tiago.ferreira/Seguran-a-em-Sistemas-Operacionais-de-Redes-II
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Atualizar conf-rede

Browse Source
This commit is contained in:
tiago.ferreira
2026-09-15 20:18:53 +00:00
parent b50046d497
commit c7b7f922c0
1 changed files with 189 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf-rede
+187 -151
View File
@@ -5,19 +5,18 @@ set -e
# ============================================================ # ============================================================
# CONFIGURAÇÃO DE REDE / GATEWAY - DEBIAN 13 # CONFIGURAÇÃO DE REDE / GATEWAY - DEBIAN 13
# #
# Funções:
# - Detecta interfaces de rede # - Detecta interfaces de rede
# - Recria /etc/network/interfaces # - Recria /etc/network/interfaces
# - DHCP / Estático / Não configurar por interface # - DHCP / IP estático / Não configurar
# - Pergunta se a máquina será gateway # - Configura /etc/resolv.conf
# - Permite selecionar a interface de saída (WAN) # - Configura gateway IPv4
# - Ativa IPv4 forwarding permanentemente # - Ativa ip_forward permanentemente
# - Configura nftables # - Configura nftables
# - Configura masquerade (NAT) permanentemente # - Configura masquerade permanente
# #
# Compatível com: # Compatível com:
#
# curl -fsSL URL | bash # curl -fsSL URL | bash
#
# ============================================================ # ============================================================
@@ -43,12 +42,9 @@ valid_ipv4() {
[ "${#octets[@]}" -eq 4 ] || return 1 [ "${#octets[@]}" -eq 4 ] || return 1
for octet in "${octets[@]}"; do for octet in "${octets[@]}"; do
[[ "$octet" =~ ^[0-9]+$ ]] || return 1 [[ "$octet" =~ ^[0-9]+$ ]] || return 1
[ "$octet" -ge 0 ] 2>/dev/null || return 1 [ "$octet" -ge 0 ] 2>/dev/null || return 1
[ "$octet" -le 255 ] 2>/dev/null || return 1 [ "$octet" -le 255 ] 2>/dev/null || return 1
done done
return 0 return 0
@@ -56,7 +52,6 @@ valid_ipv4() {
yes_answer() { yes_answer() {
case "$1" in case "$1" in
s|S|sim|SIM|Sim|y|Y|yes|YES|Yes) s|S|sim|SIM|Sim|y|Y|yes|YES|Yes)
return 0 return 0
@@ -73,13 +68,10 @@ yes_answer() {
# ============================================================ # ============================================================
if [ "$EUID" -ne 0 ]; then if [ "$EUID" -ne 0 ]; then
echo echo
echo "ERRO: execute este script como root." echo "ERRO: execute este script como root."
echo echo
exit 1 exit 1
fi fi
@@ -91,30 +83,11 @@ clear 2>/dev/null || true
echo echo
echo "============================================================" echo "============================================================"
echo " CONFIGURAÇÃO DE REDE - DEBIAN 13" echo " CONFIGURAÇÃO DE REDE / GATEWAY - DEBIAN 13"
echo "============================================================" echo "============================================================"
echo echo
# ============================================================
# VERIFICA NFTABLES
# ============================================================
if ! command -v nft >/dev/null 2>&1; then
echo "ERRO: nftables não está instalado."
echo
echo "Instale antes com:"
echo
echo " apt update"
echo " apt install nftables"
echo
exit 1
fi
# ============================================================ # ============================================================
# DETECTA INTERFACES # DETECTA INTERFACES
# ============================================================ # ============================================================
@@ -131,18 +104,14 @@ mapfile -t INTERFACES < <(
if [ "${#INTERFACES[@]}" -eq 0 ]; then if [ "${#INTERFACES[@]}" -eq 0 ]; then
echo "ERRO: nenhuma interface de rede encontrada." echo "ERRO: nenhuma interface de rede encontrada."
exit 1 exit 1
fi fi
echo "Interfaces encontradas:" echo "Interfaces encontradas:"
echo echo
for IFACE in "${INTERFACES[@]}"; do for IFACE in "${INTERFACES[@]}"; do
MAC="desconhecido" MAC="desconhecido"
@@ -170,21 +139,23 @@ done
echo "ATENÇÃO:" echo "ATENÇÃO:"
echo echo
echo "O arquivo /etc/network/interfaces será recriado." echo "Os seguintes arquivos poderão ser alterados:"
echo
echo " /etc/network/interfaces"
echo " /etc/resolv.conf"
echo " /etc/sysctl.d/99-ip-forward.conf"
echo " /etc/nftables.conf"
echo echo
read_tty "Deseja continuar? [S/n]: " CONFIRM read_tty "Deseja continuar? [S/n]: " CONFIRM
case "$CONFIRM" in case "$CONFIRM" in
n|N|nao|não|NAO|NÃO) n|N|nao|não|NAO|NÃO)
echo echo
echo "Operação cancelada." echo "Operação cancelada."
