Optimisation de firewall et vous vous utilisez koi ?

Optimisation de firewall et vous vous utilisez koi ? - Installation - Linux et OS Alternatifs

Marsh Posté le 02-05-2003 à 18:55:40    

voici mon firewall :

Citation :

start () {
#on degage tous
iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
 
#police par defaut DROP
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
 
#echo "[Activation de la passerelle]"
echo 1 > /proc/sys/net/ipv4/ip_forward
#test
echo 0 > /proc/sys/net/ipv4/tcp_ecn
 
 
# pour le localhost c obligatoire !
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
 
#pour accepter tous ce qui passe sur le rezo
iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT
iptables -A OUTPUT -d 192.168.0.0/24 -j ACCEPT
iptables -A FORWARD -s 192.168.0.0/24 -o ppp0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -d 192.168.0.0/24 -i ppp0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
 
#pour accepter le partage de connexion
iptables -A POSTROUTING -t nat -o ppp0 -j MASQUERADE
 
#pour voir
iptables -A OUTPUT -o ppp0 -p icmp --icmp-type ping -j ACCEPT
 
#DNS OK
iptables -A INPUT -i ppp0 --protocol udp --source-port 53 -j ACCEPT
iptables -A OUTPUT -o ppp0 --protocol udp --destination-port 53 -j ACCEPT
 
#pour le serveur web
#iptables -A INPUT -i ppp0 -p TCP --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -o ppp0 -p TCP --sport 80 -m state --state RELATED,ESTABLISHED -j ACCEPT
 
#SSH autorisé depuis internet
#iptables -A INPUT -i ppp0 -p tcp --dport 22 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -o ppp0 -p tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
 
#pour accepter le FTP sur mon rezo local
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
 
iptables -A INPUT -i ppp0 -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 
iptables -A INPUT -i ppp0 -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o ppp0 -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
 
iptables -A INPUT -i ppp0 -p tcp --sport 1024:65535 --dport 1024:65535 -m  state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 -p tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
 
 
LOG_FLOOD="2/s"
 
#regle qui log les packets et les drop
iptables -N LDROP
iptables -A LDROP -p tcp --dport 137:139 -j DROP
iptables -A LDROP -p udp --dport 137:139 -j DROP
iptables -A LDROP -p tcp -m limit --limit $LOG_FLOOD -j LOG --log-level 6 --log-prefix '[IPTABLES TCP Dropped] '
iptables -A LDROP -p udp -m limit --limit $LOG_FLOOD -j LOG --log-level 6 --log-prefix '[IPTABLES UDP Dropped] '
iptables -A LDROP -p icmp -m limit --limit $LOG_FLOOD -j LOG --log-level 6 --log-prefix '[IPTABLES ICMP Dropped] '
iptables -A LDROP -f -m limit --limit $LOG_FLOOD -j LOG --log-level 6 --log-prefix '[IPTABLES FRAGMENT Dropped] '
iptables -A LDROP -j DROP
 
#activer les log
iptables -A FORWARD -j LDROP
iptables -A INPUT -j LDROP
iptables -A OUTPUT -j LDROP
 
echo "régle appliqué"
}


 
pouvais vous me dire à quoi correspond :

Citation :

iptables -A INPUT -i ppp0 -p tcp --sport 1024:65535 --dport 1024:65535 -m  state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o ppp0 -p tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT


 
merci d'avance !


Message édité par stef_dobermann le 02-05-2003 à 22:32:54

---------------
Tout à commencé par un rêve...
Reply

Marsh Posté le 02-05-2003 à 18:55:40   

Reply

Marsh Posté le 02-05-2003 à 19:04:44    

i

ptables -A INPUT -i ppp0 -p tcp --sport 1024:65535 --dport 1024:65535 -m  state --state ESTABLISHED -j ACCEPT


 
tout ce qui arrive sur ta passerelle, en provenance du Web, sur un port TCP/IP > 1024, venant d'un port > 1024 et concernant une connexion établie est accepté.
 

iptables -A OUTPUT -o ppp0 -p tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT


 
idem sauf que c'est qui sort de ta passerelle et qu'on accepte en plus les connexions liées (c'est à dire en gros ouverte par une autre connexion).
 
pour + de détails :
http://christian.caleca.free.fr rubrique netfilter


---------------
Celui qui pose une question est idiot 5 minutes. Celui qui n'en pose pas le reste toute sa vie. |  Membre du grand complot pharmaceutico-médico-scientifico-judéo-maçonnique.
Reply

Marsh Posté le 02-05-2003 à 19:12:16    

il te manque la parade a pas mal d'attaque mon coco !!!


---------------
FFFF
Reply

Marsh Posté le 02-05-2003 à 19:15:01    

jamiroq a écrit :

il te manque la parade a pas mal d'attaque mon coco !!!


