Regras Básicas "IPTABLES"
Autor: Ubuntu Net | Publicado: 2011-06-24T07:20:00-07:00

Nesse tutorial, vamos fazer um script para implantação de um firewall simples com regras básicas do iptables:

Para começar vamos abrir o terminal, dê o comando Alt+F2 e digite "gnome-terminal" ou se estiver no Kubuntu "konsole" (sem aspas);

Escolha um local para a criação do arquivo, por padrão colocaremos no diterório raiz mais se você quiser pode deixá-lo em qualquer lugar do disco basta lembrar onde ele está para poder executá-lo;

&nbsp; cd /

Agora com o editor de texto vim (ou qualquer outro editor), vamos fazer o arquivo que será o nosso script;

&nbsp; vim firewall.sh

Dentro do editor coloque as seguintes linhas;

&nbsp; #!/bin/bash
case&nbsp;&nbsp;&nbsp; $1&nbsp;&nbsp;&nbsp; instart)
echo&nbsp; "Iniciando..." 
echo -n " Limpando as tabelas... " 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -F INPUT
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -F OUTPUT
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -F FORWARD
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; iptables -t nat -F POSTROUTING
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -t nat -F PREROUTING
echo "Ok"

echo -n "Bloqueando tudo nas tabelas INPUT, OUTPUT e FORWARD... "
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -P INPUT DROP
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -P OUTPUT DROP
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -P FORWARD DROP
echo "Ok"

echo -n "Liberando a interface de loopback... "
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -A INPUT -i lo -j ACCEPT
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -A OUTPUT -o lo -j ACCEPT
echo "OK" 

echo -n "Aceita o ping... "
&nbsp;&nbsp; iptables -A INPUT -i eth0 -p icmp -m limit --limit 2/s -j ACCEPT
echo "OK"

echo -n "Fornecer as conexões estabelecidas e relacionadas... "
&nbsp;&nbsp; iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
echo "OK"

echo -n "Permitir todas as conexões validas de saida... " 
&nbsp;iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
echo "OK"

echo -n "Liberando portas BIND9 e SSH... "
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PORTAS="53 22"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; for&nbsp;&nbsp; i&nbsp;&nbsp; in $PORTAS;do
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -I INPUT -p tcp --dport $i -j ACCEPT
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; iptables -I OUTPUT -p tcp --sport $i -j ACCEPT 
done 
echo "Ok"

echo -n "Mascarando a rede usando o NAT... "
echo 1 &gt; /proc/sys/net/ipv4/ip_forward &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -I FORWARD -s 192.168.0.0/24 -i eth1 -o eth0 -j ACCEPT
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -I FORWARD -d 192.168.0.0/24 -o eth1 -i eth0 -j ACCEPT
echo "Ok"
;;stop)echo -n "Limpando as Regras... "
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -F INPUT
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -F OUTPUT
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -F FORWARD
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; iptables -t nat -F POSTROUTING
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -t nat -F PREROUTING
echo "Ok"

echo -n "Aceitando tudo nas tabelas... "
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -P INPUT ACCEPT
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -P OUTPUT ACCEPT
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; iptables -P FORWARD ACCEPT
echo "Ok"
;;esac
Saia salvando;
Depois dê a permissão para a executar;

chmod +x firewall.sh

Depois execute-o;

./firewall.sh start

Isso fará que o script funcione de acordo com suas regras.
Se caso deseje pará-lo dê o comando acima substituindo por stop;

./firewall.sh stop

Obs. "echo -n" serve para retornar uma mensagem em caso de erro, para consultar se as regras estão funcionando basta da o comando iptables -L
Vale lembrar que são apenas regras simples e no próximo tutorial mostraremos como colocar o firewall.sh para iniciar junto com o sistema.