exit 0 exit 0
;; ;;
esac esac
@@ -197,30 +168,44 @@ BACKUP_DIR="/root/network-backup-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$BACKUP_DIR" mkdir -p "$BACKUP_DIR"
if [ -f /etc/network/interfaces ]; then for FILE in \
/etc/network/interfaces \
/etc/resolv.conf \
/etc/nftables.conf \
/etc/sysctl.d/99-ip-forward.conf
cp -a /etc/network/interfaces \ do
"$BACKUP_DIR/interfaces"
if [ -e "$FILE" ]; then
cp -a "$FILE" "$BACKUP_DIR/$(basename "$FILE")"
fi fi
done
if [ -f /etc/nftables.conf ]; then
cp -a /etc/nftables.conf \
"$BACKUP_DIR/nftables.conf"
fi
echo echo
echo "Backup:" echo "Backup criado em:"
echo
echo " $BACKUP_DIR" echo " $BACKUP_DIR"
echo echo
# ============================================================ # ============================================================
# CRIA /etc/network/interfaces # VARIÁVEIS
# ============================================================
CONFIGURED_INTERFACES=()
DNS_SERVERS=()
DNS_SEARCH=""
STATIC_INTERFACE_FOUND=0
# ============================================================
# RECRIA /etc/network/interfaces
# ============================================================ # ============================================================
cat > /etc/network/interfaces <<'EOF' cat > /etc/network/interfaces <<'EOF'
@@ -236,14 +221,7 @@ EOF
# ============================================================ # ============================================================
# INTERFACES CONFIGURADAS # CONFIGURA INTERFACES
# ============================================================
CONFIGURED_INTERFACES=()
# ============================================================
# CONFIGURA CADA INTERFACE
# ============================================================ # ============================================================
for IFACE in "${INTERFACES[@]}"; do for IFACE in "${INTERFACES[@]}"; do
@@ -307,6 +285,8 @@ EOF
2) 2)
STATIC_INTERFACE_FOUND=1
echo echo
echo "Configuração estática de $IFACE" echo "Configuração estática de $IFACE"
echo echo
@@ -335,7 +315,7 @@ EOF
while true; do while true; do
read_tty "Prefixo [ex.: 24]: " PREFIX read_tty "Prefixo da rede [ex.: 24]: " PREFIX
if [[ "$PREFIX" =~ ^[0-9]+$ ]] && if [[ "$PREFIX" =~ ^[0-9]+$ ]] &&
[ "$PREFIX" -ge 0 ] && [ "$PREFIX" -ge 0 ] &&
@@ -345,7 +325,7 @@ EOF
fi fi
echo "Prefixo inválido." echo "Prefixo inválido. Informe um valor entre 0 e 32."
done done
@@ -377,7 +357,7 @@ EOF
while true; do while true; do
read_tty "DNS [ex.: 172.16.0.2 8.8.8.8] [ENTER para nenhum]: " DNS read_tty "DNS [ex.: 8.8.8.8 1.1.1.1] [ENTER para nenhum]: " DNS
if [ -z "$DNS" ]; then if [ -z "$DNS" ]; then
break break
@@ -399,7 +379,7 @@ EOF
break break
fi fi
echo "DNS inválido." echo "Um ou mais servidores DNS são inválidos."
done done
@@ -408,11 +388,11 @@ EOF
# DNS SEARCH # DNS SEARCH
# ------------------------------------------------ # ------------------------------------------------
read_tty "Domínio de pesquisa DNS [ENTER para nenhum]: " DNS_SEARCH read_tty "Domínio de pesquisa DNS [ENTER para nenhum]: " CURRENT_DNS_SEARCH
# ------------------------------------------------ # ------------------------------------------------
# GRAVA # GRAVA INTERFACE
# ------------------------------------------------ # ------------------------------------------------
cat >> /etc/network/interfaces <<EOF cat >> /etc/network/interfaces <<EOF
@@ -429,26 +409,26 @@ EOF
if [ -n "$GATEWAY" ]; then if [ -n "$GATEWAY" ]; then
echo " gateway $GATEWAY" >> /etc/network/interfaces
echo " gateway $GATEWAY" \
>> /etc/network/interfaces
fi fi
if [ -n "$DNS" ]; then if [ -n "$DNS" ]; then
echo " dns-nameservers $DNS" >> /etc/network/interfaces
echo " dns-nameservers $DNS" \ for DNS_IP in $DNS; do
>> /etc/network/interfaces DNS_SERVERS+=("$DNS_IP")
done
fi fi
if [ -n "$DNS_SEARCH" ]; then if [ -n "$CURRENT_DNS_SEARCH" ]; then
echo " dns-search $DNS_SEARCH" \ echo " dns-search $CURRENT_DNS_SEARCH" \
>> /etc/network/interfaces >> /etc/network/interfaces
DNS_SEARCH="$CURRENT_DNS_SEARCH"
fi fi
@@ -478,7 +458,7 @@ EOF
*) *)
echo echo
echo "Opção inválida." echo "Opção inválida. Escolha 1, 2 ou 3."
