Estações não navegam

heberson · 02 de Dezembro de 2011, 10:27

Tenho um servidor Linux que uso como firewall e proxy funcionando, tive que por problemas de hardware efetuar a troca desse servidor.
Utilizo como firewall o firehol e como proxy o squid3, fiz a instalação dos mesmos via apt-get, e copiei os arquivos de configuração (firehol.conf , squid.conf) para a nova máquina.

O Firewall está funcionando normalmente, porém quando coloco este servidor como gateway das máquinas cliente elas não navegam.

No servidor consigo navegar na internet normalmente pelo firefox, e reparei o seguinte: quando as máquinas estão setadas com esse servidor como gateway o skype funciona.

Outro teste que fiz foi utilizar um proxy externo no navegador das máquinas cliente e navega normalmente.

Alguêm tem alguma idéia do que pode ser?

grato.

zekkerj · 02 de Dezembro de 2011, 14:00

Checklist...

1. Confirme que o repasse de pacotes está ativado.

2. Confirme que o firewall está fazendo NAT nos pacotes que saem pra internet, vindos da rede local.

3. Confime que o firewall esta permitindo que o Squid receba conexões vindas da rede interna (e só da rede interna).

4. Se estiver usando proxy transparente, confirme que o firewall deixa suas estações fazerem consulta DNS.

heberson · 02 de Dezembro de 2011, 14:33

Verifiquei o repasse de pacotes
A linha "net/ipv4/ip_forward=1" do arquivo "etc/sysctl.conf" está descomentada.

O Nat do firehol.conf está assim.
# NAT Internet share
   router inside2outside inface eth0 outface eth2
masquerade
     route all accept
   router outside2inside inface eth2 outface eth0
masquerade
route all accept

a primeira linha do squid.conf está assim:
http_port 3128 transparent

O Problema continua

zekkerj · 02 de Dezembro de 2011, 15:09

Eu nunca vi nem configurei esse firehol, mas deve ser mais uma interface pro netfilter. Se for assim, ele vai traduzir a configuração em comandos que o iptables pode ler. Execute os comandos abaixo e cole aqui.

sudo iptables -L -v -n

sudo iptables -t nat -L -v -n

heberson · 05 de Dezembro de 2011, 10:57

Segue abaixo:
tcp spts:1024:65535 dpt:6667 state NEW,ESTABLISHED

Chain in_outside_all_c10 (1 references)
pkts bytes target prot opt in out source destination
2099 2626K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED

Chain in_outside_ftp_c12 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:21 dpts:32768:61000 state ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:20 dpts:32768:61000 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpts:32768:61000 state ESTABLISHED

Chain in_outside_ftp_s4 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:21 state NEW,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:20 state ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpts:32768:61000 state RELATED,ESTABLISHED

Chain in_outside_http_s3 (1 references)
pkts bytes target prot opt in out source destination
20 1104 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:80 state NEW,ESTABLISHED

Chain in_outside_https_s2 (1 references)
pkts bytes target prot opt in out source destination
4 188 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:443 state NEW,ESTABLISHED

Chain in_outside_icmp_s1 (1 references)
pkts bytes target prot opt in out source destination
77 3456 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED

Chain in_outside_irc_c11 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:6667 dpts:32768:61000 state ESTABLISHED

Chain in_outside_pptp_s6 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:1723 state NEW,ESTABLISHED
0 0 ACCEPT 47 -- * * 0.0.0.0/0 0.0.0.0/0

Chain in_outside_rdp_s7 (1 references)
pkts bytes target prot opt in out source destination
14 684 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:3389 state NEW,ESTABLISHED

Chain in_outside_squid_c13 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:3128 dpts:32768:61000 state ESTABLISHED

Chain in_outside_ssh_s5 (1 references)
pkts bytes target prot opt in out source destination
78 5612 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:22 state NEW,ESTABLISHED

Chain in_outside_vnc_s9 (1 references)
pkts bytes target prot opt in out source destination
148 7024 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpts:5900:5903 state NEW,ESTABLISHED

Chain in_outside_webmin_s8 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpt:10000 state NEW,ESTABLISHED

