I've made a script to set an iptables firewall,but it's Causing instability on the local network aplication . The firewall is droping the connection between the clients and the server for a while when client and server are connected.
My network (192.168.x.y) :
|Modem-1|----|Modem-2|
---------||------------||
|LoadBalance Router|
----------||-----------------
|Firewall and DHCP-Server|
Modem-1 and 2 are all-in-one (WiFi Routers too)
Modem-1 Local: 192.168.1.0
Modem-2 Local:192.168.2.0
LoadBalance:192.168.3.0
Firewall Network 192.168.0.0
My Firewall server is NOT DNS Server, in the network we have the Windows AD as DNS Server.
#! /bin/bash
iniciar() {
# Limpando politicas e regras
iptables -X
iptables -F
iptables -Z
# Bloqueando tudo
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# Forward - WAN to LAN
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# Forward - LAN to WAN
iptables -A FORWARD -i eno2 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i eno2 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -i eno2 -p tcp --dport 587 -j ACCEPT
iptables -A FORWARD -i eno2 -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -i eno2 -p tcp --dport 110 -j ACCEPT
iptables -A FORWARD -i eno2 -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -i eno2 -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -i eno2 -p icmp -j ACCEPT
iptables -A FORWARD -p udp -s 192.168.0.0/24 --dport 53 -j ACCEPT
iptables -A FORWARD -i eno1 -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -p udp -s 192.168.3.0/24 --dport 53 -j ACCEPT
# Input
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
# Output
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp --dport 22 -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 4000 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 81 -j ACCEPT
# DVR 1 Portas 80, 8000 e 554
iptables -t nat -A PREROUTING -p TCP -d 192.168.3.0/24 --dport 80 -i eno1 -j DNAT --to 192.168.0.251:80
iptables -A FORWARD -p TCP -d 192.168.0.251 --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -p TCP -d 192.168.3.0/24 --dport 8000 -i eno1 -j DNAT --to 192.168.0.251:8000
iptables -A FORWARD -p TCP -d 192.168.0.251 --dport 8000 -j ACCEPT
iptables -t nat -A PREROUTING -p TCP -d 192.168.3.0/24 --dport 554 -i eno1 -j DNAT --to 192.168.0.251:554
iptables -A FORWARD -p TCP -d 192.168.0.251 --dport 554 -j ACCEPT
# DVR 2 8080,8001 e 1024
iptables -t nat -A PREROUTING -p TCP -d 192.168.3.0/24 --dport 8080 -i eno1 -j DNAT --to 192.168.0.254:8080
iptables -A FORWARD -p TCP -d 192.168.0.254 --dport 8080 -j ACCEPT
iptables -t nat -A PREROUTING -p TCP -d 192.168.3.0/24 --dport 8001 -i eno1 -j DNAT --to 192.168.0.254:8001
iptables -A FORWARD -p TCP -d 192.168.0.254 --dport 8001 -j ACCEPT
iptables -t nat -A PREROUTING -p TCP -d 192.168.3.0/24 --dport 1024 -i eno1 -j DNAT --to 192.168.0.254:1024
iptables -A FORWARD -p TCP -d 192.168.0.254 --dport 1024 -j ACCEPT
#iptables -t nat -A PREROUTING -p TCP -d 0/0 --dport 53 -i eno1 -j DNAT --to 0/0
#iptables -A FORWARD -p TCP -d 0/0 --dport 53 -j ACCEPT
#iptables -t nat -A PREROUTING -p UDP -d 0/0 --dport -i eno1 -j DNAT --to 0/0
#iptables -A FORWARD -p -d 0/0 --dport 53 -j ACCPET
# Acesso Remoto
iptables -t nat -A PREROUTING -p TCP -d 192.168.3.0/24 --dport 3389 -i eno1 -j DNAT --to 192.168.0.13:3389
iptables -A FORWARD -p TCP -d 192.168.0.13 --dport 3389 -j ACCEPT
}
parar(){
iptables -X
iptables -F
iptables -Z
}
case "$1" in
"start") iniciar;;
"restart") parar; iniciar;;
*) echo "Use start ou restart"
esac
Edit: I was talking to my teacher about this and he said the instability may be cause by hardware incompability, I need change to another OS(Not Linux distro, another OS) to solve this
Edit2: Another thing that cause the error, maybe is the time that I fixed for IPs I let 30 minutes, after that the server check if the IP was in use, I solve the problem change for FreeBSD OS based
