Tem que ver qual porta seu e-mail está usando.<br><br>E outra coisa,<br><br>/usr/sbin/iptables pode ser usado em uma variavel... dai ajuda muito depois...<br><br><div><span class="gmail_quote">2006/11/27, Bruno Contin <
<a href="mailto:brunorodeiro@gmail.com">brunorodeiro@gmail.com</a>>:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div><font face="Arial" size="2">
Olá comunidade, eu estou com um problema,
implementei um firewall com proxy ( squid ) no Fedora, a net está ok, o proxy
também, só que não consigo receber e-mails e nem enviar, e as portas no firewall
estão abertas para isso.<br>esse é o meu firewall, se alguém puder me ajudar, eu
agradeço... Vamos criar uma lista de pessoas que queiram conversar via Google
Talk para tirar dúvidas? o meu é <a href="mailto:brunorodeiro@gmail.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">brunorodeiro@gmail.com</a><br>abraços...<br><span style="font-weight: bold;">
obs: troquei de-mail pois no yahoo não estava recebendo. agora estou com
<a href="mailto:brunorodeiro@gmail.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">brunorodeiro@gmail.com</a><br><span style="font-weight: bold;">obs: se eu colocar também uma regra no firewall para excluir determinado ip do proxy, os e-mails funcionam normalmente...
</span><br><br></span>#!/bin/bash</font></div>
<div> </div>
<div><font face="Arial" size="2">stop ()<br>{<br> echo "0" >
/proc/sys/net/ipv4/ip_forward<br> iptables -F<br> iptables
-X<br>}</font></div>
<div> </div>
<div><font face="Arial" size="2">start ()<br>{</font></div>
<div> </div>
<div><font face="Arial" size="2">############################# Limpar as regras
primeiro<br>/usr/sbin/iptables -F<br>/usr/sbin/iptables -t nat
-F<br>/usr/sbin/iptables -F -t mangle<br>/usr/sbin/iptables -X -t
mangle</font></div>
<div> </div><font face="Arial" size="2">
</font><div><font face="Arial" size="2"><br>############################# Insere os modulos
kernel<br>/sbin/modprobe iptable_nat<br>/sbin/modprobe
iptable_mangle<br>/sbin/modprobe ipt_conntrack<br>/sbin/modprobe
ip_conntrack_ftp<br>/sbin/modprobe ip_nat_ftp<br>/sbin/modprobe ipt_multiport
<br>/sbin/modprobe ipt_LOG<br>/sbin/modprobe ipt_mark<br>/sbin/modprobe
ipt_MARK</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">echo 1 > /proc/sys/net/ipv4/ip_forward</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">echo "0" > /proc/sys/net/ipv4/tcp_ecn</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">###########################################<br>#/usr/sbin/iptables -t nat
-A POSTROUTING -o eth0 -j MASQUERADE<br>/usr/sbin/iptables -t nat -A POSTROUTING
-o eth1 -j MASQUERADE</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">########### LOGS ######################<br>/usr/sbin/iptables -t nat -A
PREROUTING -p tcp --dport 5190 -j LOG --log-prefix "LOG ICQ:
"<br>/usr/sbin/iptables -t nat -A PREROUTING -p tcp --dport 1863 -j LOG
--log-prefix "LOG MSN: "<br>/usr/sbin/iptables -t nat -A PREROUTING -p tcp
--dport 22 -j LOG --log-prefix "Serviço SSH: "<br>/usr/sbin/iptables -t nat -A
PREROUTING -p tcp --dport 21 -j LOG --log-prefix "Serviço FTP: "</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">#####################################<br># PROTECAO
EXTRA<br>#####################################</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">############## Brute Force ############<br>/usr/sbin/iptables -A INPUT -p
tcp --syn --dport 22 -m recent --name sshattack --set<br>/usr/sbin/iptables -A
INPUT -p tcp --dport 22 --syn -m recent --name sshattack --rcheck --seconds 60
--hitcount 3 -j LOG --log-prefix 'SSH REJECT: '<br>/usr/sbin/iptables -A INPUT
-p tcp --dport 22 --syn -m recent --name sshattack --rcheck --seconds 60
--hitcount 3 -j REJECT --reject-with tcp-reset<br>/usr/sbin/iptables -A FORWARD
-p tcp --syn --dport 22 -m recent --name sshattack --set<br>/usr/sbin/iptables
-A FORWARD -p tcp --dport 22 --syn -m recent --name sshattack --rcheck --seconds
60 --hitcount 3 -j LOG --log-prefix 'SSH REJECT: '<br>/usr/sbin/iptables -A
FORWARD -p tcp --dport 22 --syn -m recent --name sshattack --rcheck --seconds 60
