Language Translated Unfinished Unfinished words Unfinished characters Untranslated Checks Suggestions Comments
English 0 0 0 0 1 0 0
French 0 0 0 0 3 0 0
Portuguese (Brazil) 0 0 0 0 0 0 0
Please sign in to see the alerts.

Overview

Project website www.linuxfromscratch.org
Translation process
  • Translations can be made directly.
  • Translation suggestions can be made.
  • Any authenticated user can contribute.
  • The translation uses bilingual files.
Source code repository git@git.linuxfromscratch.org:fr-lfs
Repository branch 12.0
Last remote commit Add Portuguese (Brazil) BLFS 5a031b636f
Julien Lepiller authored 10 months ago
Last commit in Weblate Translated using Weblate (Portuguese (Brazil)) 73d7bab260
User avatar jamenson authored 8 months ago
Weblate repository https://translate.linuxfromscratch.org/git/linux-from-scratch-12-0/index/
File mask blfs/*/postlfs/security/iptables.po
4 days ago

String statistics

Strings percent Hosted strings Words percent Hosted words Characters percent Hosted characters
Total 384 9,993 73,938
Source 128 3,331 24,646
Translated 100% 384 100% 9,993 100% 73,938
Needs editing 0% 0 0% 0 0% 0
Read-only 33% 128 33% 3,331 33% 24,646
Failing checks 1% 4 1% 84 1% 555
Strings with suggestions 0% 0 0% 0 0% 0
Untranslated strings 0% 0 0% 0 0% 0
Last 12 months Previous

Activity in last 12 months

0 changes 0 changes 0 changes 0 changes 0 changes 136 changes 0 changes 1 change 0 changes 6 changes 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes 258 changes 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes
Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec

Quick numbers

9,993
Hosted words
384
Hosted strings
100%
Translated
0
Contributors
and previous 30 days

Trends of last 30 days

—
Hosted words
+100%
—
Hosted strings
+100%
—
Translated
+100%
—
Contributors
—
User avatar None

Changes committed
Changes committed 8 months ago
User avatar jamenson

Translation changed
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Begin rc.iptables

echo
echo "You're using the example configuration for a setup of a firewall"
echo "from Beyond Linux From Scratch."
echo "This example is far from being complete, it is only meant"
echo "to be a reference."
echo "Firewall security is a complex issue, that exceeds the scope"
echo "of the configuration rules below."
echo "You can find additional information"
echo "about firewalls in Chapter 4 of the BLFS book."
echo "https://www.&lfs-domainname;/blfs"
echo

# Insert iptables modules (not needed if built into the kernel).

modprobe nf_conntrack
modprobe nf_conntrack_ftp
modprobe xt_conntrack
modprobe xt_LOG
modprobe xt_state

# Enable broadcast echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route

# Enable TCP SYN Cookie Protection
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptance
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects

# Don't send Redirect Messages
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Drop Spoofed Packets coming in on an interface where responses
# would result in the reply going out a different interface.
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Log packets with impossible addresses.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians

# Be verbose on dynamic ip-addresses (not needed in case of static IP)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# Disable Explicit Congestion Notification
# Too many routers are still ignorant
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Set a known state
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# These lines are here in case rules are already in place and the
# script is ever rerun on the fly. We want to remove all rules and
# pre-existing user defined chains before we implement new rules.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Allow local connections
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow forwarding if the initiated on the intranet
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT

# Do masquerading
# (not needed if intranet is not using private ip-addresses)
iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE

# Log everything for debugging
# (last of all rules, but before policy rules)
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT "

# Enable IP Forwarding
echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Início do rc.iptables

echo
echo "Você está usando a configuração de exemplo para uma configuração de um firewall"
echo "oriunda do Beyond Linux From Scratch."
echo "Este exemplo está longe de ser completo; ele é entendido para ser"
echo "somente uma referência."
echo "A segurança do firewall é um problema complexo, que excede o escopo"
echo "das regras de configuração abaixo."
echo "Você pode encontrar informação adicional"
echo "acerca de firewalls no Capítulo 4 do livro BLFS."
echo "https://www.&lfs-domainname;/blfs"
echo