Ben expliques lui plutot que de critiquer de façon aussi stérile ...  :sarcastic:  
Sois un peu constructif pour une fois ... :o

Reply

Marsh Posté le 02-05-2003 à 19:15:10    

jamiroq a écrit :

il te manque la parade a pas mal d'attaque mon coco !!!


 
je pense que c'est pour ça qu'il demande l'aide :heink:

Reply

Marsh Posté le 02-05-2003 à 19:21:59    

jamiroq a écrit :

il te manque la parade a pas mal d'attaque mon coco !!!


 
merci de le dire ! mais je le savait déjà ! ce que je cherche maintenant c'est améliorer ce script, sinon j'aurais pas ouvert ce topic ;)


---------------
Tout à commencé par un rêve...
Reply

Marsh Posté le 02-05-2003 à 19:30:50    

SteF_DOBERMANN a écrit :


 
merci de le dire ! mais je le savait déjà ! ce que je cherche maintenant c'est améliorer ce script, sinon j'aurais pas ouvert ce topic ;)


je vais te donner un petit indice ..au lieu de te peter la tete a avaler la synthaxe de iptables qui va chger ds 1 an ou deux avec un nouveau truc .... apprends les concepts c plus pro : Fwbuilder est ton amis !!!
 
en + il propose un gui emprunter au meilleur fwall professionel , alors que demander de plus !!
 
http://www.fwbuilder.org/


---------------
FFFF
Reply

Marsh Posté le 02-05-2003 à 19:33:30    

Mjules a écrit :

i

ptables -A INPUT -i ppp0 -p tcp --sport 1024:65535 --dport 1024:65535 -m  state --state ESTABLISHED -j ACCEPT


 
tout ce qui arrive sur ta passerelle, en provenance du Web, sur un port TCP/IP > 1024, venant d'un port > 1024 et concernant une connexion établie est accepté.
 

iptables -A OUTPUT -o ppp0 -p tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT


 
idem sauf que c'est qui sort de ta passerelle et qu'on accepte en plus les connexions liées (c'est à dire en gros ouverte par une autre connexion).
 
pour + de détails :
http://christian.caleca.free.fr rubrique netfilter


 
merci pour la definition, mais est-ce utile pour faire de l'irc du jeu en rézo, pour les PC derriére celui-ci.
 
je rappelle que ce PC, ne fait rien d'autre que du serveur ftp web et ssh, plutard j'utiliserais aussi tomcat4 mais plus tard


---------------
Tout à commencé par un rêve...
Reply

Marsh Posté le 02-05-2003 à 19:34:50    

SteF_DOBERMANN a écrit :


 
merci pour la definition, mais est-ce utile pour faire de l'irc du jeu en rézo, pour les PC derriére celui-ci.
 
je rappelle que ce PC, ne fait rien d'autre que du serveur ftp web et ssh, plutard j'utiliserais aussi tomcat4 mais plus tard


 
Firewall Builder is multi-platform firewall configuration and
management tool. It consists of a GUI and set of policy compilers for various firewall platforms. Firewall Builder uses object-oriented approach, it helps administrator maintain a database of network objects and allows policy editing using simple drag-and-drop operations. Firewall Builder currently supports iptables, ipfilter, OpenBSD PF and Cisco PIX.
 
... tu vas halluciner la facilité de manipulation des paquet s irc et consor compris !!


---------------
FFFF
Reply

Marsh Posté le 02-05-2003 à 19:43:00    

dsl mais j'ai pas acces au site ! j'ai un petit soucis avec mon firewall ou avec mes route !


---------------
Tout à commencé par un rêve...
Reply

Marsh Posté le 02-05-2003 à 19:43:00   

Reply

Marsh Posté le 02-05-2003 à 19:44:25    

si c un pb resolution voici l'ip :
 
http://66.35.250.210/


---------------
FFFF
Reply

Marsh Posté le 02-05-2003 à 21:21:00    

voila le message que j'ai

Citation :


You have probably reached this page in error.
 
If you were attempting to reach a site that's domain ends in .sourceforge.net, it is likely that your browser is not HTTP/1.1 compliant. This may be because you're running a very old version of MSIE or Netscape.  
 
Please upgrade your browser and try again.  
 
Please Click Here


---------------
Tout à commencé par un rêve...
Reply

Marsh Posté le 02-05-2003 à 21:48:49    

ra la la, je suis une quiche pour compiler un truc !
vous avez pas un truc en ligne ? ou un script deja tout fait ?
edit :j'ai qu'une debian sans rien du tout !


Message édité par stef_dobermann le 02-05-2003 à 22:01:10

---------------
Tout à commencé par un rêve...
Reply

Marsh Posté le 02-05-2003 à 23:20:59    

j'ai trouvé ca :
http://monmotha.mplug.org/~monmoth [...] 2.3.8-pre9
vous en pensez koi ?