--hitcount 3 -j REJECT --reject-with tcp-reset</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">############# Proteção contra trojans
################<br>/usr/sbin/iptables -N TROJAN<br>/usr/sbin/iptables -A TROJAN
-m limit --limit 15/m -j LOG --log-level 6 --log-prefix "FIREWALL: trojan:
"<br>/usr/sbin/iptables -A TROJAN -j DROP<br>/usr/sbin/iptables -A INPUT -p TCP
-i eth0 --dport 666 -j TROJAN<br>/usr/sbin/iptables -A INPUT -p TCP -i eth0
--dport 666 -j TROJAN<br>/usr/sbin/iptables -A INPUT -p TCP -i eth0 --dport 4000
-j TROJAN<br>/usr/sbin/iptables -A INPUT -p TCP -i eth0 --dport 6000 -j
TROJAN<br>/usr/sbin/iptables -A INPUT -p TCP -i eth0 --dport 6006 -j
TROJAN<br>/usr/sbin/iptables -A INPUT -p TCP -i eth0 --dport 16660 -j
TROJAN</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">############## Proteção contra worms
#################<br>/usr/sbin/iptables -A FORWARD -p tcp --dport 135 -i eth0 -j
REJECT </font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">############## SYN-flood ############<br>/usr/sbin/iptables -A FORWARD -p
tcp --syn -m limit --limit 1/s -j ACCEPT</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">############## ping da morte ########<br>/usr/sbin/iptables -A FORWARD -p
icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">########### Port Scanners ###########<br>/usr/sbin/iptables -A FORWARD -p
tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j DROP</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">########## IP Spoofing ##############<br>/usr/sbin/iptables -N
syn-flood<br>/usr/sbin/iptables -A INPUT -i eth0 -p tcp --syn -j
syn-flood<br>/usr/sbin/iptables -A INPUT -s <a href="http://10.0.0.0/8" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.0.0.0/8</a> -i eth0 -j
DROP<br>/usr/sbin/iptables -A INPUT -s <a href="http://172.16.0.0/16" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">172.16.0.0/16</a> -i eth0 -j
DROP<br>/usr/sbin/iptables -A INPUT -s <a href="http://192.168.0.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.0/24</a> -i eth0 -j DROP</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">######## anomalias de pacotes #######<br>/usr/sbin/iptables -A FORWARD -m
unclean -j DROP</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">################### CEF ########################<br>/usr/sbin/iptables -t
nat -A PREROUTING -p tcp -d <a href="http://200.201.174.0/16" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">200.201.174.0/16</a> -j ACCEPT<br>/usr/sbin/iptables -A
FORWARD -p tcp -d <a href="http://200.201.174.0/16" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">200.201.174.0/16</a> -j ACCEPT<br>/usr/sbin/iptables -t nat -A
PREROUTING -p tcp -d <a href="http://200.201.166.0/16" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">200.201.166.0/16</a> -j ACCEPT<br>/usr/sbin/iptables -A FORWARD
-p tcp -d <a href="http://200.201.166.0/16" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">200.201.166.0/16</a> -j ACCEPT</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">############################# Redirecionar 80, 3128 -> 3128</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">#/usr/sbin/iptables -t nat -A PREROUTING -p tcp --dport 2100 -j DNAT
--to-destination <a href="http://192.168.0.1:3128" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.1:3128</a><br>#/usr/sbin/iptables -t nat -A PREROUTING -p
tcp --dport 80 -s <a href="http://192.168.0.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.0/24</a> -j DNAT --to-destination
<a href="http://192.168.0.1:3128" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.1:3128</a><br>iptables -t nat -A PREROUTING -i eth1 -p tcp -m multiport -s
<a href="http://192.168.0.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.0/24</a> --dport 80,443,563 -j REDIRECT --to-port 3128</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">############################# Aceitar lista de portas
padrao<br>/usr/sbin/iptables -t nat -A PREROUTING -p tcp --dport 21 -j
ACCEPT<br>/usr/sbin/iptables -t nat -A PREROUTING -p tcp --dport 22 -j
ACCEPT<br>/usr/sbin/iptables -t nat -A PREROUTING -p tcp --dport 23 -j ACCEPT
-s <a href="http://192.168.0.145" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.145</a><br>/usr/sbin/iptables -t nat -A PREROUTING -p tcp --dport 25