# Insere módulos do iptables (não necessário se construído internamente
# ao kernel).

modprobe nf_conntrack
modprobe nf_conntrack_ftp
modprobe xt_conntrack
modprobe xt_LOG
modprobe xt_state

# Habilita difusão echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Desabilita Pacotes Fonte Roteados
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route

# Habilita a Proteção SYN Cookie do TCP
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Desabilita a Aceitação de Redireção de ICMP
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_redirects

# Não envia Mensagens de Redireção
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Descarta Pacotes Falsificados entrantes em uma interface, onde as
# respostas resultariam na resposta indo para uma interface diferente.
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Registra pacotes com endereços impossíveis.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians

# Seja verboso a respeito de endereços de IP dinâmicos de IP (não necessário
# no caso de IP estático)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# Desabilita a Notificação Explícita de Congestão
# roteadores demais ainda são ignorantes
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Configura um estado conhecido
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Estas linhas estão aqui no caso das regras já estiverem no lugar e o
# script for mesmo
# reexecutado em tempo real. Nós queremos remover
# todas as regras e cadeias preexistentes
# definidas por usuário(a)
# antes de implementarmos novas regras.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Permite conexões locais
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Permite o encaminhamento se a iniciada na intranet
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD ! -i WAN1 -m conntrack --ctstate NEW -j ACCEPT

# Faz o mascaramento (não necessário se a intranet não estiver usando
# endereços IP privados)
iptables -t nat -A POSTROUTING -o WAN1 -j MASQUERADE

# Registra tudo para depuração (última de todas as regras, porém antes
# das regras de política)
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
iptables -A FORWARD -j LOG --log-prefix "FIREWALL:FORWARD "
iptables -A OUTPUT -j LOG --log-prefix "FIREWALL:OUTPUT "

# Habilita o Encaminhamento de IP
echo 1 &gt; /proc/sys/net/ipv4/ip_forward</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
8 months ago
User avatar jamenson

Translation changed
<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts

cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Begin /etc/systemd/scripts/iptables

# Insert connection-tracking modules
# (not needed if built into the kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Enable broadcast echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Enable TCP SYN Cookie Protection
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptance
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Do not send Redirect Messages
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Drop Spoofed Packets coming in on an interface, where responses
# would result in the reply going out a different interface.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Log packets with impossible addresses.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# be verbose on dynamic ip-addresses (not needed in case of static IP)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# disable Explicit Congestion Notification
# too many routers are still ignorant
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Set a known state
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# These lines are here in case rules are already in place and the
# script is ever rerun on the fly. We want to remove all rules and
# pre-existing user defined chains before we implement new rules.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Allow local-only connections
iptables -A INPUT -i lo -j ACCEPT

# Free output on any interface to any ip for any service
# (equal to -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permit answers on already established connections
# and permit new connections related to established ones
# (e.g. port mode ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Log everything else.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# End /etc/systemd/scripts/iptables</literal>
EOF
chmod 700 /etc/systemd/scripts/iptables</userinput>
<?dbfo keep-together="auto"?><userinput>install -v -dm755 /etc/systemd/scripts

cat &gt; /etc/systemd/scripts/iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Início do /etc/systemd/scripts/iptables

# Insere módulos de rastreamento de conexão (não necessário se
# construído internamente ao kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Habilita difusão echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Desabilita Pacotes Fonte Roteados
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Habilita a Proteção SYN Cookie do TCP
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Desabilita a Aceitação de Redireção de ICMP
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Não envia Mensagens de Redireção
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Descarta Pacotes Falsificados entrantes em uma interface, onde as
# respostas resultariam na resposta indo para uma interface diferente.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Registra pacotes com endereços impossíveis.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# Seja verboso a respeitocerca de endereços de IP dinâmicos de IP (não necessário
# no caso de IP estático)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# Desabilita a Notificação Explícita de Congestão
# roteadores demais ainda são ignorantes
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Configura um estado conhecido
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Estas linhas estão aqui no caso das regras já estiverem no lugar e o
# script for mesmo
# reexecutado em tempo real. Nós queremos remover
# todas as regras e cadeias preexistentes
# definidas por usuário(a)
# antes de implementarmos novas regras.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Permite conexões locais somente
iptables -A INPUT -i lo -j ACCEPT