Message édité par stef_dobermann le 02-05-2003 à 23:26:40

---------------
Tout à commencé par un rêve...
Reply

Marsh Posté le 02-05-2003 à 23:25:00    

je sais pas ;) mais pour abrandre en profondeur je trouve qu il est mieux de faire soi meme tes sripts iptables (et les principes des firewalls pour bien les connaitres faut lire les rfc sur le net;) de plus tu conneras aussi bien et mieux qu avaec firebuilder)
 
en plus apres pour integrer du qos c plus facile qd meme :D ;)

Reply

Marsh Posté le 02-05-2003 à 23:26:13    

GUG a écrit :

je sais pas ;) mais pour abrandre en profondeur je trouve qu il est mieux de faire soi meme tes sripts iptables (et les principes des firewalls pour bien les connaitres faut lire les rfc sur le net;) de plus tu conneras aussi bien et mieux qu avaec firebuilder)
 
en plus apres pour integrer du qos c plus facile qd meme :D ;)  


as tu utilisé fwbuilder ?


---------------
FFFF
Reply

Marsh Posté le 02-05-2003 à 23:27:03    

alors tu aurais koi pour amélioré le mien ?


---------------
Tout à commencé par un rêve...
Reply

Marsh Posté le 02-05-2003 à 23:43:50    

jamiroq tu pourrais me générer un script avec fwbuilder ?


---------------
Tout à commencé par un rêve...
Reply

Marsh Posté le 03-05-2003 à 00:38:32    

SteF_DOBERMANN a écrit :

jamiroq tu pourrais me générer un script avec fwbuilder ?


donne t'as config , tes interfaces , tes lan et host et l'ip de la gateway


---------------
FFFF
Reply

Marsh Posté le 03-05-2003 à 01:08:39    

ip gateway : 192.168.0.13
ppp0 (eth0) => internet
eth1 => reseau local (192.168.0.0)
serveur web, ftp sur le firewall qui est aussi la gateway


---------------
Tout à commencé par un rêve...
Reply

Marsh Posté le 03-05-2003 à 01:10:53    

jamiroq a écrit :

il te manque la parade a pas mal d'attaque mon coco !!!


 
toujours à faire le malin celui là [:rofl2]


---------------
Non au projet de loi DADVSI ! (droits d'auteurs)
Reply

Marsh Posté le 03-05-2003 à 01:25:47    

udok a écrit :


 
toujours à faire le malin celui là [:rofl2]


attends t'as vu son script !!!
je vois pas ou je fais le malin a part le prevenir ... mais bon je suis sur osa  !  ah oui c vrai ...


---------------
FFFF
Reply

Marsh Posté le 03-05-2003 à 01:27:02    

SteF_DOBERMANN a écrit :

ip gateway : 192.168.0.13
ppp0 (eth0) => internet
eth1 => reseau local (192.168.0.0)
serveur web, ftp sur le firewall qui est aussi la gateway


ok je te fais ca demain  A++ ( ss mdk 9.1)
en fait ca te fera un scritp iptables t'auras plus qu'a faire sh script...


---------------
FFFF
Reply

Marsh Posté le 03-05-2003 à 01:39:14    

Citation :

ok je te fais ca demain  A++ ( ss mdk 9.1)  
en fait ca te fera un scritp iptables t'auras plus qu'a faire sh script...


 
oué, c ce que j'ai lu, et je doit dir que ca a fait vraiment pencher la balance pour que je l'installe. Je croyais que ct un truc à la crosoft (propriaitaire mais juste au niveau des scripts => obligation d'avoir le soft pour faire tourner les script  :sweat:  ) mais la c vrai que c pas mal (comme ca je peu l'installer sur une autre Debian (VMware) est c bon, pas de fichier superflux sur mon server ;) )
 
Je te remercie quand meme et je regarderais ton script avec grand interet (le temps de comprendre le fonctionnement de fwbuilder)


