[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Permitir salida por puerto 22 y vpn.

Hola a todos.
Tengo el problema que mi firewall no me deja que salgan los equipos de
mi red para hacer ssh al exterior. Es decir, por el puerto 22.
Tengo redireccionada la entrada por ese puerto hacia uno de los equipos,
y creo que eso es lo que me está liando para permitir la salida por
puerto 22.

¿Como puedo solucionar esto?, y ¿que puerto tengo que habilitar para
permitir la salida de un equipo por una vpn?.

Os pego el script 

Saludos y gracias.
Pablo.

#!/bin/bash

case "$1" in
	start)
			
		#Limpieza de reglas.
		echo -n "Limpiando reglas iptables: "
		iptables -F
		iptables -X
		iptables -Z
		iptables -t nat -F
		echo "hecho."
		
		#Cargando modulos.
		echo -n "Cargando modulos: "
		/sbin/depmod -a
		modprobe ip_tables
		modprobe ip_conntrack
		modprobe iptable_filter
		modprobe iptable_nat
		modprobe ipt_state
		modprobe ipt_MASQUERADE
		modprobe ipt_LOG
		modprobe ip_nat_irc
		echo "hecho."		


		#Forwarding.
		echo -n "Activando forwarding: "
		echo "1"> /proc/sys/net/ipv4/ip_forward
		echo "hecho."
		
		#Política por defecto.
		echo -n "Aplicando política: "
		iptables -P INPUT DROP
		iptables -P OUTPUT DROP
		iptables -P FORWARD DROP
		echo "hecho."
		
		#NAT
		echo -n "Activando NAT: "
		iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
		echo "hecho."
		
		#Acceso		

		#DNS.
		echo -n "Consulta a dns: "
		iptables -A INPUT -i eth0 -s 62.42.230.24 -p udp -m state --state
ESTABLISHED --sport 53 -j ACCEPT
		iptables -A INPUT -i eth0 -s 62.42.63.52 -p udp -m state --state
ESTABLISHED  --sport 53 -j ACCEPT
		iptables -A INPUT -i eth0 -s 212.95.216.62 -p udp -m state --state
ESTABLISHED --sport 53 -j ACCEPT		

		iptables -A OUTPUT -o eth0 -d 62.42.230.24 -p udp -m state --state
NEW,ESTABLISHED,RELATED --dport 53 -j ACCEPT
		iptables -A OUTPUT -o eth0 -d 62.42.63.52 -p udp -m state --state
NEW,ESTABLISHED,RELATED --dport 53 -j ACCEPT
		iptables -A OUTPUT -o eth0 -d 212.95.216.62 -p udp -m state --state
NEW,ESTABLISHED,RELATED --dport 53 -j ACCEPT

		iptables -A FORWARD -i eth0 -s 62.42.230.24 -p udp -m state --state
ESTABLISHED --sport 53 -j ACCEPT
		iptables -A FORWARD -i eth0 -s 62.42.63.52 -p udp -m state --state
ESTABLISHED --sport 53 -j ACCEPT
		iptables -A FORWARD -i eth0 -s 212.95.216.62 -p udp -m state --state
ESTABLISHED --sport 53 -j ACCEPT

		iptables -A FORWARD -o eth0 -d 62.42.230.24 -p udp -m state --state
NEW,ESTABLISHED,RELATED --dport 53 -j ACCEPT
		iptables -A FORWARD -o eth0 -d 62.42.63.52 -p udp -m state --state
NEW,ESTABLISHED,RELATED --dport 53 -j ACCEPT
		iptables -A FORWARD -o eth0 -d 212.95.216.62 -p udp -m state --state
NEW,ESTABLISHED,RELATED --dport 53 -j ACCEPT
		echo "hecho."

		#ICMP
		echo -n "Permitendo echo request: "
		iptables -A INPUT -i eth0 -p icmp -j ACCEPT
		iptables -A OUTPUT -o eth0 -p icmp -j ACCEPT 

		iptables -A FORWARD -i eth0 -p icmp -j ACCEPT
		iptables -A FORWARD -o eth0 -p icmp -j ACCEPT
		echo "hecho."
		
		#Conexión a Internet.
		echo -n "Activando acceso a Internet: "
		iptables -A INPUT -i eth0 -p tcp -s 0.0.0.0/0 -d 192.168.0.0/24
--sport 80 -m state --state ESTABLISHED -j ACCEPT
		iptables -A OUTPUT -o eth0 -p tcp -s 192.168.0.0/24 -d 0.0.0.0/0
--dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

		iptables -A INPUT -i eth0 -p tcp -s 0.0.0.0/0 -d 192.168.0.0/24
--sport 443 -m state --state ESTABLISHED -j ACCEPT
		iptables -A OUTPUT -o eth0 -p tcp -s 192.168.0.0/24 -d 0.0.0.0/0
--dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT

		iptables -A FORWARD -i eth0 -p tcp -s 0.0.0.0/0 -d 192.168.0.0/24
--sport 80 -m state --state ESTABLISHED -j ACCEPT
		iptables -A FORWARD -o eth0 -p tcp -s 192.168.0.0/24 -d 0.0.0.0/0
--dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

		iptables -A FORWARD -i eth0 -p tcp -s 0.0.0.0/0 -d 192.168.0.0/24
--sport 443 -m state --state ESTABLISHED -j ACCEPT
		iptables -A FORWARD -o eth0 -p tcp -s 192.168.0.0/24 -d 0.0.0.0/0
--dport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

		echo "hecho."