-j ACCEPT -s <a href="http://192.168.0.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.0/24</a><br>/usr/sbin/iptables -t nat -A PREROUTING -p tcp
--dport 53 -j ACCEPT<br>/usr/sbin/iptables -t nat -A PREROUTING -p tcp --dport
80 -j ACCEPT -s <a href="http://192.168.0.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.0/24</a><br>/usr/sbin/iptables -t nat -A PREROUTING -p
tcp --dport 110 -j ACCEPT -s <a href="http://192.168.0.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.0/24</a><br>/usr/sbin/iptables -t nat -A
PREROUTING -p tcp --dport 443 -j ACCEPT<br>/usr/sbin/iptables -t nat -A
PREROUTING -p tcp --dport 465 -j ACCEPT<br>/usr/sbin/iptables -t nat -A
PREROUTING -p tcp --dport 500 -j ACCEPT<br>/usr/sbin/iptables -t nat -A
PREROUTING -p tcp --dport 587 -j ACCEPT<br>/usr/sbin/iptables -t nat -A
PREROUTING -p tcp --dport 995 -j ACCEPT<br>/usr/sbin/iptables -t nat -A
PREROUTING -p tcp --dport 3306 -j ACCEPT -s <a href="http://192.168.0.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.0/24</a><br>/usr/sbin/iptables
-t nat -A PREROUTING -p tcp --dport 2100 -j ACCEPT -s
<a href="http://192.168.0.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.0/24</a><br>/usr/sbin/iptables -t nat -A PREROUTING -p tcp --dport 8080 -j
ACCEPT -s <a href="http://192.168.0.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.0/24</a><br>/usr/sbin/iptables -t nat -A PREROUTING -p tcp
--dport 5017 -j ACCEPT -s <a href="http://192.168.0.0/24" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.0/24</a></font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">########## ICQ ################<br>/usr/sbin/iptables -t nat -A PREROUTING
-p tcp --dport 5190 -j ACCEPT -s <a href="http://192.168.0.50" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.50</a></font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">########### MSN #######################<br>/usr/sbin/iptables -t nat -A
PREROUTING -p tcp --dport 1863 -j ACCEPT -s <a href="http://192.168.0.128" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">192.168.0.128</a> </font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2"><br>######################################<br># Filtros de portas
udp<br>######################################<br>/usr/sbin/iptables -t nat -A
PREROUTING -p udp --dport 53 -j ACCEPT<br>/usr/sbin/iptables -t nat -A
PREROUTING -p tcp --dport 53 -j ACCEPT</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2"><br>########### Apos feitas as regras rejeitar todos os outros
pacotes<br>/usr/sbin/iptables -t nat -p tcp -A PREROUTING -j
DROP<br>/usr/sbin/iptables -t nat -p udp -A PREROUTING -j DROP</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">}</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">case $1 in<br> start)<br> echo -n Starting Firewall...<br> add_rules<br>
echo "Done"<br> ;;<br> stop)<br> echo -n Stoping Firewall...<br>
flush_rules<br> echo "Done"<br> ;;<br> restart)<br> echo -n Restarting
Firewall...<br> flush_rules<br> add_rules<br> echo
"Done"<br> ;;<br> status)<br> echo "============================ Firewall
rules:"<br> iptables -L -n<br> echo "============================ Masquerade
tables:"<br> iptables -t nat -L -n<br> echo "============================
Mangle table:"<br> iptables -t mangle -L -n<br> ;;<br> *)<br> echo Usar: "$0
{ status | start | stop | restart }"<br> ;;<br>esac</font></div>
<br>--<br>Fedora-users-br mailing list<br><a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:Fedora-users-br@redhat.com">Fedora-users-br@redhat.com</a><br><a onclick="return top.js.OpenExtLink(window,event,this)" href="https://www.redhat.com/mailman/listinfo/fedora-users-br" target="_blank">
https://www.redhat.com/mailman/listinfo/fedora-users-br</a><br><br><br></blockquote></div><br><br clear="all"><br>-- <br>Rafael Brito Gomes<br>Sistema de Informação<br>Universidade de Salvador (UNIFACS)<br><br>Linux User - 430086
<br><br>O Tabareu - A Arte em sua forma mais Pura!<br><a href="http://tabareu.wordpress.com/">http://tabareu.wordpress.com/</a><br><br>Blog do Sinot<br><a href="http://sinot.wordpress.com/">http://sinot.wordpress.com/</a>