| sharlaan |
Salut,
voila mon 1er script mais je sais pas si c'est bon.
Ma config :
Code :
- ----------------- --------------
- | Routeur ADSL | | Moi |
- | 192.168.1.254 |<---------->| IP = DHCP |
- | Serveur DHCP | | |
- ----------------- --------------
|
Ce que je veux : HTTP + HTTPS (surf), FTP (envoyer des fichiers et recevoir d'internet), IRC, MSN, JABBER, EMERGE.
Voila ce que j'ai fais :
Code :
- #!/bin/sh
- IPTABLES=/sbin/iptables
- modprobe ip_conntrack_irc
- $IPTABLES -P INPUT DROP
- $IPTABLES -P OUTPUT DROP
- $IPTABLES -P FORWARD DROP
- # "On accepte le traffic sur 'lo'"
- $IPTABLES -A INPUT -i lo -j ACCEPT
- $IPTABLES -A OUTPUT -o lo -j ACCEPT
- $IPTABLES -A FORWARD -i lo -j ACCEPT
- $IPTABLES -A FORWARD -o lo -j ACCEPT
- # "On accepte le traffic sur le réseau local"
- $IPTABLES -A INPUT -i $INTERNAL_IF -j ACCEPT
- $IPTABLES -A OUTPUT -o $INTERNAL_IF -j ACCEPT
- $IPTABLES -A FORWARD -i $INTERNAL_IF -j ACCEPT
- $IPTABLES -A FORWARD -o $INTERNAL_IF -j ACCEPT
- # On loggue les packets DROPés
- $IPTABLES -A LOG_DROP -j LOG --log-prefix "[IPT] "
- $IPTABLES -A LOG_DROP -j DROP
- # Local <-> Internet
- $IPTABLES -A INPUT -i $EXTERNAL_IF -p tcp --sport www -m state --state ESTABLISHED,RELATED -j ACCEPT
- $IPTABLES -A OUTPUT -o $EXTERNAL_IF -p tcp --dport www -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
- # Internet <-> Local
- $IPTABLES -A INPUT -i $EXTERNAL_IF -p tcp -m multiport --sports www,https -m state --state ESTABLISHED,RELATED -j ACCEPT
- $IPTABLES -A OUTPUT -o $EXTERNAL_IF -p tcp -m multiport --dports www,https -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
- # DCC -> ??? cf lea-linux
- $IPTABLES -A OUTPUT -o $EXTERNAL_IF -p tcp --sport 1024:65535 --dport 1024:65535 -m state --state NEW -j ACCEPT
- # Ping
- $IPTABLES -A OUTPUT -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
- $IPTABLES -A INPUT -p icmp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
- $IPTABLES -A INPUT -p icmp -m state --state RELATED,ESTABLISHED -j ACCEPT
- $IPTABLES -A INPUT -p icmp -m state --state NEW -m limit --limit 10/min -j ACCEPT
- # Identification IP-nom
- $IPTABLES -A INPUT -i $EXTERNAL_IF -p tcp --sport domain -m state --state ESTABLISHED,RELATED -j ACCEPT
- $IPTABLES -A OUTPUT -o $EXTERNAL_IF -p tcp --dport domain -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
- $IPTABLES -A INPUT -i $EXTERNAL_IF -p udp --sport domain -m state --state ESTABLISHED,RELATED -j ACCEPT
- $IPTABLES -A OUTPUT -o $EXTERNAL_IF -p udp --dport domain -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
- # Rsync
- $IPTABLES -A INPUT -i $EXTERNAL_IF -p tcp --sport rsync -m state --state ESTABLISHED,RELATED -j ACCEPT
- $IPTABLES -A OUTPUT -o $EXTERNAL_IF -p tcp --dport rsync -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
- # Accelere les connections sur IRC
- IPTABLES -A OUTPUT -o $EXTERNAL_IF -p tcp --sport auth -m state --state ESTABLISHED,RELATED -j ACCEPT
- $IPTABLES -A INPUT -i $EXTERNAL_IF -p tcp --dport auth -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
- # Loggue avec Syslogd
- $IPTABLES -A FORWARD -j LOG_DROP
- $IPTABLES -A INPUT -j LOG_DROP
- $IPTABLES -A OUTPUT -j LOG_DROP
|
C'est bon ?
Edit : je l'ai fais à partir de http://lea-linux.org/reseau/murdefeu.php3 |