		#ssh exterior al server.
		echo -n "Activando redireccionamiento conexión ssh al server: "
		iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 22 -m state
--state ESTABLISHED -j DNAT --to 192.168.0.2:22
		iptables -t nat -A POSTROUTING -o eth0 -p tcp --sport 22 -m state
--state NEW,ESTABLISHED,RELATED -j ACCEPT
		iptables -A FORWARD -i eth0 -p tcp --dport 22 -m state --state
ESTABLISHED -j ACCEPT
		iptables -A FORWARD -o eth0 -p tcp --sport 22 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
		echo "hecho."
		
		#ssh interno.
		echo -n "Activando ssh interno: "
		iptables -A INPUT -i eth0 -p tcp -d 192.168.0.0/24 -s 0.0.0.0/0
--dport 22 -m state --state ESTABLISHED -j ACCEPT
		iptables -A OUTPUT -o eth0 -p tcp -d 0.0.0.0/0 -s 192.168.0.0/24
--sport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

		iptables -A FORWARD -i eth0 -p tcp -d 192.168.0.0/24 -s 0.0.0.0/0
--dport 22 -m state --state ESTABLISHED -j ACCEPT
		iptables -A FORWARD -o eth0 -p tcp -d 0.0.0.0/0 -s 192.168.0.0/24
--sport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
		echo "hecho."	

		#CVS
		echo -n "Activando ssh para cvs: "
		iptables -A INPUT -i eth0 -p tcp -s 0.0.0.0/0 -d 192.168.0.0/24
--dport 22 -m state --state ESTABLISHED -j ACCEPT
		iptables -A OUTPUT -o eth0 -p tcp -s 192.168.0.0/24 -d 0.0.0.0/0
--sport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
		
		iptables -A FORWARD -i eth0 -p tcp -s 0.0.0.0/0 -d 192.168.0.0/24
--dport 22 -m state --state ESTABLISHED -j ACCEPT
		iptables -A FORWARD -o eth0 -p tcp -s 192.168.0.0/24 -d 0.0.0.0/0
--sport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
		echo "hecho."
		
		#Conexión mail
		echo -n "Aceptando conexiones mail: "
		iptables -A INPUT -i eth0 -p tcp --sport 25 -m state --state
ESTABLISHED -j ACCEPT
		iptables -A OUTPUT -o eth0 -p tcp --dport 25 -m state --state
NEW,ESTABLISHED -j ACCEPT
		
		iptables -A INPUT -i eth0 -p tcp --sport 110 -m state --state
ESTABLISHED -j ACCEPT
		iptables -A OUTPUT -o eth0 -p tcp --dport 110 -m state --state
NEW,ESTABLISHED -j ACCEPT
		
		iptables -A FORWARD -i eth0 -p tcp --sport 25 -m state --state
ESTABLISHED -j ACCEPT
		iptables -A FORWARD -o eth0 -p tcp --dport 25 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
		
		iptables -A FORWARD -i eth0 -p tcp --sport 110 -m state --state
ESTABLISHED -j ACCEPT		
		iptables -A FORWARD -o eth0 -p tcp --dport 110 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
		echo "hecho."

		#msn
		echo -n "Abriendo puerto para messenger: "
		iptables -A INPUT -i eth0 -p tcp --sport 1863 -m state --state
ESTABLISHED -j ACCEPT
		iptables -A OUTPUT -o eth0 -p tcp --dport 1863 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
		
		iptables -A FORWARD -i eth0 -p tcp --sport 1863 -m state --state
ESTABLISHED -j ACCEPT
		iptables -A FORWARD -o eth0 -p tcp --dport 1863 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
		echo "hecho."
		
		#Jabber
		echo -n "Abriendo puerto para Jabber: "
		iptables -A INPUT -i eth0 -p tcp --sport 5222 -m state --state
ESTABLISHED -j ACCEPT
		iptables -A OUTPUT -o eth0 -p tcp --dport 5222 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
		
		iptables -A FORWARD -i eth0 -p tcp --sport 5222 -m state --state
ESTABLISHED -j ACCEPT
		iptables -A FORWARD -o eth0 -p tcp --dport 5222 -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
		echo "hecho."
		
	
		#Cerrar 
		echo -n "Cerrando conexiones no necesarias: "
		iptables -A INPUT -i eth0 -m state --state NEW,INVALID -j DROP
		#iptables -A INPUT -i eth1 -m state --state NEW,INVALID -j DROP
		
		iptables -A OUTPUT -o eth0 -m state --state NEW,INVALID -j DROP
		#iptables -A OUTPUT -o eth1 -m state --state NEW,INVALID -j DROP
		
		iptables -A FORWARD -i eth0 -m state --state NEW,INVALID -j DROP
		#iptables -A FORWARD -i eth1 -m state --state NEW,INVALID -j DROP
		echo "hecho."
		;;
		
	stop)
		echo -n "Parando el firewall: "
		iptables -F INPUT
		iptables -F OUTPUT
		iptables -F FORWARD
		iptables -F
		iptables -t nat -F
		echo "hecho."
		;;
		
	restart)
		$0 stop
		echo -n "Reiniciando el firewall: "
		sleep 2
		$0 start
		echo "hecho."
		;;
		
	status)
		iptables -L -n
		;;
	*)
		echo "usar: $0 {start|stop|restart|status}"
		exit 1
esac
exit 0

Attachment: signature.asc
Description: Esta parte del mensaje =?ISO-8859-1?Q?est=E1?= firmada digitalmente

Reply to: