Vamos lá. Nesse servidor tenho:
- DHCP
- DNS
- SQUID
- APACHE
- FIREWALL
- SSH
Preciso liberar as portas para o WPAD funcionar corretamente. Se eu deixar o firewall com tudo ACCEPT funciona, mas como estou adotando a estratégia de DROP total e liberar o necessário, estou tendo problemas para fazer funcionar o WPAD. Abaixo seguem os scripts. Por favor, aponte uma solução. Alguém com mais experiência pode achar o erro mais fácil correndo o olho no script.
dhcpd.conf
#PARA FUNCIONAR O DNS
ddns-update-style interim;
ddns-updates on;
ddns-domainname "macaco.local";
ddns-rev-domainname "0.168.192.in-addr.arpa";
include "/etc/bind/rndc.key";
zone macaco.local
{
primary 127.0.0.1;
key rndc-key;
}
zone 0.168.192.in-addr-arpa
{
primary 127.0.0.1;
key rndc-key;
}
#WPAD
option wpad code 252 = text;
option wpad "http://192.168.0.254/wpad.dat\n";
#DHCP
authoritative;
default-lease-time 600;
max-lease-time 7200;
option domain-name "macaco.local";
option domain-name-servers 192.168.0.254,8.8.8.8,8.8.4.4;
option subnet-mask 255.255.255.0;
# Configurando o dhcp para distribuir ip na ETH1 - REDE LOCAL - OFFBOARD
subnet 192.168.0.0 netmask 255.255.255.0 {
range 192.168.0.2 192.168.0.200;
option routers 192.168.0.254;
option broadcast-address 192.168.0.255;
}
named.conf.local
include "/etc/bind/rndc.key";
zone "macaco.local" {
type master;
file "/etc/bind/db.macaco.local";
allow-update {key rndc-key;};
};
zone "0.168.192.in-addr.arpa" {
type master;
file "/etc/bind/0.168.192.in-addr.arpa";
allow-update {key rndc-key;};
};
0.168.192.in-addr.arpa
$TTL 43200 ; 12 hours
@ IN SOA fw3.macaco.local. root.macaco.local. (
1 ; serial
28800 ; refresh (8 hours)
14400 ; retry (4 hours)
3600000 ; expire (5 weeks 6 days 16 hours)
86400 ; minimum (1 day)
)
@ IN NS fw3.macaco.local.
254.0.168.192 IN PTR fw3.macaco.local.
254 IN PTR www.macaco.local.
db.macaco.local
$TTL 43200 ; 12 hours
@ IN SOA fw3.macaco.local. root.macaco.local. (
2 ; serial
28800 ; refresh (8 hours)
14400 ; retry (4 hours)
3600000 ; expire (5 weeks 6 days 16 hours)
86400 ; minimum (1 day)
)
@ IN NS fw3.macaco.local.
fw3 IN A 192.168.0.254
wpad IN A 192.168.0.254
www IN A 192.168.0.254
firewall
#!/bin/bash
INTERNET="eth1"
REDELOCAL="eth0"
modprobe ip_tables
modprobe iptable_nat
# Politica padrao
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# Politicas da rede ou pessoais
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
###################### FORWARD ##############################
# Liberando o DNS -
iptables -A FORWARD -i $REDELOCAL -o $INTERNET -p udp -m multiport --dports 53,5353 -j ACCEPT
# Liberando o ssh
iptables -A FORWARD -i $REDELOCAL -o $INTERNET -p tcp --dport 22 -j ACCEPT
# Liberando o Squid
iptables -A FORWARD -i $REDELOCAL -o $INTERNET -p tcp --dport 3128 -j ACCEPT
# Liberando POP E SMTP - SSL Também
iptables -A FORWARD -i $REDELOCAL -o $INTERNET -p tcp -m multiport --dports 25,110,465,995,587 -j ACCEPT
# Liberando o FTP
iptables -A FORWARD -i $REDELOCAL -o $INTERNET -p tcp --dport 21 -j ACCEPT
###################### INPUT ################################
# Liberando Samba
iptables -A INPUT -i $REDELOCAL -p tcp -m multiport --dports 139,445 -j ACCEPT
iptables -A INPUT -i $REDELOCAL -p udp -m multiport --dports 137,138 -j ACCEPT
# Liberando ssh
iptables -A INPUT -i $REDELOCAL -p tcp --dport 22 -j ACCEPT
# Liberando o Squid
iptables -A INPUT -i $REDELOCAL -p tcp --dport 3128 -j ACCEPT
###################### OUTPUT ################################
# Liberando o Squid
iptables -A OUTPUT -p tcp --dport 3128 -j ACCEPT
# Liberando o Dns - Necessario para o Squid
iptables -A OUTPUT -p udp -m multiport --dports 53,5353 -j ACCEPT
# Liberando o Samba
iptables -A OUTPUT -p tcp -m multiport --dports 139,445 -j ACCEPT
iptables -A OUTPUT -p udp -m multiport --dports 137,138 -j ACCEPT
# Compartilhando a internet com a REDELOCAL
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
################### LIBERANDO PC ACESSO ESPECIAL ############
# Juca
iptables -A FORWARD -s 192.168.0.99 -j ACCEPT
################### Protegendo contra ataques ###############
# Syn Cookyes
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
# ICMP Broadcasts
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
# Mensagens falsas de icmp_error responses
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
# Anti-spoofings
iptables -A INPUT -j DROP -s 10.0.0.0/8 -i $INTERNET
iptables -A INPUT -j DROP -s 127.0.0.0/8 -i $INTERNET
iptables -A INPUT -j DROP -s 172.16.0.0/12 -i $INTERNET
iptables -A INPUT -j DROP -s 192.168.1.0/16 -i $INTERNET
# Syn Flood via modulo limit
iptables -A FORWARD -p tcp --syn -m limit --limit 100/s -j ACCEPT
################### Bloqueando aplicativos ###################
#
