Script de inicialización de suse ubicado en /etc/init.d/firewall
# cat /etc/init.d/firewall
### BEGIN INIT INFO
# Provides: SuSEfirewall2_init
# Required-Start: $local_fs
# Required-Stop: $local_fs
# Default-Start: 3 5
# Default-Stop: 0 1 2 6
# Short-Description: SuSEfirewall2 phase 1
# Description: SuSEfirewall2_init does some basic setup and is the
# phase 1 of 2 of the SuSEfirewall initialization
### END INIT INFO
SUSEFWALL="/usr/local/bin/fw_nat_centos"
BOOTLOCKFILE="/var/lock/SuSEfirewall2.booting"
test -x $SUSEFWALL || exit 5
test -r /etc/sysconfig/SuSEfirewall2 || exit 6
startmode=close
if (. /etc/sysconfig/SuSEfirewall2; test "$FW_BOOT_FULL_INIT" = yes); then
startmode=start
fi >/dev/null 2>&1
. /etc/rc.status
rc_reset
case "$1" in
start)
echo -n "Loading basic firewall rules "
if test -x /usr/sbin/iptables; then
/bin/rm -rf /var/run/SuSEfirewall2
$SUSEFWALL --bootlock -q $startmode
else
echo -n "${extd}iptables not available (yet)${norm}"
rc_failed 5
fi
rc_status -v
;;
stop)
rc_failed 0
rc_status
;;
restart|force-reload)
$0 start
;;
try-restart|reload)
if ($0 status) >/dev/null 2>&1; then
$0 start
else
rc_reset
fi
;;
status)
echo -n "Checking the status of SuSEfirewall2 "
{ test -e /proc/net/ip_tables_names && iptables -nL reject_func >/dev/null 2>&1; } || rc_failed 3
rc_status -v
;;
*)
echo "Usage: $0 {start|stop|status|restart|reload|force-reload}"
exit 1
;;
esac
# Set exit status
rc_exit
# cat /usr/local/bin/fw_nat_centos #!/bin/sh #define variables ipt="/sbin/iptables" mod="/sbin/modprobe" LAN_IFACE="eth1" WAN_IFACE="eth0" NETLAN="192.168.0.0/24" IP_SERVER="192.168.0.1" #basic set of kernel modules $mod ip_tables $mod ip_conntrack $mod iptable_filter $mod iptable_nat $mod iptable_mangle $mod ipt_LOG $mod ipt_limit $mod ipt_state $mod ipt_MASQUERADE #add these for IRC and FTP $mod ip_nat_ftp $mod ip_nat_irc $mod ip_conntrack_ftp $mod ip_conntrack_irc # Flush all active rules and delete all custom chains $ipt -F $ipt -t nat -F $ipt -t mangle -F $ipt -X $ipt -t nat -X $ipt -t mangle -X #Set default policies $ipt -P INPUT DROP $ipt -P FORWARD DROP $ipt -P OUTPUT ACCEPT $ipt -t nat -P OUTPUT ACCEPT $ipt -t nat -P PREROUTING ACCEPT $ipt -t nat -P POSTROUTING ACCEPT $ipt -t mangle -P PREROUTING ACCEPT $ipt -t mangle -P POSTROUTING ACCEPT #this line is necessary for the loopback interface #and internal socket-based services to work correctly $ipt -A INPUT -i lo -j ACCEPT $ipt -A OUTPUT -o lo -j ACCEPT # Activar IP masquerading #$ipt -t nat -A POSTROUTING -o $WAN_IFACE -s $NETLAN -d 0/0 -j MASQUERADE $ipt -t nat -A POSTROUTING -o $WAN_IFACE -j MASQUERADE # Permitir conexion previamente establecida por la interfaz internet eth0 $ipt -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -i eth0 # permitir LAN acceda al firewall $ipt -A INPUT -j ACCEPT -p all -s $NETLAN -i eth1 $ipt -A OUTPUT -j ACCEPT -p all -d $NETLAN -o eth1 $ipt -A FORWARD -o $WAN_IFACE -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT $ipt -A FORWARD -i $WAN_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT # Accept important ICMP messages $ipt -A INPUT -p icmp --icmp-type echo-request -j ACCEPT $ipt -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT $ipt -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT # Restringir acceso SSH solamente a hosts LAN $ipt -A INPUT -i $LAN_IFACE -p tcp -s $NETLAN --dport 22 --sport 1024:65535 -m state --state NEW -j ACCEPT # Restringir ciertos servicios dudosos $ipt -A OUTPUT -o eth0 -p tcp --dport 31337 --sport 31337 -j DROP $ipt -A FORWARD -o eth0 -p tcp --dport 31337 --sport 31337 -j DROP # open access to samba server for lan users only $ipt -A INPUT -s $NETLAN -m state --state NEW -p tcp --dport 137 -j ACCEPT $ipt -A INPUT -s $NETLAN -m state --state NEW -p udp --dport 137 -j ACCEPT $ipt -A INPUT -s $NETLAN -m state --state NEW -p tcp --dport 138 -j ACCEPT $ipt -A INPUT -s $NETLAN -m state --state NEW -p tcp --dport 139 -j ACCEPT $ipt -A INPUT -s $NETLAN -m state --state NEW -p udp --dport 139 -j ACCEPT $ipt -A INPUT -s $NETLAN -m state --state NEW -p tcp --dport 445 -j ACCEPT $ipt -A INPUT -s $NETLAN -m state --state NEW -p udp --dport 445 -j ACCEPT # Aceptamos que consulten los DNS $ipt -A OUTPUT -s $NETLAN -o eth1 -p udp --dport 53 --sport 1024:65535 -j ACCEPT $ipt -A INPUT -s $NETLAN -i eth1 -p udp --sport 53 --dport 1024:65535 -j ACCEPT # Multicast de DNS (mDNS) $ipt -A OUTPUT -s $NETLAN -o eth1 -p udp --dport 5353 -j ACCEPT # Aceptar peticiones DHCP $ipt -I INPUT -i $LAN_IFACE -p udp --dport 67:68 --sport 67:68 -j ACCEPT # allow client to query and receive timeserver # $ipt -A OUTPUT -o eth0 -p udp -s--sport 123 -d --dport 123 -m state --state NEW -j ACCEPT $ipt -A OUTPUT -o eth1 -p udp -s $NET_LAN --sport 123 -d $IP_SERVER --dport 123 -m state --state NEW -j ACCEPT # OPEN port by SWAT $ipt -A INPUT -s $NETLAN -m state --state NEW -p tcp --dport 901 -j ACCEPT # Open port ldap #$ipt -A INPUT -s $NETLAN -m state --state NEW -p tcp --dport 389 -j ACCEPT # block all outgoing traffic to internet from ports 0:1024 $ipt -A OUTPUT -o $WAN_IFACE -p tcp --sport 1:1024 -j DROP $ipt -A OUTPUT -o $WAN_IFACE -p udp --sport 1:1024 -j DROP # Log all other input from internet $ipt -A INPUT -i $WAN_IFACE -j LOG # Log all other forward $ipt -A FORWARD -j LOG --log-prefix "Forward:" # log all other input form lan $ipt -A INPUT -i $LAN_IFACE -j LOG --log-prefix "from LAN:" # enable forwarding - done last for security echo " - Enabling firewall.." #echo "1" > /proc/sys/net/ipv4/ip_forward # saving iptables rules (works for Redhat/Fedora) (perhaps other distributions too) /sbin/service iptables save # /sbin/iptables -nL
