Merci pour ta réponse ...
J'ai testé et j'arrive pas a le faire fonctionner ... néanmoins j'ai un script un peu spécial ... c un script qu'un mec a fait et que je trouvais tres clair au niveau de la config pour qcn qui ne s'y connait pas bcp ... ( http://monmotha.mplug.org/firewall/index.php)
J'ai mit en gras ce que j'ai modifié mais je pense que j'applique pas ces regles a la bonne chaine ... (g pas encore bien comprit comment ca marchait les chaines qu'on ajoute).
J'ai quelques questions subsidiaires :
- le modprobe ip_conntrack_ftp je le met ou dans le script ? au debut c bon ...
- dans les lignes que tu m'as filé tu parles du port 20 ? Je ne pense pas que je dois l'ouvrir pour la chaine INPUT ?? Pour toi le $highport c bien synonyme de 1024:65535
Merci par avance !
IPTABLES="/sbin/iptables" #set to your iptables location, must be set
DNS="" #set to your DNS server(s) that you get zones from
TCP_ALLOW="21 22 80 27012 27015" #TCP ports to ALLOW
UDP_ALLOW="27012 27015" #UDP ports to ALLOW (53 not needed, covered by DNS above)
INET_IFACE="ppp0" #the interface your internet's on (one only), must be set
LAN_IFACE="eth0" #the interface(s) your LAN's on (currently unused)
USE_SSH1="TRUE" #set to TRUE if you use "real" SSH1 (anything else is interpreted as FALSE)
USE_OPENSSH="FALSE" #set to TRUE if you use OpenSSH (anything else is interpreted as FALSE)
INTERNAL_LAN="192.168.1.0/20" #the internal network(s), must be set
AUTH_ALLOW="" #IPs allowed to use the AUTH service (leave blank and put 113 in TCP_ALLOW for all)
DENY_ALL="" #internet hosts to explicitly deny from accessing your system at all
DROP="REJECT" #what to do with packets we don't want
# You shouldn't need to modify anything below here |
# ----------------------------------------------------------------------|
# Let's load it!
echo "Loading iptables firewall:"
# Turn on IP forwarding
echo -n "Checking IP Forwarding..."
if [ -e /proc/sys/net/ipv4/ip_forward ] ; then
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "enabled."
else
echo "support not found! This will probably cause problems!"
fi
# Enable TCP Syncookies
echo -n "Checking IP SynCookies..."
if [ -e /proc/sys/net/ipv4/tcp_syncookies ] ; then
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo "enabled."
else
echo "support not found, but that's OK."
fi
# Flush everything
# If you need compatability, you can comment some or all of these out,
# but remember, if you re-run it, it'll just add the new rules in, it
# won't remove the old ones for you then, this is how it removes them.
#
# You'll notice I give status now 
echo -n "Flush: "
${IPTABLES} -t filter -F INPUT
echo -n "INPUT "
${IPTABLES} -t filter -F OUTPUT
echo -n "OUTPUT1 "
${IPTABLES} -t filter -F FORWARD
echo -n "FORWARD "
${IPTABLES} -t nat -F PREROUTING
echo -n "PREROUTING1 "
${IPTABLES} -t nat -F OUTPUT
echo -n "OUTPUT2 "
${IPTABLES} -t nat -F POSTROUTING
echo -n "POSTROUTING "
${IPTABLES} -t mangle -F PREROUTING
echo -n "PREROUTING2 "
${IPTABLES} -t mangle -F OUTPUT
echo -n "OUTPUT3"
echo
# Create new chains
# Output to /dev/null in case the script hasn't been run yet
echo -n "Creating chains: "
${IPTABLES} -t filter -F INETIN > /dev/null 2>&1
${IPTABLES} -t filter -X INETIN > /dev/null 2>&1
${IPTABLES} -t filter -N INETIN
echo -n "INETIN "
${IPTABLES} -t filter -F INETOUT > /dev/null 2>&1
${IPTABLES} -t filter -X INETOUT > /dev/null 2>&1
${IPTABLES} -t filter -N INETOUT
echo -n "INETOUT "
echo
# Default Policies
# INPUT is still ACCEPT, the INETIN chain (defined above and jumped to later)
# is given a policy of DROP at the end
echo -n "Default Policies: "
${IPTABLES} -t filter -P INPUT ACCEPT
echo -n "INPUT:ACCEPT "
${IPTABLES} -t filter -P OUTPUT ACCEPT
echo -n "OUTPUT:ACCEPT "
${IPTABLES} -t filter -P FORWARD DROP
echo -n "FORWARD:DROP "
echo
# Security
echo -n "Local Traffic Rules: "
for subnet in ${INTERNAL_LAN} ; do
${IPTABLES} -t filter -A FORWARD -s ${subnet} -j ACCEPT
${IPTABLES} -t filter -A FORWARD -d ${subnet} -j ACCEPT
echo -n "${subnet}:ACCEPT "
