firewall e proxy no suse SLES 10

[The hell 0]

Boa tarde.Queria saber como faço para instalar os modulos para preparar um super firewall no suse enterprise server 10.Estou preparando um script para o firewall mas tenho muitos erros, creio que é falta de determinados modulos.veja o script:############################# Limpar as regras primeiro/usr/sbin/iptables -F/usr/sbin/iptables -t nat -F/usr/sbin/iptables -F -t mangle/usr/sbin/iptables -X -t mangle############################# Insere os modulos kernel/sbin/modprobe iptable_nat/sbin/modprobe iptable_mangle/sbin/modprobe ipt_conntrack/sbin/modprobe ip_conntrack_ftp/sbin/modprobe ip_nat_ftp/sbin/modprobe ipt_multiport/sbin/modprobe ipt_LOG/sbin/modprobe ipt_mark/sbin/modprobe ipt_MARKecho 1 > /proc/sys/net/ipv4/ip_forwardecho "0" > /proc/sys/net/ipv4/tcp_ecn###########################################/usr/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE/usr/sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE########### LOGS ######################/usr/sbin/iptables -t nat -A PREROUTING -p tcp --dport 5190 -j LOG --log-prefix "LOG ICQ: "/usr/sbin/iptables -t nat -A PREROUTING -p tcp --dport 1863 -j LOG --log-prefix "LOG MSN: "/usr/sbin/iptables -t nat -A PREROUTING -p tcp --dport 22 -j LOG --log-prefix "Serviço SSH: "/usr/sbin/iptables -t nat -A PREROUTING -p tcp --dport 21 -j LOG --log-prefix "Serviço FTP: "###################################### PROTECAO EXTRA################################################### Brute Force ############/usr/sbin/iptables -A INPUT -p tcp --syn --dport 22 -m recent --name sshattack --set/usr/sbin/iptables -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack --rcheck --seconds 60 --hitcount 3 -j LOG --log-prefix 'SSH REJECT: '/usr/sbin/iptables -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack --rcheck --seconds 60 --hitcount 3 -j REJECT --reject-with tcp-reset/usr/sbin/iptables -A FORWARD -p tcp --syn --dport 22 -m recent --name sshattack --set/usr/sbin/iptables -A FORWARD -p tcp --dport 22 --syn -m recent --name sshattack --rcheck --seconds 60 --hitcount 3 -j LOG --log-prefix 'SSH REJECT: '/usr/sbin/iptables -A FORWARD -p tcp --dport 22 --syn -m recent --name sshattack --rcheck --seconds 60 --hitcount 3 -j REJECT --reject-with tcp-reset############# Proteção contra trojans ################/usr/sbin/iptables -N TROJAN/usr/sbin/iptables -A TROJAN -m limit --limit 15/m -j LOG --log-level 6 --log-prefix "FIREWALL: trojan: "/usr/sbin/iptables -A TROJAN -j DROP/usr/sbin/iptables -A INPUT -p TCP -i eth0 --dport 666 -j TROJAN/usr/sbin/iptables -A INPUT -p TCP -i eth0 --dport 666 -j TROJAN/usr/sbin/iptables -A INPUT -p TCP -i eth0 --dport 4000 -j TROJAN/usr/sbin/iptables -A INPUT -p TCP -i eth0 --dport 6000 -j TROJAN/usr/sbin/iptables -A INPUT -p TCP -i eth0 --dport 6006 -j TROJAN/usr/sbin/iptables -A INPUT -p TCP -i eth0 --dport 16660 -j TROJAN############## Proteção contra worms #################/usr/sbin/iptables -A FORWARD -p tcp --dport 135 -i eth0 -j REJECT############## SYN-flood ############/usr/sbin/iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT############## ping da morte ########/usr/sbin/iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT########### Port Scanners ###########/usr/sbin/iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j DROP########## IP Spoofing ##############/usr/sbin/iptables -N syn-flood/usr/sbin/iptables -A INPUT -i eth0 -p tcp --syn -j syn-flood/usr/sbin/iptables -A INPUT -s 10.0.0.0/8 -i eth0 -j DROP/usr/sbin/iptables -A INPUT -s 172.16.0.0/16 -i eth0 -j DROP/usr/sbin/iptables -A INPUT -s 192.168.0.0/24 -i eth0 -j DROP######## anomalias de pacotes #######/usr/sbin/iptables -A FORWARD -m unclean -j DROPespero uma ajuda. na realidade tenho que resolver isso e depois vou implementar o proxyObrigado

[Prog 183]

Quais são as mensagens de erro?

 

Para alguns itens das suas regras, acredito que seja necessário uma recompilação do kernel.

[Guilherme S Zanoni 0]

Confira se o pacote do iptables está instalado, estando... tente atualizal. Se estiver tudo ok, adicione o comando: echo 1 > /proc/sys/net/ipva/ip_forward (conferir o caminho) Depois rode novamente o comando...Antes tente o comando #iptables -nv -L e cole aqui o resultado...Abraços

[The hell 0]

boa tarde.Desculpe a demora.na verdade não esta carregando os modulos do kernel/usr/sbin/iptables -F/usr/sbin/iptables -t nat -F/usr/sbin/iptables -F -t mangle/usr/sbin/iptables -X -t mangle############################# Insere os modulos kernel/sbin/modprobe iptable_nat/sbin/modprobe iptable_mangle/sbin/modprobe ipt_conntrack/sbin/modprobe ip_conntrack_ftp/sbin/modprobe ip_nat_ftp/sbin/modprobe ipt_multiport/sbin/modprobe ipt_LOG/sbin/modprobe ipt_mark/sbin/modprobe ipt_MARda um erro de como não foi encontrado.O imteresante e que a parte dos log foi adicionado com sucesso o resto das regras não foi adicionada lembrando a distribuição é o suse enterprise server 10espero uma força obrigado