Chain out_inside (1 references)
pkts bytes target prot opt in out source destination
64423 327M out_inside_all_s1 all -- * * 0.0.0.0/0 0.0.0.0/0
1612 66546 out_inside_irc_s2 all -- * * 0.0.0.0/0 0.0.0.0/0
1612 66546 out_inside_ftp_s3 all -- * * 0.0.0.0/0 0.0.0.0/0
1612 66546 out_inside_all_c4 all -- * * 0.0.0.0/0 0.0.0.0/0
163 16600 out_inside_irc_c5 all -- * * 0.0.0.0/0 0.0.0.0/0
163 16600 out_inside_ftp_c6 all -- * * 0.0.0.0/0 0.0.0.0/0
163 16600 out_inside_msn_s7 all -- * * 0.0.0.0/0 0.0.0.0/0
163 16600 out_inside_p2p_s8 all -- * * 0.0.0.0/0 0.0.0.0/0
163 16600 out_inside_emule_s9 all -- * * 0.0.0.0/0 0.0.0.0/0
163 16600 out_inside_squid_s10 all -- * * 0.0.0.0/0 0.0.0.0/0
163 16600 out_inside_snmp_s11 all -- * * 0.0.0.0/0 0.0.0.0/0
163 16600 out_inside_squid_c12 all -- * * 0.0.0.0/0 0.0.0.0/0
163 16600 out_inside_http_c13 all -- * * 0.0.0.0/0 0.0.0.0/0
163 16600 out_inside_all_c14 all -- * * 0.0.0.0/0 0.0.0.0/0
163 16600 out_inside_irc_c15 all -- * * 0.0.0.0/0 0.0.0.0/0
163 16600 out_inside_ftp_c16 all -- * * 0.0.0.0/0 0.0.0.0/0
146 15176 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED
17 1424 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `''OUT-inside':''
17 1424 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain out_inside2outside (1 references)
pkts bytes target prot opt in out source destination
80 38094 out_inside2outside_all_s1 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 out_inside2outside_irc_s2 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 out_inside2outside_ftp_s3 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED

Chain out_inside2outside_all_s1 (1 references)
pkts bytes target prot opt in out source destination
80 38094 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED

Chain out_inside2outside_ftp_s3 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:21 dpts:1024:65535 state ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:20 dpts:1024:65535 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpts:1024:65535 state ESTABLISHED

Chain out_inside2outside_irc_s2 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:6667 dpts:1024:65535 state ESTABLISHED

Chain out_inside_all_c14 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED

Chain out_inside_all_c4 (1 references)
pkts bytes target prot opt in out source destination
1449 49946 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED

Chain out_inside_all_s1 (1 references)
pkts bytes target prot opt in out source destination
62811 327M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED

Chain out_inside_emule_s9 (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:4662 state ESTABLISHED
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:4662 state NEW,ESTABLISHED
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:4672 state ESTABLISHED
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:4672 state NEW,ESTABLISHED
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:4661 state ESTABLISHED
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:4665 state ESTABLISHED

Chain out_inside_ftp_c16 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpt:21 state NEW,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpt:20 state ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpts:1024:65535 state RELATED,ESTABLISHED

Chain out_inside_ftp_c6 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpt:21 state NEW,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpt:20 state ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpts:1024:65535 state RELATED,ESTABLISHED

Chain out_inside_ftp_s3 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:21 dpts:1024:65535 state ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:20 dpts:1024:65535 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpts:1024:65535 state ESTABLISHED

Chain out_inside_http_c13 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpt:80 state NEW,ESTABLISHED

Chain out_inside_irc_c15 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpt:6667 state NEW,ESTABLISHED

Chain out_inside_irc_c5 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpt:6667 state NEW,ESTABLISHED

Chain out_inside_irc_s2 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:6667 dpts:1024:65535 state ESTABLISHED

heberson · 05 de Dezembro de 2011, 13:39

Chain out_inside_msn_s7 (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:1863 dpts:1024:65535 state ESTABLISHED
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:1863 dpts:1024:65535 state ESTABLISHED

