Re: Firewall

Em 19/08/07, Leandro Moreira < leandro@leandromoreira.eti.br> escreveu:

Caros,
Estou revendo meu script de firewall, gostaria da opnião da lista a
respeito das regras abaixo, se elas ainda estão em uso ou se já não são
mais necessárias

# -------------------------------------------------------
# Definindo variáveis
# -------------------------------------------------------
iptables="/sbin/iptables"
IF_EXTERNA="ppp0"
IF_INTERNA="eth1"
#########################################################
# Algumas protecoes contra determinados ataques
########################################################

# -------------------------------------------------------
# Dropa pacotes TCP indesejaveis
# -------------------------------------------------------

$iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP

# Dropa pacotes mal formados
# -------------------------------------------------------

#$iptables -A INPUT -i $IF_EXTERNA -m unclean -j DROP

# Protecao contra trinoo
# -------------------------------------------------------
$iptables -N TRINOO
$iptables -A TRINOO -j DROP
$iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 27444 -j TRINOO
$iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 27665 -j TRINOO
$iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 31335 -j TRINOO
$iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 34555 -j TRINOO
$iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 35555 -j TRINOO

# Protecao contra tronjans
# -------------------------------------------------------
$iptables -N TROJAN
$iptables -A TROJAN -j DROP
$iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 666 -j TROJAN
$iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 666 -j TROJAN
$iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 4000 -j TROJAN
$iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 6000 -j TROJAN
$iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 6006 -j TROJAN
$iptables -A INPUT -p TCP -i $IF_EXTERNA --dport 16660 -j TROJAN

# Protecao contra worms
# -------------------------------------------------------
$iptables -A FORWARD -p tcp --dport 135 -i $IF_INTERNA -j REJECT

# Protecao contra syn-flood
# -------------------------------------------------------
$iptables -A FORWARD -p tcp --syn -m limit --limit 2/s -j ACCEPT

# Protecao contra ping da morte
# -------------------------------------------------------
$iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit
1/s -j ACCEPT

# Protecao contra port scanners
# -------------------------------------------------------
$iptables -N SCANNER
$iptables -A SCANNER -j DROP
$iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -i $IF_EXTERNA -j
SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL NONE -i $IF_EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL ALL -i $IF_EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL FIN,SYN -i $IF_EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -i
$IF_EXTERNA -j SCANNER
$iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -i $IF_EXTERNA -j
SCANNER
$iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -i $IF_EXTERNA -j
SCANNER
##################### END OF FILE ######################

Att.

--
Leandro Moreira
Linux Networking
Telefone: +55 (32) 9197-7909
E-mail/MSN: leandro@leandromoreira.eti.br
www.leandromoreira.eti.br

--
To UNSUBSCRIBE, email to debian-user-portuguese-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org