dport 4567
\
-j SNAT --to [Link]
# nat de entrada correspondente
$IPT -t nat -A PREROUTING \
-p tcp -i eth0 \
-d [Link] --dport 20000
:20019 \
-j DNAT --to [Link]
# faz o NAT de saida do DCTF
$IPT -t nat -A POSTROUTING \
-p tcp -o eth0 \
-s [Link] \
--dport 4567
\
-j SNAT --to [Link]
# nat de entrada correspondente
$IPT -t nat -A PREROUTING \
-p tcp -i eth0 \
-d [Link] --dport 20000
:20019 \
-j DNAT --to [Link] }
para()
{
# apaga regras da tabela filter
$IPT -F
# relaxa a politica padrao
$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
}
case
"$1
" in
"start"
)
inicia
;;
"stop"
)
para
;;
esac

You might also like