Chain out_inside_p2p_s8 (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:1214 state NEW,ESTABLISHED
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:1214 state NEW,ESTABLISHED
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1214 state NEW,ESTABLISHED
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1214 state NEW,ESTABLISHED

Chain out_inside_snmp_s11 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:161 dpts:1024:65535 state ESTABLISHED

Chain out_inside_squid_c12 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpt:3128 state NEW,ESTABLISHED

Chain out_inside_squid_s10 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:3128 dpts:1024:65535 state ESTABLISHED

Chain out_outside (1 references)
pkts bytes target prot opt in out source destination
1533 165K out_outside_icmp_s1 all -- * * 0.0.0.0/0 0.0.0.0/0
1508 164K out_outside_https_s2 all -- * * 0.0.0.0/0 0.0.0.0/0
1505 164K out_outside_http_s3 all -- * * 0.0.0.0/0 0.0.0.0/0
1492 163K out_outside_ftp_s4 all -- * * 0.0.0.0/0 0.0.0.0/0
1492 163K out_outside_ssh_s5 all -- * * 0.0.0.0/0 0.0.0.0/0
1436 155K out_outside_pptp_s6 all -- * * 0.0.0.0/0 0.0.0.0/0
1436 155K out_outside_rdp_s7 all -- * * 0.0.0.0/0 0.0.0.0/0
1433 155K out_outside_webmin_s8 all -- * * 0.0.0.0/0 0.0.0.0/0
1433 155K out_outside_vnc_s9 all -- * * 0.0.0.0/0 0.0.0.0/0
1280 148K out_outside_all_c10 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 out_outside_irc_c11 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 out_outside_ftp_c12 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 out_outside_squid_c13 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `''OUT-outside':''
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain out_outside2inside (1 references)
pkts bytes target prot opt in out source destination
0 0 out_outside2inside_all_s1 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 out_outside2inside_irc_s2 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 out_outside2inside_ftp_s3 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED

Chain out_outside2inside_all_s1 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED

Chain out_outside2inside_ftp_s3 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:21 dpts:1024:65535 state ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:20 dpts:1024:65535 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpts:1024:65535 state ESTABLISHED

Chain out_outside2inside_irc_s2 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:6667 dpts:1024:65535 state ESTABLISHED

Chain out_outside_all_c10 (1 references)
pkts bytes target prot opt in out source destination
1280 148K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED

Chain out_outside_ftp_c12 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpt:21 state NEW,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpt:20 state ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpts:1024:65535 state RELATED,ESTABLISHED

Chain out_outside_ftp_s4 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:21 dpts:1024:65535 state ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:20 dpts:1024:65535 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpts:1024:65535 state ESTABLISHED

Chain out_outside_http_s3 (1 references)
pkts bytes target prot opt in out source destination
13 520 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:80 dpts:1024:65535 state ESTABLISHED

Chain out_outside_https_s2 (1 references)
pkts bytes target prot opt in out source destination
3 120 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:443 dpts:1024:65535 state ESTABLISHED

Chain out_outside_icmp_s1 (1 references)
pkts bytes target prot opt in out source destination
25 1120 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED

Chain out_outside_irc_c11 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpt:6667 state NEW,ESTABLISHED

Chain out_outside_pptp_s6 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:1723 dpts:1024:65535 state ESTABLISHED
0 0 ACCEPT 47 -- * * 0.0.0.0/0 0.0.0.0/0

Chain out_outside_rdp_s7 (1 references)
pkts bytes target prot opt in out source destination
3 120 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:3389 dpts:1024:65535 state ESTABLISHED

Chain out_outside_squid_c13 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:32768:61000 dpt:3128 state NEW,ESTABLISHED

Chain out_outside_ssh_s5 (1 references)
pkts bytes target prot opt in out source destination
56 8004 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:22 dpts:1024:65535 state ESTABLISHED

Chain out_outside_vnc_s9 (1 references)
pkts bytes target prot opt in out source destination
153 7132 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:5900:5903 dpts:1024:65535 state ESTABLISHED

Chain out_outside_webmin_s8 (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:10000 dpts:1024:65535 state ESTABLISHED