;; ;;
esac esac
@@ -491,6 +471,51 @@ done
chmod 644 /etc/network/interfaces chmod 644 /etc/network/interfaces
# ============================================================
# CONFIGURA /etc/resolv.conf
# ============================================================
if [ "${#DNS_SERVERS[@]}" -gt 0 ]; then
echo
echo "Configurando /etc/resolv.conf..."
cat > /etc/resolv.conf <<'EOF'
# ============================================================
# Configuração DNS
# Gerada automaticamente
# ============================================================
EOF
if [ -n "$DNS_SEARCH" ]; then
echo "search $DNS_SEARCH" >> /etc/resolv.conf
fi
# Remove duplicatas
mapfile -t UNIQUE_DNS < <(
printf "%s\n" "${DNS_SERVERS[@]}" |
awk '!seen[$0]++'
)
for DNS_IP in "${UNIQUE_DNS[@]}"; do
echo "nameserver $DNS_IP" >> /etc/resolv.conf
done
chmod 644 /etc/resolv.conf
fi
# ============================================================ # ============================================================
# GATEWAY # GATEWAY
# ============================================================ # ============================================================
@@ -501,30 +526,46 @@ echo " CONFIGURAÇÃO DE GATEWAY"
echo "============================================================" echo "============================================================"
echo echo
read_tty "Esta máquina será gateway para outras redes? [s/N]: " IS_GATEWAY read_tty "Esta máquina será gateway para outras máquinas/redes? [s/N]: " IS_GATEWAY
if yes_answer "$IS_GATEWAY"; then if yes_answer "$IS_GATEWAY"; then
# ======================================================== # ========================================================
# VERIFICA INTERFACES CONFIGURADAS # NFTABLES
# ======================================================== # ========================================================
if ! command -v nft >/dev/null 2>&1; then
echo
echo "ERRO: nftables não está instalado."
echo
echo "Instale com:"
echo
echo " apt update"
echo " apt install nftables"
echo
exit 1
fi
if [ "${#CONFIGURED_INTERFACES[@]}" -lt 2 ]; then if [ "${#CONFIGURED_INTERFACES[@]}" -lt 2 ]; then
echo echo
echo "ATENÇÃO:" echo "ATENÇÃO:"
echo echo
echo "Um gateway normalmente precisa de pelo menos" echo "Foram configuradas menos de duas interfaces."
echo "duas interfaces configuradas." echo "Um gateway normalmente utiliza pelo menos uma WAN e uma LAN."
echo echo
fi fi
# ======================================================== # ========================================================
# SELEÇÃO DA WAN # SELECIONA WAN
# ======================================================== # ========================================================
echo echo
@@ -568,12 +609,31 @@ if yes_answer "$IS_GATEWAY"; then
echo echo
echo "Interface WAN selecionada: $WAN_INTERFACE" echo "Interface WAN selecionada:"
echo
echo " $WAN_INTERFACE"
echo echo
# ======================================================== # ========================================================
# FORWARD IPV4 PERMANENTE # INTERFACES LAN
# ========================================================
LAN_INTERFACES=()
for IFACE in "${CONFIGURED_INTERFACES[@]}"; do
if [ "$IFACE" != "$WAN_INTERFACE" ]; then
LAN_INTERFACES+=("$IFACE")
fi
done
# ========================================================
# IP FORWARD
# ======================================================== # ========================================================
echo "Ativando IPv4 forwarding..." echo "Ativando IPv4 forwarding..."
@@ -595,24 +655,22 @@ EOF
# NFTABLES # NFTABLES
# ======================================================== # ========================================================
echo "Configurando nftables..." echo "Criando configuração do nftables..."