Message édité par stef_dobermann le 03-05-2003 à 01:40:22

---------------
Tout à commencé par un rêve...
Reply

Marsh Posté le 03-05-2003 à 02:39:25    

Code :
  1. #!/bin/sh
  2. #
  3. # Generated iptables firewall script for the Linux 2.4 kernel
  4. # Script generated by Easy Firewall Generator for IPTables
  5. # copyright 2002 Timothy Scott Morizot
  6. #
  7. # Redhat chkconfig comments - firewall applied early,
  8. #                             removed late
  9. # chkconfig: 2345 08 92
  10. # description: This script applies or removes iptables firewall rules
  11. #
  12. # This generator is primarily designed for RedHat installations,
  13. # although it should be adaptable for others.
  14. #
  15. # It can be executed with the typical start and stop arguments.
  16. # If used with stop, it will stop after flushing the firewall.
  17. # The save and restore arguments will save or restore the rules
  18. # from the /etc/sysconfig/iptables file.  The save and restore
  19. # arguments are included to preserve compatibility with
  20. # Redhat's init.d script (at least in 7.x) if you prefer to use it.
  22. # Redhat installation instructions
  23. #
  24. # 1. Ensure that ipchains will not automatically start.
  25. #    chkconfig --level 0123456 ipchains off
  26. #    This will make sure that the ipchains init.d script
  27. #    is not linked to an S file in any of the rc directories.
  28. #
  29. # 2. Stop ipchains if it's running.
  30. #    service ipchains stop
  31. #
  32. # 3. Execute lsmod to see if the ipchains kernel module is still loaded.
  33. #    If it is, use rmmod to unload it. -- rmmod ipchains
  34. #
  35. # 4. Have the system link the iptables init.d startup script into run states
  36. #    2, 3, and 5.
  37. #    chkconfig --level 235 iptables on
  38. #
  39. # 5. Save this script and execute it to load the ruleset from this file.
  40. #    You may need to run the dos2unix command on it to remove carraige returns.
  41. #
  42. # 6. To have it applied at startup, copy this script to
  43. #    /etc/init.d/iptables.  It accepts stop, start, save, and restore
  44. #    arguments.  (You may wish to save the existing one first.)
  45. #
  46. # 7. For non-Redhat systems (or Redhat systems if you have a problem), you
  47. #    may want to append the command to execute this script to rc.local.
  48. #    rc.local is typically located in /etc and /etc/rc.d and is usually
  49. #    the last thing executed on startup.  Simply add /path/to/script/script_name
  50. #    on its own line in the rc.local file.
  52. ###############################################################################
  53. #
  54. # Local Settings
  55. #
  57. # sysctl location.  If set, it will use sysctl to adjust the kernel parameters.
  58. # If this is set to the empty string (or is unset), the use of sysctl
  59. # is disabled.
  61. SYSCTL="/sbin/sysctl -w"
  63. # To echo the value directly to the /proc file instead
  64. # SYSCTL=""
  66. # IPTables Location - adjust if needed
  68. IPT="/sbin/iptables"
  69. IPTS="/sbin/iptables-save"
  70. IPTR="/sbin/iptables-restore"
  72. # Internet Interface
  73. INET_IFACE="eth0"
  75. # Local Interface Information
  76. LOCAL_IFACE="eth1"
  77. LOCAL_IP="192.168.0.13"
  78. LOCAL_NET="192.168.0.0/24"
  79. LOCAL_BCAST="192.168.0.255"
  81. # Localhost Interface
  83. LO_IFACE="lo"
  84. LO_IP="127.0.0.1"
  86. # Save and Restore arguments handled here
  87. if [ "$1" = "save" ]
  88. then
  89. echo -n "Saving firewall to /etc/sysconfig/iptables ... "
  90. $IPTS > /etc/sysconfig/iptables
  91. echo "done"
  92. exit 0
  93. elif [ "$1" = "restore" ]
  94. then
  95. echo -n "Restoring firewall from /etc/sysconfig/iptables ... "
  96. $IPTR < /etc/sysconfig/iptables
  97. echo "done"
  98. exit 0
  99. fi
  101. ###############################################################################
  102. #
  103. # Load Modules
  104. #
  106. echo "Loading kernel modules ..."
  108. # You should uncomment the line below and run it the first time just to
  109. # ensure all kernel module dependencies are OK.  There is no need to run
  110. # every time, however.
  112. # /sbin/depmod -a
  114. # Unless you have kernel module auto-loading disabled, you should not
  115. # need to manually load each of these modules.  Other than ip_tables,
  116. # ip_conntrack, and some of the optional modules, I've left these
  117. # commented by default.  Uncomment if you have any problems or if
  118. # you have disabled module autoload.  Note that some modules must
  119. # be loaded by another kernel module.
  121. # core netfilter module
  122. /sbin/modprobe ip_tables
  124. # the stateful connection tracking module
  125. /sbin/modprobe ip_conntrack
  127. # filter table module
  128. # /sbin/modprobe iptable_filter
  130. # mangle table module
  131. # /sbin/modprobe iptable_mangle
  133. # nat table module
  134. # /sbin/modprobe iptable_nat
  136. # LOG target module