# Libera a saída gerada em qualquer interface para qualquer IP para
# qualquer serviço (igual a -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permite respostas em conexões já estabelecidas e permite novas
# conexões relacionadas às estabelecidas (por exemplo, modo de porta
# ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Registra tudo o mais.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# Fim do /etc/systemd/scripts/iptables</literal>
EOF
chmod 700 /etc/systemd/scripts/iptables</userinput>
8 months ago
User avatar None

Changes committed
Changes committed 8 months ago
User avatar jamenson

Translation completed
Translation completed 8 months ago
User avatar jamenson

Translation changed
<xref linkend="libpcap"/> (required for BPF compiler or nfsynproxy support), <ulink url="https://github.com/tadamdam/bpf-utils">bpf-utils</ulink> (required for Berkeley Packet Filter support), <ulink url="https://netfilter.org/projects/libnfnetlink/">libnfnetlink</ulink> (required for connlabel support), <ulink url="https://netfilter.org/projects/libnetfilter_conntrack/">libnetfilter_conntrack</ulink> (required for connlabel support), and <ulink url="https://netfilter.org/projects/nftables/">nftables</ulink>
<xref linkend="libpcap"/> (exigido para suporte ao compilador BPF ou nfsynproxy), <ulink url="https://github.com/tadamdam/bpf-utils">bpf-utils</ulink> (exigido para suporte ao Berkeley Packet Filter), <ulink url="https://netfilter.org/projects/libnfnetlink/">libnfnetlink</ulink> (exigido para suporte ao connlabel), <ulink url="https://netfilter.org/projects/libnetfilter_conntrack/">libnetfilter_conntrack</ulink> (exigido para suporte ao connlabel) e <ulink url="https://netfilter.org/projects/nftables/">nftables</ulink>
8 months ago
User avatar None

Changes committed
Changes committed 9 months ago
User avatar jamenson

Translation changed
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Begin rc.iptables

# Insert connection-tracking modules
# (not needed if built into the kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Enable broadcast echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Enable TCP SYN Cookie Protection
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptance
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Do not send Redirect Messages
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Drop Spoofed Packets coming in on an interface, where responses
# would result in the reply going out a different interface.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Log packets with impossible addresses.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# be verbose on dynamic ip-addresses (not needed in case of static IP)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# disable Explicit Congestion Notification
# too many routers are still ignorant
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Set a known state
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# These lines are here in case rules are already in place and the
# script is ever rerun on the fly. We want to remove all rules and
# pre-existing user defined chains before we implement new rules.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Allow local-only connections
iptables -A INPUT -i lo -j ACCEPT

# Free output on any interface to any ip for any service
# (equal to -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permit answers on already established connections
# and permit new connections related to established ones
# (e.g. port mode ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Drop any incoming MULTICAST or BROADCAST packet before logging:
# The box outputs several of them when using netbios or mDNS, and those
# appear immediately as incoming, which clutters the log.
iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP

# Log everything else.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# End $rc_base/rc.iptables</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Início do rc.iptables

# Insere módulos de rastreamento de conexão
# (não necessário se construído internamente ao kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Habilita difusão echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Desabilita Pacotes Fonte Roteados
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Habilita a Proteção SYN Cookie do TCP
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Desabilita a Aceitação de Redireção de ICMP
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Não envia Mensagens de Redireção
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Descarta Pacotes Falsificados entrantes em uma interface, onde as
# respostas resultariam na resposta indo para uma interface diferente.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Registra pacotes com endereços impossíveis.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# Seja detalhado acerca de endereços de IP dinâmicos (não necessário no caso de IP estático)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# Desabilita a Notificação Explícita de Congestão
# roteadores demais ainda são ignorantes
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Configura um estado conhecido
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Estas linhas estão aqui no caso das regras já estiverem no lugar e o
# scriptconjunto de comandos sequenciais for até mesmo
# reexecutado em tempo real. Nós queremos remover
# todas as regras e cadeias preexistentes definidas por usuário(a)
# antes de implementarmos novas regras.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Permite conexões locais somente
iptables -A INPUT -i lo -j ACCEPT

