fifo026 wrote:
J'ai oublié de changer le sujet ... Désolé
Sujet : firewall .. :)
(1) Mettez-vous dans /etc/rc.d/rc.local :
##
/usr/sbin/iptables-restore < /etc/rc.d/rc.iptables
##
(2) copiez à /etc/rc.d/rc.iptables
Fait les changes pour passerelle, eth? et IP
##############################################################
##############################################################
# Generated by iptables-save v1.3.3 on Wed Feb 8 20:08:53 2006
*nat
:PREROUTING ACCEPT [315:15616]
:POSTROUTING ACCEPT [202:12236]
:OUTPUT ACCEPT [202:12236]
COMMIT
# Completed on Wed Feb 8 20:08:53 2006
# Generated by iptables-save v1.3.3 on Wed Feb 8 20:08:53 2006
*mangle
:PREROUTING ACCEPT [31484:4186258]
:INPUT ACCEPT [31484:4186258]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [40500:49513786]
:POSTROUTING ACCEPT [40500:49513786]
COMMIT
# Completed on Wed Feb 8 20:08:53 2006
# Generated by iptables-save v1.3.3 on Wed Feb 8 20:08:53 2006
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:allowed - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_packets - [0:0]
:udp_packets - [0:0]
-A INPUT -p tcp -j bad_tcp_packets
#
# Votre Passerelle - change 192.168.0.0/255.255.0.0
# Votre eth? - Change eth1
-A INPUT -s 192.168.0.0/255.255.0.0 -i eth1 -j ACCEPT
-A INPUT -s 127.0.0.1 -i lo -j ACCEPT
#
# Votre IP - change 192.168.1.189
-A INPUT -s 192.168.1.189 -i lo -j ACCEPT
-A INPUT -s 192.168.1.189 -i lo -j ACCEPT
-A INPUT -i eth1 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -d 192.168.1.189 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -j tcp_packets
-A INPUT -i eth0 -p udp -j udp_packets
-A INPUT -i eth0 -p icmp -j icmp_packets
-A INPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT
INPUT packet died: " --log-level 7
-A FORWARD -p tcp -j bad_tcp_packets
-A FORWARD -i eth1 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix
"IPT FORWARD packet died: " --log-level 7
-A OUTPUT -p tcp -j bad_tcp_packets
-A OUTPUT -s 127.0.0.1 -j ACCEPT
-A OUTPUT -s 192.168.1.189 -j ACCEPT
-A OUTPUT -s 192.168.1.189 -j ACCEPT
-A OUTPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix
"IPT OUTPUT packet died: " --log-level 7
-A allowed -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A allowed -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A allowed -p tcp -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m state
--state NEW -j REJECT --reject-with tcp-reset
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m
state --state NEW -j LOG --log-prefix "New not syn:"
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m
state --state NEW -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A tcp_packets -p tcp -m tcp --dport 21 -j allowed
-A tcp_packets -p tcp -m tcp --dport 22 -j allowed
-A tcp_packets -p tcp -m tcp --dport 80 -j allowed
-A tcp_packets -p tcp -m tcp --dport 113 -j allowed
-A udp_packets -p udp -m udp --dport 2074 -j ACCEPT
-A udp_packets -p udp -m udp --dport 4000 -j ACCEPT
COMMIT
# Completed on Wed Feb 8 20:08:53 2006
##############################################################
##############################################################
(3) Tapez sur CLI comme root
/usr/sbin/iptables-restore < /etc/rc.d/rc.iptables
(4) Tapez sur CLI comme root
/usr/sbin/iptables -L
(5) Voila - paré_feu très simple!!
--
Félicitations
Slack Rat (Bill Henderson)
Dit 'NON' aux brevets Logiciels
http://brevets-logiciels.info/
Linux-Azur : http://www.linux-azur.org
Désinscriptions: http://www.linux-azur.org/liste.php3
**** Pas de message au format HTML, SVP ****