done
echo
# Set up basic NAT
# I assume masquerading here, which is technically for dynamic IPs, but
# it should still work with a static. If you want to be proper, change
# it accordingly.
echo -n "Setting up NAT: "
for subnet in ${INTERNAL_LAN} ; do
${IPTABLES} -t nat -A POSTROUTING -s ${subnet} -o ${INET_IFACE} -j MASQUERADE
echo -n "${subnet}:MASQUERADE "
done
echo
# Set up INET chains
echo -n "Setting up INET chains: "
${IPTABLES} -t filter -A INPUT -i ${INET_IFACE} -j INETIN
echo -n "INETIN "
${IPTABLES} -t filter -A OUTPUT -o ${INET_IFACE} -j INETOUT
echo -n "INETOUT "
echo
# Flood security
# You'll still respond to these if they comply with the limits
# Default limits are 1/sec for ICMP pings
# SYN Flood protection moved to a port-based basis because of the side
# effect that it allowed all SYN packets through regardless if they
# compiled with the limits. SYN flood protection is still in here, see
# the TCP_ALLOW loop for the new method
echo -n "Flood Protection: "
# Ping Floods (ICMP echo-request)
${IPTABLES} -t filter -A INETIN -p icmp --icmp-type echo-request -m limit --limit 1/s -i ${INET_IFACE} -j ACCEPT
echo -n "ICMP-PING "
echo
# Allow the rest of the ICMP in
echo -n "Allowing ICMP in..."
${IPTABLES} -t filter -A INETIN -p icmp --icmp-type ! echo-request -j ACCEPT
echo "done"
#Explicit denies
echo -n "Denying hosts: "
for host in ${DENY_ALL} ; do
${IPTABLES} -t filter -A INETIN -s ${host} -j ${DROP}
echo -n "${host}:${DROP}"
done
echo
#Start allowing stuff
echo -n "TCP Input Allow: "
for port in ${TCP_ALLOW} ; do
if [ "0$port" == "021" ]; then #Active FTP (thanks steff)
${IPTABLES} -t filter -A INETIN -p tcp --sport 20 --dport 1024:65535 ! --syn -j ACCEPT
fi
${IPTABLES} -t filter -A INETIN -p tcp --dport ${port} ! --syn -j ACCEPT
${IPTABLES} -t filter -A INETIN -p tcp --dport ${port} --syn -m limit --limit 2/s -j ACCEPT
echo -n "${port} "
done
# FTP Active mode
${IPTABLES} -A FORWARD -i ${LAN_IFACE} -o ${INET_IFACE} -p tcp --sport 1024:65535 -m state --state ESTABLISHED ! --syn -j ACCEPT
${IPTABLES} -A FORWARD -i ${LAN_IFACE} -o ${INET_IFACE} -p tcp --dport 20 --sport 1024:65535 -m state --state ESTABLISHED ! --syn -j ACCEPT
${IPTABLES} -A FORWARD -i ${INET_IFACE} -o ${LAN_IFACE} -p tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED ! --syn -j ACCEPT
${IPTABLES} -A FORWARD -i ${INET_IFACE} -o ${LAN_IFACE} -p tcp --sport 20 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
echo
echo -n "UDP Input Allow: "
for port in ${UDP_ALLOW} ; do
${IPTABLES} -t filter -A INETIN -p udp --dport ${port} -j ACCEPT
echo -n "${port} "
done
echo
echo -n "DNS Servers: "
for server in ${DNS} ; do
${IPTABLES} -t filter -A INETIN -p udp -s ${server} --sport 53 -j ACCEPT
echo -n "${server} "
done
echo
#SSH Rulesets
if [ $USE_SSH1 = TRUE ]; then #SSH1
echo -n "Accounting for SSH..."
${IPTABLES} -t filter -A INETIN -p tcp --sport 22 --dport 513:1023 ! --syn -j ACCEPT
echo -n "SSH1 "
fi
if [ $USE_OPENSSH = TRUE ] ; then #OpenSSH
if [ ! $USE_SSH1 = TRUE ] ; then #We need to echo "Accounting for SSH..."
echo -n "Accounting for SSH..."
fi
${IPTABLES} -t filter -A INETIN -p tcp --sport 22 --dport 1024:65535 ! --syn -j ACCEPT
echo -n "OpenSSH "
fi
echo
#AUTH(identd) host-based allows
if [ "$AUTH_ALLOW" != "" ] ; then
echo -n "AUTH accepts: "
for host in ${AUTH_ALLOW} ; do
${IPTABLES} -t filter -A INETIN -p tcp -s ${host} --dport 113 -j ACCEPT
echo -n "${host} "
done
echo
fi
echo -n "Allowing established outbound connections back in..."
${IPTABLES} -t filter -A INETIN -m state --state ESTABLISHED,RELATED -j ACCEPT
echo "done"
echo -n "Setting up INET Policies: "
# Drop if we cant find a valid inbound rule.
${IPTABLES} -t filter -A INETIN -j ${DROP}
echo -n "INETIN:${DROP} "
#We can send what we want to the internet
${IPTABLES} -t filter -A INETOUT -j ACCEPT
echo -n "INETOUT:ACCEPT "
echo "Done loading the firewall!"
Message édité par SCREAM78 le 30-11-2002 à 17:55:30
---------------
Gates gave us the windows ... Linux gave us the whole house ...