# Libera a saída gerada em qualquer interface para qualquer IP para
# qualquer serviço (igual a -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permite respostas em conexões já estabelecidas e permite novas
# conexões relacionadas às estabelecidas (por exemplo, modo de porta
# ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Descarte qualquer pacote MULTICAST ou BROADCAST entrante antes de registrar:
# A caixa gera vários deles ao usar netbios ou mDNS e aqueles aparecem imediatamente
# como entrantes, o que sobrecarrega o log.
iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP

# Registra tudo o mais.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# Fim do $rc_base/rc.iptables</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
9 months ago
User avatar jamenson

Translation changed
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Begin rc.iptables

# Insert connection-tracking modules
# (not needed if built into the kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Enable broadcast echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Enable TCP SYN Cookie Protection
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptance
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Do not send Redirect Messages
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Drop Spoofed Packets coming in on an interface, where responses
# would result in the reply going out a different interface.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Log packets with impossible addresses.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# be verbose on dynamic ip-addresses (not needed in case of static IP)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# disable Explicit Congestion Notification
# too many routers are still ignorant
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Set a known state
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# These lines are here in case rules are already in place and the
# script is ever rerun on the fly. We want to remove all rules and
# pre-existing user defined chains before we implement new rules.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Allow local-only connections
iptables -A INPUT -i lo -j ACCEPT

# Free output on any interface to any ip for any service
# (equal to -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permit answers on already established connections
# and permit new connections related to established ones
# (e.g. port mode ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Drop any incoming MULTICAST or BROADCAST packet before logging:
# The box outputs several of them when using netbios or mDNS, and those
# appear immediately as incoming, which clutters the log.
iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP

# Log everything else.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# End $rc_base/rc.iptables</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Início do rc.iptables

# Insere módulos de rastreamento de conexão
# (não necessário se construído internamente ao kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Habilita difusão echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Desabilita Pacotes Fonte Roteados
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Habilita a Proteção SYN Cookie do TCP
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Desabilita a Aceitação de Redireção de ICMP
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Não envia Mensagens de Redireção
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Descarta Pacotes Falsificados entrantes em uma interface, onde as
# respostas resultariam na resposta indo para uma interface diferente.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Registra pacotes com endereços impossíveis.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# Seja verboso a respeitodetalhado acerca de endereços de IP dinâmicos (não necessário
# no caso de IP estático)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# Desabilita a Notificação Explícita de Congestão
# roteadores demais ainda são ignorantes
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Configura um estado conhecido
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Estas linhas estão aqui no caso das regras já estiverem no lugar e o
# script for mesmo reexecutado em tempo real. Nós queremos remover
# todas as regras e cadeias preexistentes definidas por usuário(a)
# antes de implementarmos novas regras.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Permite conexões locais somente
iptables -A INPUT -i lo -j ACCEPT

# Libera a saída gerada em qualquer interface para qualquer IP para
# qualquer serviço (igual a -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permite respostas em conexões já estabelecidas e permite novas
# conexões relacionadas às estabelecidas (por exemplo, modo de porta
# ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Descarte qualquer pacote MULTICAST ou BROADCAST entrante antes de registrar:
# A caixa gera vários deles ao usar netbios ou mDNS e aqueles aparecem imediatamente
# como entrantes, o que sobrecarrega o log.
iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP

# Registra tudo o mais.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# Fim do $rc_base/rc.iptables</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
9 months ago
User avatar jamenson

Translation changed
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Begin rc.iptables

