Bueno, este es un script Router/Firewall q' diseñe yo mismo para un tarrito q' tengo en la casa administrando la red y ademas sirviendo web, ftp y ssh.
#!/bin/sh
#Firewall y Router Casa
#By Pwn-BoFH (CC)
startFirewall() {
echo "INICIANDO MODULOS..."
$MOD ip_tables
$MOD ip_conntrack
$MOD ipt_LOG
$MOD ipt_limit
$MOD ipt_state
$MOD ip_conntrack_ftp
$MOD ip_conntrack_irc
$MOD iptable_filter
$MOD iptable_nat
$MOD iptable_mangle
echo "INICIANDO FIREWALL... "
$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -s 192.168.10.0/24 -i $LAN -j ACCEPT
$IPT -A FORWARD -s 192.168.10.0/24 -i $LAN -j ACCEPT
$IPT -A INPUT --match limit --limit 5/second --limit-burst 5 -p icmp --icmp-type echo-request -j ACCEPT
$IPT -A INPUT -s 0.0.0.0/0 -p tcp --dport 80 -j ACCEPT
$IPT -A INPUT -s 0.0.0.0/0 -p tcp --dport 443 -j ACCEPT
$IPT -A INPUT -s 0.0.0.0/0 -p tcp --dport 21 -j ACCEPT
$IPT -A INPUT -s 0.0.0.0/0 -p tcp --dport 22 -j ACCEPT
$IPT -A INPUT -s 0.0.0.0/0 -s $WAN -p tcp --dport 1:1024 -j DROP
$IPT -A INPUT -s 0.0.0.0/0 -s $WAN -p udp --dport 1:1024 -j DROP
$IPT -A FORWARD -s 192.168.10.0/24 -i $LAN -d 0.0.0.0/0 -o $WAN -j ACCEPT
$IPT -A FORWARD -s 192.168.10.0/24 -i $LAN -d 0.0.0.0/0 -o $LAN -j ACCEPT
$IPT -t nat -A POSTROUTING -s 192.168.10.0/24 -o $WAN -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "Firewall & Router, iniciados correctamente... "
}
stopFirewall() {
echo "FLUSHING TABLAS... "
$IPT -t filter -F
$IPT -t filter -X
$IPT -t filter -P INPUT ACCEPT
$IPT -t filter -P OUTPUT ACCEPT
$IPT -t filter -P FORWARD ACCEPT
$IPT -t nat -F
$IPT -t nat -X
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -t mangle -P INPUT ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P POSTROUTING ACCEPT
}
action="$1"
IPT="/sbin/iptables"
MOD="/sbin/modprobe"
WAN="ppp0"
LAN="eth1"
if [ "$1" = "" ]; then
echo "Uso: sh firewall.sh { start | stop | restart }"
exit 1
fi
case $action in
start)
stopFirewall
startFirewall
;;
stop)
stopFirewall
;;
restart)
stopFirewall
startFirewall
;;
*)
echo "Argumento invalido!
Uso: sh firewall.sh { start | stop | restart }"
;;
esac
Cualquier duda, error q' vean uo aporte q' tengan con respecto al Script, porfavor aganla.
GL and GH
Autor