  137. # /sbin/modprobe ipt_LOG
  139. # This is used to limit the number of packets per sec/min/hr
  140. # /sbin/modprobe ipt_limit
  142. # masquerade target module
  143. # /sbin/modprobe ipt_MASQUERADE
  145. # filter using owner as part of the match
  146. # /sbin/modprobe ipt_owner
  148. # REJECT target drops the packet and returns an ICMP response.
  149. # The response is configurable.  By default, connection refused.
  150. # /sbin/modprobe ipt_REJECT
  152. # This target allows packets to be marked in the mangle table
  153. # /sbin/modprobe ipt_mark
  155. # This target affects the TCP MSS
  156. # /sbin/modprobe ipt_tcpmss
  158. # This match allows multiple ports instead of a single port or range
  159. # /sbin/modprobe multiport
  161. # This match checks against the TCP flags
  162. # /sbin/modprobe ipt_state
  164. # This match catches packets with invalid flags
  165. # /sbin/modprobe ipt_unclean
  167. # The ftp nat module is required for non-PASV ftp support
  168. /sbin/modprobe ip_nat_ftp
  170. # the module for full ftp connection tracking
  171. /sbin/modprobe ip_conntrack_ftp
  173. # the module for full irc connection tracking
  174. /sbin/modprobe ip_conntrack_irc
  177. ###############################################################################
  178. #
  179. # Kernel Parameter Configuration
  180. #
  181. # See http://ipsysctl-tutorial.frozentux [...] index.html
  182. # for a detailed tutorial on sysctl and the various settings
  183. # available.
  185. # Required to enable IPv4 forwarding.
  186. # Redhat users can try setting FORWARD_IPV4 in /etc/sysconfig/network to true
  187. # Alternatively, it can be set in /etc/sysctl.conf
  188. if [ "$SYSCTL" = "" ]
  189. then
  190.     echo "1" > /proc/sys/net/ipv4/ip_forward
  191. else
  192.     $SYSCTL net.ipv4.ip_forward="1"
  193. fi
  195. # This enables dynamic address hacking.
  196. # This may help if you have a dynamic IP address \(e.g. slip, ppp, dhcp\).
  197. #if [ "$SYSCTL" = "" ]
  198. #then
  199. #    echo "1" > /proc/sys/net/ipv4/ip_dynaddr
  200. #else
  201. #    $SYSCTL net.ipv4.ip_dynaddr="1"
  202. #fi
  204. # This enables source validation by reversed path according to RFC1812.
  205. # In other words, did the response packet originate from the same interface
  206. # through which the source packet was sent?  It's recommended for single-homed
  207. # systems and routers on stub networks.  Since those are the configurations
  208. # this firewall is designed to support, I turn it on by default.
  209. # Turn it off if you use multiple NICs connected to the same network.
  210. if [ "$SYSCTL" = "" ]
  211. then
  212.     echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
  213. else
  214.     $SYSCTL net.ipv4.conf.all.rp_filter="1"
  215. fi
  217. # This option allows a subnet to be firewalled with a single IP address.
  218. # It's used to build a DMZ.  Since that's not a focus of this firewall
  219. # script, it's not enabled by default, but is included for reference.
  220. # See: http://www.sjdjweis.com/linux/proxyarp/
  221. #if [ "$SYSCTL" = "" ]
  222. #then
  223. #    echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp
  224. #else
  225. #    $SYSCTL net.ipv4.conf.all.proxy_arp="1"
  226. #fi
  228. # The following kernel settings were suggested by Alex Weeks. Thanks!
  230. # This kernel parameter instructs the kernel to ignore all ICMP
  231. # echo requests sent to the broadcast address.  This prevents
  232. # a number of smurfs and similar DoS nasty attacks.
  233. if [ "$SYSCTL" = "" ]
  234. then
  235.     echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
  236. else
  237.     $SYSCTL net.ipv4.icmp_echo_ignore_broadcasts="1"
  238. fi
  240. # This option can be used to accept or refuse source routed
  241. # packets.  It is usually on by default, but is generally
  242. # considered a security risk.  This option turns it off.
  243. if [ "$SYSCTL" = "" ]
  244. then
  245.     echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
  246. else
  247.     $SYSCTL net.ipv4.conf.all.accept_source_route="0"
  248. fi
  250. # This option can disable ICMP redirects.  ICMP redirects
  251. # are generally considered a security risk and shouldn't be
  252. # needed by most systems using this generator.
  253. #if [ "$SYSCTL" = "" ]
  254. #then
  255. #    echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
  256. #else
  257. #    $SYSCTL net.ipv4.conf.all.accept_redirects="0"
  258. #fi
  260. # However, we'll ensure the secure_redirects option is on instead.
  261. # This option accepts only from gateways in the default gateways list.
  262. if [ "$SYSCTL" = "" ]
  263. then
  264.     echo "1" > /proc/sys/net/ipv4/conf/all/secure_redirects
  265. else
  266.     $SYSCTL net.ipv4.conf.all.secure_redirects="1"
  267. fi
  269. # This option logs packets from impossible addresses.
  270. if [ "$SYSCTL" = "" ]
  271. then
  272.     echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
  273. else
  274.     $SYSCTL net.ipv4.conf.all.log_martians="1"
  275. fi
  278. ###############################################################################
  279. #
  280. # Flush Any Existing Rules or Chains
  281. #
  283. echo "Flushing Tables ..."
  285. # Reset Default Policies
  286. $IPT -P INPUT ACCEPT
  287. $IPT -P FORWARD ACCEPT
  288. $IPT -P OUTPUT ACCEPT
  289. $IPT -t nat -P PREROUTING ACCEPT
  290. $IPT -t nat -P POSTROUTING ACCEPT
  291. $IPT -t nat -P OUTPUT ACCEPT
  292. $IPT -t mangle -P PREROUTING ACCEPT
  293. $IPT -t mangle -P OUTPUT ACCEPT
  295. # Flush all rules
  296. $IPT -F
  297. $IPT -t nat -F
  298. $IPT -t mangle -F
  300. # Erase all non-default chains
  301. $IPT -X
  302. $IPT -t nat -X
  303. $IPT -t mangle -X
  305. if [ "$1" = "stop" ]
  306. then
  307. echo "Firewall completely flushed!  Now running with no firewall."
  308. exit 0
  309. fi
  311. ###############################################################################
  312. #
  313. # Rules Configuration
  314. #
  316. ###############################################################################
  317. #
  318. # Filter Table
  319. #
  320. ###############################################################################
  322. # Set Policies
  324. $IPT -P INPUT DROP
  325. $IPT -P OUTPUT DROP
  326. $IPT -P FORWARD DROP
  328. ###############################################################################
  329. #
  330. # User-Specified Chains
  331. #
  332. # Create user chains to reduce the number of rules each packet
  333. # must traverse.
  335. echo "Create and populate custom rule chains ..."
  337. # Create a chain to filter INVALID packets
  339. $IPT -N bad_packets
  341. # Create another chain to filter bad tcp packets
  343. $IPT -N bad_tcp_packets
  345. # Create separate chains for icmp, tcp (incoming and outgoing),
  346. # and incoming udp packets.
  348. $IPT -N icmp_packets
  350. # Used for UDP packets inbound from the Internet
  351. $IPT -N udp_inbound
  353. # Used to block outbound UDP services from internal network
  354. # Default to allow all
  355. $IPT -N udp_outbound
  357. # Used to allow inbound services if desired
  358. # Default fail except for established sessions
  359. $IPT -N tcp_inbound
  361. # Used to block outbound services from internal network
  362. # Default to allow all
  363. $IPT -N tcp_outbound
  365. ###############################################################################
  366. #
  367. # Populate User Chains
  368. #
  370. # bad_packets chain
  371. #
  372. # Drop INVALID packets immediately
  374. $IPT -A bad_packets -p ALL -m state --state INVALID -j LOG \
  375.     --log-prefix "fp=bad_packets:1 a=DROP "
  377. $IPT -A bad_packets -p ALL -m state --state INVALID -j DROP
  379. # Then check the tcp packets for additional problems
  380. $IPT -A bad_packets -p tcp -j bad_tcp_packets
  382. # All good, so return
  383. $IPT -A bad_packets -p ALL -j RETURN
  385. # bad_tcp_packets chain
  386. #
  387. # All tcp packets will traverse this chain.
  388. # Every new connection attempt should begin with
  389. # a syn packet.  If it doesn't, it is likely a
  390. # port scan.  This drops packets in state
  391. # NEW that are not flagged as syn packets.
  393. # Return to the calling chain if the bad packets originate
  394. # from the local interface. This maintains the approach
  395. # throughout this firewall of a largely trusted internal
  396. # network.
  397. $IPT -A bad_tcp_packets -p tcp -i $LOCAL_IFACE -j RETURN
  399. # However, I originally did apply this filter to the forward chain
  400. # for packets originating from the internal network.  While I have
  401. # not conclusively determined its effect, it appears to have the
  402. # interesting side effect of blocking some of the ad systems.
  403. # Apparently some ad systems have the browser initiate a NEW
  404. # connection that is not flagged as a syn packet to retrieve
  405. # the ad image.  If you wish to experiment further comment the
  406. # rule above. If you try it, you may also wish to uncomment the
  407. # rule below.  It will keep those packets from being logged.
  408. # There are a lot of them.
  409. # $IPT -A bad_tcp_packets -p tcp -i $LOCAL_IFACE ! --syn -m state \
  410. #     --state NEW -j DROP
  412. $IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \
  413.     --log-prefix "fp=bad_tcp_packets:1 a=DROP "
  414. $IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
  416. # All good, so return
  417. $IPT -A bad_tcp_packets -p tcp -j RETURN
  419. # icmp_packets chain
  420. #
  421. # This chain is for inbound (from the Internet) icmp packets only.
  422. # Type 8 (Echo Request) is not accepted by default
  423. # Enable it if you want remote hosts to be able to reach you.
  424. # 11 (Time Exceeded) is the only one accepted
  425. # that would not already be covered by the established
  426. # connection rule.  Applied to INPUT on the external interface.
  427. #
  428. # See: http://www.ee.siue.edu/~rwalden/networking/icmp.html
  429. # for more info on ICMP types.
  430. #
  431. # Note that the stateful settings allow replies to ICMP packets.
  432. # These rules allow new packets of the specified types.
  434. # ICMP packets should fit in a Layer 2 frame, thus they should
  435. # never be fragmented.  Fragmented ICMP packets are a typical sign
  436. # of a denial of service attack.
  437. $IPT -A icmp_packets --fragment -p ICMP -j LOG \
  438.     --log-prefix "fp=icmp_packets:1 a=DROP "
  439. $IPT -A icmp_packets --fragment -p ICMP -j DROP
  441. # Echo - uncomment to allow your system to be pinged.
  442. # Uncomment the LOG command if you also want to log PING attempts
  443. #
  444. # $IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j LOG \
  445. #    --log-prefix "fp=icmp_packets:2 a=ACCEPT "
  446. # $IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
  448. # Time Exceeded
  449. $IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
  451. # Not matched, so return so it will be logged
  452. $IPT -A icmp_packets -p ICMP -j RETURN
  454. # TCP & UDP
  455. # Identify ports at:
  456. #    http://www.chebucto.ns.ca/~rakerman/port-table.html
  457. #    http://www.iana.org/assignments/port-numbers
  459. # udp_inbound chain
  460. #
  461. # This chain describes the inbound UDP packets it will accept.
  462. # It's applied to INPUT on the external or Internet interface.
  463. # Note that the stateful settings allow replies.
  464. # These rules are for new requests.
  465. # It drops netbios packets (windows) immediately without logging.
  467. # Drop netbios calls
  468. # Please note that these rules do not really change the way the firewall
  469. # treats netbios connections.  Connections from the localhost and
  470. # internal interface (if one exists) are accepted by default.
  471. # Responses from the Internet to requests initiated by or through
  472. # the firewall are also accepted by default.  To get here, the
  473. # packets would have to be part of a new request received by the
  474. # Internet interface.  You would have to manually add rules to
  475. # accept these.  I added these rules because some network connections,
  476. # such as those via cable modems, tend to be filled with noise from
  477. # unprotected Windows machines.  These rules drop those packets
  478. # quickly and without logging them.  This prevents them from traversing
  479. # the whole chain and keeps the log from getting cluttered with
  480. # chatter from Windows systems.
  481. $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 137 -j DROP
  482. $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 138 -j DROP
  484. # Ident requests (Port 113) must have a REJECT rule rather than the
  485. # default DROP rule.  This is the minimum requirement to avoid
  486. # long delays while connecting.  Also see the tcp_inbound rule.
  487. $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 113 -j REJECT
  489. # A more sophisticated configuration could accept the ident requests.
  490. # $IPT -A udp_inbound -p UDP -s 0/0 --destination-port 113 -j ACCEPT
  492. # However, if this is a gateway system that masquerades/nats for internal systems
  493. # and the internal systems wish to chat, a simple changing these rules to
  494. # ACCEPT won't work.  The ident daemon on the gateway will need to know how
  495. # to handle the requests.  The stock daemon in most linux distributions
  496. # can't do that.   oidentd is one package that can.
  497. # See: http://dev.ojnk.net/
  499. # Dynamic Address
  500. # If DHCP, the initial request is a broadcast. The response
  501. # doesn't exactly match the outbound packet.  This explicitly
  502. # allow the DHCP ports to alleviate this problem.
  503. # If you receive your dynamic address by a different means, you
  504. # can probably comment this line.
  505. $IPT -A udp_inbound -p UDP -s 0/0 --source-port 67 --destination-port 68 \
  506.      -j ACCEPT
  509. # Not matched, so return for logging
  510. $IPT -A udp_inbound -p UDP -j RETURN
  512. # udp_outbound chain
  513. #
  514. # This chain is used with a private network to prevent forwarding for
  515. # UDP requests on specific protocols.  Applied to the FORWARD rule from
  516. # the internal network.  Ends with an ACCEPT
  519. # No match, so ACCEPT
  520. $IPT -A udp_outbound -p UDP -s 0/0 -j ACCEPT
  522. # tcp_inbound chain
  523. #
  524. # This chain is used to allow inbound connections to the
  525. # system/gateway.  Use with care.  It defaults to none.
  526. # It's applied on INPUT from the external or Internet interface.
  528. # Ident requests (Port 113) must have a REJECT rule rather than the
  529. # default DROP rule.  This is the minimum requirement to avoid
  530. # long delays while connecting.  Also see the tcp_inbound rule.
  531. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 113 -j REJECT