Chain pr_outside_fragments (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `'PACKET FRAGMENTS:''
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain pr_outside_icmpflood (1 references)
pkts bytes target prot opt in out source destination
77 3456 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 100/sec burst 50
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `'ICMP FLOOD:''
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain pr_outside_malbad (4 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `'MALFORMED BAD:''
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain pr_outside_malnull (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `'MALFORMED NULL:''
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain pr_outside_malxmas (1 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `'MALFORMED XMAS:''
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain pr_outside_nosyn (1 references)
pkts bytes target prot opt in out source destination
5 200 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `'NEW TCP w/o SYN:''
5 200 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

Chain pr_outside_synflood (1 references)
pkts bytes target prot opt in out source destination
626 30892 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 100/sec burst 50
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `'SYN FLOOD:''
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

heberson · 05 de Dezembro de 2011, 13:42

root@SE-SP-003:~# sudo iptables -t nat -L -v -n
sudo: unable to resolve host SE-SP-003
Chain PREROUTING (policy ACCEPT 224K packets, 59M bytes)
pkts bytes target prot opt in out source destination
577 27968 REDIRECT tcp -- * * 192.168.2.0/24 0.0.0.0/0 tcp dpt:80 redir ports 3128
0 0 DNAT tcp -- eth0 * 192.168.2.0/24 0.0.0.0/0 tcp dpt:1863 to:192.168.2.9:3128
411 24660 DNAT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:23 to:192.168.2.11:3389
0 0 DNAT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:24 to:192.168.2.9:5900
746 37900 DNAT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:192.168.2.10:80

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
144 20531 MASQUERADE all -- * eth2 0.0.0.0/0 0.0.0.0/0
153 8154 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT 7341 packets, 1457K bytes)
pkts bytes target prot opt in out source destination

zekkerj · 05 de Dezembro de 2011, 15:08

É um firewall bem complexo... e parece que ficou faltando uma parte importante da listagem. Execute os comandos abaixo pra pegar essa parte específica que ficou faltando.

sudo iptables -L INPUT -v -n
sudo iptables -L OUTPUT -v -n
sudo iptables -L FORWARD -v -n

heberson · 06 de Dezembro de 2011, 13:01

Segue abaixo:

root@SE-SP-003:~# iptables -L INPUT -v -n
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1723
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1723
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:554
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:42000
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:42999
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:9999
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:6970
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:554
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:554
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:7070
1458 260K DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:5353
4 184 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8000
1067 239K in_outside all -- eth2 * 0.0.0.0/0 0.0.0.0/0
46542 3968K in_inside all -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED
5807 173K LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `'IN-unknown:''
5954 177K DROP all -- * * 0.0.0.0/0 0.0.0.0/0
root@SE-SP-003:~# iptables -L OUTPUT -v -n
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
4 200 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
136 33886 out_outside all -- * eth2 0.0.0.0/0 0.0.0.0/0
11178 57M out_inside all -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED
2082 667K LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `'OUT-unknown:''
3619 768K DROP all -- * * 0.0.0.0/0 0.0.0.0/0
root@SE-SP-003:~# iptables -L FORWARD -v -n
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 in_inside2outside all -- eth0 eth2 0.0.0.0/0 0.0.0.0/0
0 0 out_inside2outside all -- eth2 eth0 0.0.0.0/0 0.0.0.0/0
0 0 in_outside2inside all -- eth2 eth0 0.0.0.0/0 0.0.0.0/0
0 0 out_outside2inside all -- eth0 eth2 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 4 prefix `'PASS-unknown:''
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

zekkerj · 06 de Dezembro de 2011, 13:13

A informação que a gente precisa está na cadeia "in_inside", que não está listada. Mas deixa estar, já deu pra entender o funcionamento geral do firewall.

É um firewall restritivo (política DROP para as cadeias INPUT, OUTPUT e FORWARD), portanto você tem que liberar explicitamente as portas que podem ser utilizadas na rede local ou na internet.

