Ajuda com a seguinte atividade de firewall !

Aleredes · Novato Registrado em: Nov 21, 2007 Mensagens: 2

Atividade sobre firewall
-----------------------------
Configure um firewall utilizando o sistema operacional linux para controle de pacotes entre algumas redes de uma empresa hipotética:
As redes mínimas a serem configuradas são:
• Rede dos vendedores;
• Rede da contabilidade e finanças;
• Rede da diretoria;
• Rede dos Servidores;
• Rede com o roteador de acesso a internet.

Os seguintes critérios devem ser obedecidos:

• Todas as redes estão ligadas ao firewall por interfaces de rede distintas;
• O Firewall deverá permitir o repasse de pacotes entre as redes;
• A rede da diretoria deverá ter acesso a qualquer rede, o contrário não poderá permitido;
• Todas as redes, exceto a da diretoria, deverão ter acesso entre sí;
• As redes dos vendedores, contabilidade e finanças deverão ter acesso à
internet via servidor proxy;
• A rede da diretoria deverá ter acesso total à internet via mascaramento;
• O acesso externo aos servidores e as redes internas deverá ser bloqueado,
exceto aos servidores DNS e WWW;
• O acesso interno aos servidores deverá ser limitado ao serviços oferecidos
(mínimo 08 );

*Obs: Não consegui criar sub-redes, nem subí-las no Fedora, alguém pode me ajudar???

Aleredes · Novato Registrado em: Nov 21, 2007 Mensagens: 2

Não consegui fazer tudo, mais, segue o pouco que fiz... acho que tem muita coisa errada... me ajudem! =)

Esse template foi gerado com auxilio de um exemplo configurado no firewall do kurumin
#!/bin/bash

# --------------------------------------------------------------------
# Os comandos abaixo foram obtidos a partir do script de
# configuração de firewall (configurar-firewall) de
# Carlos Morimoto, que acompanha o Kurumin
# --------------------------------------------------------------------
# Script de configuração do iptables
# Este script pode ser usado em outras distribuições Linux
# que utilizam o Kernel 2.4 em diante
# --------------------------------------------------------------------
# Feito por: Aleredes
# --------------------------------------------------------------------

firewall_start(){

#########################################################################
# O FIREWALL DEVERÁ PERMITIR O REPASSE DE PACOTES ENTRE AS REDES
########################################################################################################################
# Abre o firewall para os endereços da rede local (TCP/UDP) - Política de 'shopping center' - todos podem entrar menos os que forem barrados.
########################################################################################################################
# Faixa de IP é 192.168.0.0
# máscara 255.255.255.0
# ou seja, os ips são do tipo 192.168.X.Y
#############################################################
#
iptables -A INPUT -p tcp -s 192.168.0.0/255.255.255.0 -j ACCEPT
iptables -A INPUT -p udp -s 192.168.0.0/255.255.255.0 -j ACCEPT
#
#############################################################
# Abre o firewall para a internet
#############################################################
# Porta 22 : Porta Padrão do SSH
# Porta 6666 : Servidor SSH em Galileu
iptables -A INPUT -p tcp --destination-port 2222 -j ACCEPT
#
#############################################################

#################################################################################################################
# A REDE DA DIRETORIA DEVERÁ TER ACESSO A QUALQUER REDE, O CONTRÁRIO NÃO PODERÁ SER PERMITIDO
#################################################################################################################
# Diretoria 192.168.1.1/24; Contabilidade 192.168.2.0/24 ; Vendedores 192.168.3.0/24; Servidores 192.168.4.0/24; Firewall 192.168.0.1/24
#-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
iptables -A INPUT -s 192.168.1.1/24 -j DROP
#-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
#
###############################################################################################################
# AS REDES DOS VENDEDORES, CONTABILIDADE E FINANÇAS DEVERÃO TER ACESSO À INTERNET VIA SERVIDOR PROXY
################################################################################################################
#
# Utilizado o IP masquerading, para o servidor proxy
#---------------------------------------------------------------------------------------------------------------
iptables -t nat -A POSTROUTING -s 192.168.4.0/24 -o ppp0 -j MASQUERADE
#---------------------------------------------------------------------------------------------------------------
# Utilizado o DNAT para fazer o redirecionamento de pacotes das máquinas:
#Contabilidade:
iptables -t nat -A PREROUTING -s 192.168.2.0 -i eth0 -j DNAT --to 192.168.4.0
#---------------------------------------------------------------------------------------------------------------
# Vendedores:
iptables -t nat -A PREROUTING -s 192.168.3.0 -i eth0 -j DNAT --to 192.168.4.0
#
#######################################################################################################
# A REDE DA DIRETORIA DEVERÁ TER ACESSO TOTAL À INTERNET VIA MASCARAMENTO
#######################################################################################################
# Utilizado o IP Masquerading para a rede Diretoria
#---------------------------------------------------------------------------------------------------------------
iptables -t nat -A POSTROUTING -s 192.168.1.1/24 -o ppp0 -j MASQUERADE
#
##########################################################################################################################
# O ACESSO EXTERNO AOS SERVIDORES E AS REDES INTERNAS DEVERÁ SER BLOQUEADO EXCETO AOS SERVIDORES DNS E WWW
###########################################################################################################################
#bloqueia qualquer tráfego local para a internet
#------------------------------------------------------------------
iptables -A OUTPUT -o ppp+ -j DROP
#---------------------------------------------------------------
#libera o tráfego externo para os servidores
#---------------------------------------------------------------
iptables -A OUTPUT -s 192.168.4.0/24 -o ppp+ -j ACCEPT
#
#######################################################################################################
#O ACESSO INTERNO AOS SERVIDORES DEVERÁ SER LIMITADO AOS SERVIÇOS OFERECIDOS
#######################################################################################################

}
firewall_stop(){
iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
}

case "$1" in
"start")
echo -n "O firewall está sendo ativado ..."
firewall_start
echo " Ok!"
;;
"stop")
echo -n "O firewall está sendo desativado ..."
firewall_stop
echo " Ok!"
;;
"restart")
echo -n "O firewall está sendo desativado ..."
firewall_stop
echo " Ok!"
echo -n "O firewall está sendo ativado ..."
firewall_start
echo " Ok!"
;;
*)
echo "Essa é a sua configuração de Firewall"
echo
iptables -L -n
;;
esac