bom galera, tentei as dicas mas não foi, não sei o que pode ser,
vou postar meu script fica mais fácil,
#!/bin/bash
modprobe iptable_nat
modprobe iptable_filter
modprobe ipt_LOG
modprobe ipt_state
modprobe ipt_limit
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
IPT="/sbin/iptables"
REDE="
192.168.1.0/24"
LAN="eth1"
WAN="eth0"
IP1="x.186"
IP2="x.187"
IP3="x.188"
IP4="x.189"
# Seta IPs nas interfaces virtuais
ifconfig eth0:0 x.186 netmask 255.255.255.0
ifconfig eth0:1 x.187 netmask 255.255.255.0
ifconfig eth0:2 x.188 netmask 255.255.255.0
ifconfig eth0:2 x.189 netmask 255.255.255.0
# Arquivos de portas liberadas
PT_TCP="/etc/squid/PT_TCP"
PT_UDP="/etc/squid/PT_UDP"
# Limpando Regras existentes
$IPT -F
$IPT -Z
$IPT -t nat -F
$IPT -t mangle -F
$IPT -t filter -F
$IPT -t nat -Z
$IPT -t mangle -Z
$IPT -t filter -Z
echo "Regras Zeradas."
# Definindo Politicas Padrão
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT ACCEPT
# Habilitanto NAT
$IPT -t nat -A POSTROUTING -o $WAN -j MASQUERADE
# Liberando Input loopback
$IPT -A INPUT -i lo -j ACCEPT
# Ativa Proxy Transparente
$IPT -t nat -A PREROUTING -i $LAN -s $REDE -p tcp --dport 80 -j REDIRECT --to-port 3128
# Forca o uso do proxy
#$IPT -t nat -A PREROUTING -i $LAN -p tcp --dport 80 -j DNAT --to
192.168.0.253:80
# Liberando Conexoes Estabelecidas pela LAN
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
# Libera Resposta a ping WAN
$IPT -A INPUT -p icmp -i $WAN -j ACCEPT
######### Libera Acessos LAN_to_WAN #########
$IPT -A FORWARD -i $LAN -o $WAN -p icmp -j ACCEPT
for i in `cat $PT_TCP`; do
$IPT -A FORWARD -i $LAN -o $WAN -p tcp --dport $i -j ACCEPT
done
for i in `cat $PT_UDP`; do
$IPT -A FORWARD -i $LAN -o $WAN -p udp --dport $i -j ACCEPT
done
# Bloqueia IPs
#IPT -A INPUT -s 81.35.253.20 -j DROP
# Libera Porta para fora
#$IPT -A FORWARD -i $LAN -s 192.168.1.119 -o $WAN -p tcp --dport 5432 -j ACCEPT
# Libera PC Acesso geral LAN_to_WAN
#$IPT -A FORWARD -i $LAN -o $WAN -s 192.168.1.219 -j ACCEPT
# Acessos LAN_to_Server
$IPT -A INPUT -p icmp -i $LAN -s $REDE -j ACCEPT
$IPT -A INPUT -p tcp --dport 53 -i $LAN -s $REDE -j ACCEPT
$IPT -A INPUT -p udp --dport 53 -i $LAN -s $REDE -j ACCEPT
$IPT -A INPUT -p tcp --dport 80 -i $LAN -s $REDE -j ACCEPT
$IPT -A INPUT -p tcp --dport 3128 -i $LAN -s $REDE -j ACCEPT
$IPT -A INPUT -p tcp --dport 2222 -i $LAN -s $REDE -j ACCEPT
# Servicos WAN_to_Server
$IPT -A INPUT -p tcp --dport 2222 -i $WAN -j ACCEPT
$IPT -A INPUT -p tcp --dport 80 -i $WAN -j ACCEPT
$IPT -A INPUT -p tcp --dport 3128 -i $WAN -j ACCEPT
# Servicos WAN_to_LAN
$IPT -A INPUT -p tcp --dport 3389 -i $WAN -j ACCEPT
$IPT -A FORWARD -i $WAN -o $LAN -p tcp --dport 3389 -j ACCEPT
$IPT -t nat -A PREROUTING -p tcp --dport 3389 -i $WAN -d $IP1 -j DNAT --to 192.168.1.2
$IPT -t nat -A PREROUTING -p tcp --dport 3389 -i $WAN -d $IP2 -j DNAT --to 192.168.1.3
$IPT -t nat -A PREROUTING -p tcp --dport 3389 -i $WAN -d $IP3 -j DNAT --to 192.168.1.4
$IPT -t nat -A PREROUTING -p tcp --dport 3389 -i $WAN -d $IP4 -j DNAT --to 192.168.1.5
#Redirect para Servidor PostgreSQL SERVIDOR NOVO
$IPT -A INPUT -p tcp --dport 5432 -i $WAN -j ACCEPT
$IPT -A FORWARD -i $WAN -o $LAN -p tcp --dport 5432 -j ACCEPT
$IPT -t nat -A PREROUTING -p tcp --dport 5432 -i $WAN -d $IP2 -j DNAT --to 192.168.1.4
#Redirect para Servidor FTP
$IPT -A INPUT -p tcp --dport 21 -i $WAN -j ACCEPT
$IPT -A FORWARD -i $WAN -o $LAN -p tcp --dport 21 -j ACCEPT
$IPT -t nat -A PREROUTING -p tcp --dport 21 -i $WAN -d $IP1 -j DNAT --to 192.168.1.2
# Redireciona acessos internos ao $IP1 para o 192.168.1.2
$IPT -A INPUT -p tcp --dport 84 -i $LAN -j ACCEPT
$IPT -A FORWARD -i $LAN -p tcp --dport 84 -j ACCEPT
$IPT -t nat -A PREROUTING -p tcp --dport 84 -i $LAN -d $IP1 -j DNAT --to 192.168.1.2
# Desabilitando Filtro martian source
for eee in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 0 > $eee
done
# Libera uso do FTP
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
iptables -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
echo "Fim do Firewall."