O manual do firewall vai te dar o detalhe sobre como fazer isso; você vai ter que alterar o tal arquivo de configuração "firehol.conf" pra incluir a porta do squid (3128/tcp). Depois de alterado, talvez vc precise reiniciar a máquina pra ativar a configuração.

heberson · 07 de Dezembro de 2011, 11:26

Meu Firehol.conf está assim:

version 5

# Redireciona SQUID
iptables -t nat -A PREROUTING -s 192.168.2.9/24 -p tcp --dport 80 -j REDIRECT --to-port 3128
#iptables -t nat -A PREROUTING -s 192.168.2.63 -p tcp --dport 80 -j REDIRECT --to-port 3128
# Bloqueando msn
iptables -t nat -A PREROUTING -s 192.168.2.0/24 -i eth0 -p tcp --dport 1863 -j DNAT --to-destination 192.168.2.9:3128

# Bloqueio MMS
iptables -A INPUT -p TCP --dport 1723 -j DROP
iptables -A INPUT -p UDP --dport 1723 -j DROP
iptables -A INPUT -p TCP --dport 554 -j DROP
iptables -A INPUT -p TCP --dport 42000 -j DROP
iptables -A INPUT -p TCP --dport 42999 -j DROP
iptables -A INPUT -p UDP --dport 9999 -j DROP
iptables -A INPUT -p UDP --dport 6970 -j DROP

# Bloqueio de Itunes
iptables -A INPUT -p TCP --dport 554 -j DROP
iptables -A INPUT -p UDP --dport 554 -j DROP
iptables -A INPUT -p UDP --dport 7070 -j DROP
iptables -A INPUT -p UDP --dport 5353 -j DROP

iptables -A INPUT -p TCP --dport 8000 -j ACCEPT

   interface eth2 outside
protection strong
server icmp accept
      server https accept
   server http accept
server ftp accept
server ssh accept
server pptp accept
server rdp accept
server webmin accept
#server smtp accept
#server dhcp accept
server vnc accept
#server msn deny
#server p2p deny
#server emule deny
#client p2p deny
#client emule deny
client all accept
#client all deny
client squid accept
interface eth0 inside
server all accept
client all accept
server msn deny
server p2p deny
server emule deny
server squid accept
server snmp accept
client squid accept
client http accept
client all accept

# NAT Internet share
   router inside2outside inface eth0 outface eth2
masquerade
     route all accept
   router outside2inside inface eth2 outface eth0
masquerade
route all accept

# Terminal services to SE-SP-001 com pat
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 23 -j DNAT --to 192.168.2.11:3389

# Terminal services to SE-SP-001 com pat
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 24 -j DNAT --to 192.168.2.9:5900

# Forward to IIS
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.2.10:80

# FTP to SE-RJ-001
# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 21 -j DNAT --to 192.168.1.250:21

# VPN forward to se-rj-001
# iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
# iptables -A INPUT -p 47 -j ACCEPT
# iptables -A FORWARD -p TCP --dport 1723 -j ACCEPT
# iptables -A FORWARD -p 47 -j ACCEPT
# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 1723 -j DNAT --to 192.168.1.250:1723
# iptables -t nat -A PREROUTING -i eth0 -p 47 -j DNAT --to 192.168.1.250
# iptables -t nat -A PREROUTING -i eth0 -p udp --dport 1701 -j DNAT --to 192.168.1.250

***************************************************************************

Onde adiciono o comando?

zekkerj · 07 de Dezembro de 2011, 12:36

Sinceridade? Não sei.

Nunca usei esse firehol. Aliás, nunca tinha nem ouvido falar dele antes deste tópico. Quando faço algum firewall, uso o próprio iptables.

O que posso observar é que o firehol parece estar misturando configurações próprias e comandos do iptables. Vale uma consulta à documentação do próprio aplicativo.

heberson · 07 de Dezembro de 2011, 13:57

è mesmo complicado achar material dele na net, mesmo assim valeu pela atenção.
abraço.

zekkerj · 07 de Dezembro de 2011, 14:59

Talvez se vc usar uma ferramenta mais conhecida? O Ubuntu mesmo já vem com um firewall próprio, que é o UFW.

Brodovisk · 07 de Dezembro de 2011, 21:20

Só fez reparo de hard?
Que hard são estes?
Não chegou a formatar chegou?

Estações não navegam

Brodovisk