cat > /etc/nftables.conf <<EOF cat > /etc/nftables.conf <<EOF
#!/usr/sbin/nft -f #!/usr/sbin/nft -f
# ============================================================ # ============================================================
# Firewall / Gateway # NFTABLES - GATEWAY IPV4
# Debian 13 # Gerado automaticamente
#
# Arquivo gerado automaticamente
# ============================================================ # ============================================================
flush ruleset flush ruleset
# ============================================================ # ============================================================
# FILTRO # FILTER
# ============================================================ # ============================================================
table inet filter { table inet filter {
@@ -630,27 +688,21 @@ table inet filter {
type filter hook forward priority filter; type filter hook forward priority filter;
policy drop; policy drop;
# Permite conexões já estabelecidas # Tráfego já estabelecido
ct state established,related accept ct state established,related accept
# Permite tráfego entrando pelas interfaces internas
# e saindo pela WAN
EOF EOF
# ======================================================== # ========================================================
# ADICIONA INTERFACES LAN # REGRAS LAN -> WAN
# ======================================================== # ========================================================
for IFACE in "${CONFIGURED_INTERFACES[@]}"; do for LAN_INTERFACE in "${LAN_INTERFACES[@]}"; do
if [ "$IFACE" != "$WAN_INTERFACE" ]; then echo " iifname \"$LAN_INTERFACE\" oifname \"$WAN_INTERFACE\" accept" \
echo " iifname \"$IFACE\" oifname \"$WAN_INTERFACE\" accept" \
>> /etc/nftables.conf >> /etc/nftables.conf
fi
done done
@@ -662,7 +714,7 @@ EOF
# ============================================================ # ============================================================
# NAT IPv4 # NAT
# ============================================================ # ============================================================
table ip nat { table ip nat {
@@ -681,19 +733,20 @@ EOF
# ======================================================== # ========================================================
# TESTA NFTABLES # VALIDA NFTABLES
# ======================================================== # ========================================================
echo echo
echo "Validando regras do nftables..." echo "Validando regras do nftables..."
if ! nft -c -f /etc/nftables.conf; then if ! nft -c -f /etc/nftables.conf; then
echo echo
echo "ERRO:" echo "ERRO: configuração inválida do nftables."
echo "A configuração do nftables possui algum problema." echo
echo "Backup disponível em:"
echo echo
echo "O backup está em:"
echo " $BACKUP_DIR" echo " $BACKUP_DIR"
echo echo
@@ -703,7 +756,7 @@ EOF
# ======================================================== # ========================================================
# ATIVA NFTABLES # ATIVA
# ======================================================== # ========================================================
echo echo
@@ -719,37 +772,6 @@ EOF
systemctl restart nftables systemctl restart nftables
# ========================================================
# RESULTADO GATEWAY
# ========================================================
echo
echo "============================================================"
echo " GATEWAY CONFIGURADO"
echo "============================================================"
echo
echo "WAN:"
echo " $WAN_INTERFACE"
echo
echo "IPv4 Forwarding:"
echo " ATIVADO"
echo
echo "NAT / Masquerade:"
echo " ATIVADO"
echo
else
# ========================================================
# NÃO É GATEWAY
# ========================================================
echo
echo "A máquina não será configurada como gateway."
echo
fi fi
@@ -763,26 +785,41 @@ echo " CONFIGURAÇÃO FINAL"
echo "============================================================" echo "============================================================"
echo echo
echo "/etc/network/interfaces:"
echo "Arquivo de interfaces:"
echo echo
echo "------------------------------------------------------------" echo "------------------------------------------------------------"
cat /etc/network/interfaces cat /etc/network/interfaces
echo "------------------------------------------------------------"
echo
echo "DNS:"
echo
echo "------------------------------------------------------------"
cat /etc/resolv.conf
echo "------------------------------------------------------------" echo "------------------------------------------------------------"
if yes_answer "$IS_GATEWAY"; then if yes_answer "$IS_GATEWAY"; then
echo echo
echo "IPv4 Forward:" echo "Gateway:"
echo
echo "WAN : $WAN_INTERFACE"
if [ "${#LAN_INTERFACES[@]}" -gt 0 ]; then
echo "LAN : ${LAN_INTERFACES[*]}"
fi
echo "IPv4 Forward : $(sysctl -n net.ipv4.ip_forward)"
echo "Masquerade : ativado"
echo echo
sysctl net.ipv4.ip_forward echo "------------------------------------------------------------"
echo "NFTABLES"
echo
echo "Regras nftables:"
echo
echo "------------------------------------------------------------" echo "------------------------------------------------------------"
nft list ruleset nft list ruleset
@@ -800,7 +837,7 @@ sync
# ============================================================ # ============================================================
# FINALIZAÇÃO # FINALIZA
# ============================================================ # ============================================================
echo echo
@@ -808,14 +845,13 @@ echo "============================================================"
echo " CONFIGURAÇÃO CONCLUÍDA" echo " CONFIGURAÇÃO CONCLUÍDA"
echo "============================================================" echo "============================================================"
echo echo
echo "Backup da configuração anterior:" echo "Backup:"
echo echo
echo " $BACKUP_DIR" echo " $BACKUP_DIR"
echo echo
echo "Recomenda-se reiniciar a máquina para aplicar" echo "A configuração foi gravada."
echo "completamente a nova configuração de interfaces."
echo echo
echo "Execute:" echo "Recomenda-se reiniciar a máquina:"
echo echo
echo " reboot" echo " reboot"
echo echo