[no subject]

[Diego Tobón <jtobones en delta eafit edu co>]

no tengo mucha idea del asunto ....
quien podria modificar este scrit para ipchains kernel> 2.2.X


> --- firewall.sh --
> FW=/sbin/ipfwadm
> LOCALHOST="linux.box.com.mx"
> IFEXTERN="aaa.bbb.ccc.ddd"
> IFINTERN="192.168.0.20"
> LOCALNET="192.168.0.0/255.255.0.0"
> ANYWHERE="0.0.0.0/0"
> UNPRIVPORTS="1024:65535"
> 
> # Limpiar todas las reglas
> echo "Limpiando reglas..."
> for i in I O F
> do
>         ${FW} -$i -f
> done
> 
> ######################### REGLAS BASICAS ################################
> echo "Definiendo reglas basicas..."
> ${FW} -I -p deny
> ${FW} -O -p deny
> ${FW} -F -p deny
> 
> # Medidas anti-spoof
> ${FW} -I -a deny -V $IFEXTERN -S $LOCALNET -D $ANYWHERE
> ${FW} -I -a deny -V $IFEXTERN -S $IFEXTERN -D $ANYWHERE
> 
> # Trafico ilimitado interno
> ${FW} -I -a accept -V $IFINTERN -S $ANYWHERE -D $ANYWHERE
> ${FW} -O -a accept -V $IFINTERN -S $ANYWHERE -D $ANYWHERE
> 
> # Trafico icmp (para hacer pings)
> ${FW} -I -a accept -P icmp -S $ANYWHERE -D $ANYWHERE
> ${FW} -O -a accept -P icmp -S $ANYWHERE -D $ANYWHERE
> ${FW} -F -a accept -P icmp -S $ANYWHERE -D $ANYWHERE
> 
> ######################### USO EXTERNO DEL SISTEMA
############################
> echo "Definiendo reglas para uso externo..."
> ${FW} -I -a accept -P tcp -S $ANYWHERE -D $LOCALHOST smtp ftp www domain
ident
> ${FW} -I -a accept -P udp -S $ANYWHERE -D $LOCALHOST domain
> ${FW} -I -a accept -k -P tcp -S $ANYWHERE -D $LOCALHOST ftp-data ident
> ${FW} -O -a accept -P tcp -S $LOCALHOST smtp ftp ftp-data www domain
ident -D $ANYWHERE
> ${FW} -O -a accept -P udp -S $LOCALHOST domain -D $ANYWHERE
> 
> ######################### USO INTERNO DE INTERNET
#############################
> echo "Definiendo reglas para uso interno..."
> ${FW} -O -a accept -P tcp -S $LOCALNET $UNPRIVPORTS -D $ANYWHERE smtp
ftp-data www telnet gopher domain ident
> ${FW} -O -a accept -P tcp -S $IFEXTERN $UNPRIVPORTS -D $ANYWHERE smtp ftp
ftp-data www telnet gopher domain ident
> ${FW} -O -a accept -P udp -S $LOCALHOST $UNPRIVPORTS -D $ANYWHERE domain
> ${FW} -O -a accept -P tcp -S $LOCALNET $UNPRIVPORTS -D $ANYWHERE ftp
ftp-data www telnet gopher ident
> 
> ############################# PAQUETES DE ENTRADA
############################
> echo "Definiendo reglas de entrada de paquetes..."
> ${FW} -I -a accept -k -P tcp -S $ANYWHERE ftp www telnet gopher domain
ident -D $LOCALNET $UNPRIVPORTS
> ${FW} -I -a accept -k -P tcp -S $ANYWHERE ftp www telnet gopher domain
ident -D $IFEXTERN $UNPRIVPORTS
> ${FW} -I -a accept -P tcp -S $ANYWHERE ftp-data ident -D $LOCALNET
$UNPRIVPORTS
> ${FW} -I -a accept -P tcp -S $ANYWHERE ftp-data ident -D $IFEXTERN
$UNPRIVPORTS
> ${FW} -F -a accept -k -P tcp -S $ANYWHERE ftp www telnet gopher ident -D
$LOCALNET $UNPRIVPORTS
> ${FW} -F -a accept -P tcp -S $ANYWHERE ftp-data ident -D $LOCALNET
$UNPRIVPORTS
> 
> --- firewall.sh ---
> hace un rato le agregué ident (tcp), como datos adicionales, tengo
> corriendo kernel 2.0.36, con ip-forward activado, tengo también
> socks-4.3.beta2-2, squid+icmp-2.2.STABLE3-1
> 
> Saludos
> David