#Exercicio T6

#Para cada linha das abaixo, inserir um comentario explicando o objetivo e o efe
ito do comando.
#Preste atencao em cada um dos parametros, todos sempre tem significado (os para
metros sao case sensitive)
#
#Enviar este arquivo com os comentrios e o nome
#Subject: SENAC2014 - FVI - T6 - Nome Completo
#!/bin/sh
IPT=/sbin/iptables
INET_IFACE="eth0" //SELECIONA INTERFACE
INET_ADDRESS="245.245.245.245" //DEFINE IP DA INTERFACE, NESTE CASO EXT
ERNA
LOCAL_IFACE="eth1" //SELECIONA INTERFACE
LOCAL_IP="192.168.5.240" //DEFINE IP DA INTERFACE, NESTE CASO INT
ERNA
LOCAL_NET="192.168.5.0/24" //DEFINE ENDEREAMENTO DA REDE LOCAL
$IPT -F INPUT //LIMPA CHAINS DAS TABELAS
$IPT -F OUTPUT //LIMPA CHAINS DAS TABELAS
$IPT -F FORWARD //LIMPA CHAINS DAS TABELAS
$IPT -F -t nat //LIMPA CHAINS DAS TABELAS
$IPT -P INPUT DROP //DETERMINA POLTICA PADRO
$IPT -P OUTPUT DROP //DETERMINA POLTICA PADRO
$IPT -P FORWARD DROP //DETERMINA POLTICA PADRO
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X
$IPT -A INPUT -i $INET_IFACE -p icmp --icmp-type 0 -j ACCEPT
$IPT -A INPUT -i $INET_IFACE -p icmp --icmp-type 8 -j ACCEPT
$IPT -A INPUT -i $INET_IFACE -p icmp --icmp-type 11 -j ACCEPT
$IPT -A OUTPUT -p icmp --icmp-type 0 -j ACCEPT
$IPT -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
$IPT -A OUTPUT -p icmp --icmp-type 11 -j ACCEPT
$IPT -A INPUT -i $INET_IFACE -p udp --dport 53 -j ACCEPT
$IPT -A OUTPUT -p udp --sport 53 -j ACCEPT
$IPT -A INPUT -i $INET_IFACE -m state -p tcp --dport 1024:65535 --state ESTABLIS
HED,RELATED -j ACCEPT
$IPT -A OUTPUT -m state -p tcp --sport 1024:65535 ! --state INVALID -j ACCEPT
$IPT -A INPUT -i $INET_IFACE -m state -p tcp -s 245.245.0.0/16 --dport 22 ! --s
tate INVALID -j ACCEPT
$IPT -A OUTPUT -m state -p tcp --sport 22 --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -s 127.0.0.1 -i lo -j ACCEPT
$IPT -A OUTPUT -d 127.0.0.1 -o lo -j ACCEPT
$IPT -A INPUT -s $LOCAL_NET -i $LOCAL_IFACE -j ACCEPT
$IPT -A OUTPUT -d $LOCAL_NET -o $LOCAL_IFACE -j ACCEPT
$IPT -A FORWARD -p ALL -i $LOCAL_IFACE -j ACCEPT
$IPT -A FORWARD -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_ADDRESS
$IPT -A INPUT -p tcp ! -syn -m state --state NEW -j DROP
$IPT -f -j DROP
$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
$IPT -A INPUT -p tcp --tcp-flags FIN, PSH, URG FIN, PSH, URG -j DROP
$IPT -A INPUT -s 127.0.0.1 -i $INET_IFACE -j DROP
$IPT -A INPUT -j LOG
$IPT -A OUTPUT -j LOG
http://www.aboutdebian.com/firewall.htm
http://centosbr.org/modules/newbb/viewtopic.php?topic_id=2718