# Insert connection-tracking modules
# (not needed if built into the kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Enable broadcast echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable Source Routed Packets
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Enable TCP SYN Cookie Protection
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptance
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Do not send Redirect Messages
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Drop Spoofed Packets coming in on an interface, where responses
# would result in the reply going out a different interface.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Log packets with impossible addresses.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# be verbose on dynamic ip-addresses (not needed in case of static IP)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# disable Explicit Congestion Notification
# too many routers are still ignorant
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Set a known state
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# These lines are here in case rules are already in place and the
# script is ever rerun on the fly. We want to remove all rules and
# pre-existing user defined chains before we implement new rules.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Allow local-only connections
iptables -A INPUT -i lo -j ACCEPT

# Free output on any interface to any ip for any service
# (equal to -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permit answers on already established connections
# and permit new connections related to established ones
# (e.g. port mode ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Drop any incoming MULTICAST or BROADCAST packet before logging:
# The box outputs several of them when using netbios or mDNS, and those
# appear immediately as incoming, which clutters the log.
iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP

# Log everything else.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# End $rc_base/rc.iptables</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
<?dbfo keep-together="auto"?><userinput>cat &gt; /etc/rc.d/rc.iptables &lt;&lt; "EOF"
<literal>#!/bin/sh

# Início do rc.iptables

# Insere módulos de rastreamento de conexão
# (não necessário se construído internamente ao kernel)
modprobe nf_conntrack
modprobe xt_LOG

# Habilita difusão echo Protection
echo 1 &gt; /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Desabilita Pacotes Fonte Roteados
echo 0 &gt; /proc/sys/net/ipv4/conf/all/accept_source_route
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_source_route

# Habilita a Proteção SYN Cookie do TCP
echo 1 &gt; /proc/sys/net/ipv4/tcp_syncookies

# Desabilita a Aceitação de Redireção de ICMP
echo 0 &gt; /proc/sys/net/ipv4/conf/default/accept_redirects

# Não envia Mensagens de Redireção
echo 0 &gt; /proc/sys/net/ipv4/conf/all/send_redirects
echo 0 &gt; /proc/sys/net/ipv4/conf/default/send_redirects

# Descarta Pacotes Falsificados entrantes em uma interface, onde as
# respostas resultariam na resposta indo para uma interface diferente.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 &gt; /proc/sys/net/ipv4/conf/default/rp_filter

# Registra pacotes com endereços impossíveis.
echo 1 &gt; /proc/sys/net/ipv4/conf/all/log_martians
echo 1 &gt; /proc/sys/net/ipv4/conf/default/log_martians

# Seja verboso a respeito de endereços de IP dinâmicos (não necessário
# no caso de IP estático)
echo 2 &gt; /proc/sys/net/ipv4/ip_dynaddr

# Desabilita a Notificação Explícita de Congestão
# roteadores demais ainda são ignorantes
echo 0 &gt; /proc/sys/net/ipv4/tcp_ecn

# Configura um estado conhecido
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Estas linhas estão aqui no caso das regras já estiverem no lugar e o
# script for mesmo reexecutado em tempo real. Nós queremos remover
# todas as regras e cadeias preexistentes definidas por usuário(a)
# antes de implementarmos novas regras.
iptables -F
iptables -X
iptables -Z

iptables -t nat -F

# Permite conexões locais somente
iptables -A INPUT -i lo -j ACCEPT

# Libera a saída gerada em qualquer interface para qualquer IP para
# qualquer serviço (igual a -P ACCEPT)
iptables -A OUTPUT -j ACCEPT

# Permite respostas em conexões já estabelecidas e permite novas
# conexões relacionadas às estabelecidas (por exemplo, modo de porta
# ftp)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Descarte qualquer pacote MULTICAST ou BROADCAST entrante antes de registrar:
# A caixa gera vários deles ao usar netbios ou mDNS e aqueles aparecem imediatamente
# como entrantes, o que sobrecarrega o log.
iptables -A INPUT -m addrtype --dst-type BROADCAST,MULTICAST -j DROP

# Registra tudo o mais.
iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "

# Fim do $rc_base/rc.iptables</literal>
EOF
chmod 700 /etc/rc.d/rc.iptables</userinput>
9 months ago
Browse all component changes