  533. # A more sophisticated configuration could accept the ident requests.
  534. # $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 113 -j ACCEPT
  536. # However, if this is a gateway system that masquerades/nats for internal systems
  537. # and the internal systems wish to chat, a simple changing these rules to
  538. # ACCEPT won't work.  The ident daemon on the gateway will need to know how
  539. # to handle the requests.  The stock daemon in most linux distributions
  540. # can't do that.   oidentd is one package that can.
  541. # See: http://dev.ojnk.net/
  543. # Web Server
  545. # HTTP
  546. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 80 -j ACCEPT
  548. # HTTPS (Secure Web Server)
  549. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 443 -j ACCEPT
  551. # FTP Server (Control)
  552. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 21 -j ACCEPT
  554. # FTP Client (Data Port for non-PASV transfers)
  555. $IPT -A tcp_inbound -p TCP -s 0/0 --source-port 20 -j ACCEPT
  557. # Passive FTP
  558. #
  559. # With passive FTP, the server provides a port to the client
  560. # and allows the client to initiate the connection rather
  561. # than initiating the connection with the client from the data port.
  562. # Web browsers and clients operating behind a firewall generally
  563. # use passive ftp transfers.  A general purpose FTP server
  564. # will need to support them.
  565. #
  566. # However, by default an FTP server will select a port from the entire
  567. # range of high ports.  It is not particularly safe to open all
  568. # high ports.  Fortunately, that range can be restricted.  This
  569. # firewall presumes that the range has been restricted to a specific
  570. # selected range.  That range must also be configured in the ftp server.
  571. #
  572. # Instructions for specifying the port range for the wu-ftpd server
  573. # can be found here:
  574. # http://www.wu-ftpd.org/man/ftpaccess.html
  575. # (See the passive ports option.)
  576. #
  577. # Instructions for the ProFTPD server can be found here:
  578. # http://proftpd.linux.co.uk/localsi [...] /x861.html
  580. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 62000:64000 -j ACCEPT
  582. # sshd
  583. $IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 22 -j ACCEPT
  586. # Not matched, so return so it will be logged
  587. $IPT -A tcp_inbound -p TCP -j RETURN
  589. # tcp_outbound chain
  590. #
  591. # This chain is used with a private network to prevent forwarding for
  592. # requests on specific protocols.  Applied to the FORWARD rule from
  593. # the internal network.  Ends with an ACCEPT
  596. # No match, so ACCEPT
  597. $IPT -A tcp_outbound -p TCP -s 0/0 -j ACCEPT
  599. ###############################################################################
  600. #
  601. # INPUT Chain
  602. #
  604. echo "Process INPUT chain ..."
  606. # Allow all on localhost interface
  607. $IPT -A INPUT -p ALL -i $LO_IFACE -j ACCEPT
  609. # Drop bad packets
  610. $IPT -A INPUT -p ALL -j bad_packets
  612. # DOCSIS compliant cable modems
  613. # Some DOCSIS compliant cable modems send IGMP multicasts to find
  614. # connected PCs.  The multicast packets have the destination address
  615. # 224.0.0.1.  You can accept them.  If you choose to do so,
  616. # Uncomment the rule to ACCEPT them and comment the rule to DROP
  617. # them  The firewall will drop them here by default to avoid
  618. # cluttering the log.  The firewall will drop all multicasts
  619. # to the entire subnet (224.0.0.1) by default.  To only affect
  620. # IGMP multicasts, change '-p ALL' to '-p 2'.  Of course,
  621. # if they aren't accepted elsewhere, it will only ensure that
  622. # multicasts on other protocols are logged.
  623. # Drop them without logging.
  624. $IPT -A INPUT -p ALL -d 224.0.0.1 -j DROP
  625. # The rule to accept the packets.
  626. # $IPT -A INPUT -p ALL -d 224.0.0.1 -j ACCEPT
  628. # Rules for the private network (accessing gateway system itself)
  629. $IPT -A INPUT -p ALL -i $LOCAL_IFACE -s $LOCAL_NET -j ACCEPT
  630. $IPT -A INPUT -p ALL -i $LOCAL_IFACE -d $LOCAL_BCAST -j ACCEPT
  633. # Inbound Internet Packet Rules
  635. # Accept Established Connections
  636. $IPT -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
  637.      -j ACCEPT
  639. # Route the rest to the appropriate user chain
  640. $IPT -A INPUT -p TCP -i $INET_IFACE -j tcp_inbound
  641. $IPT -A INPUT -p UDP -i $INET_IFACE -j udp_inbound
  642. $IPT -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
  644. # Drop without logging broadcasts that get this far.
  645. # Cuts down on log clutter.
  646. # Comment this line if testing new rules that impact
  647. # broadcast protocols.
  648. $IPT -A INPUT -p ALL -d 255.255.255.255 -j DROP
  650. # Log packets that still don't match
  651. $IPT -A INPUT -j LOG --log-prefix "fp=INPUT:99 a=DROP "
  653. ###############################################################################
  654. #
  655. # FORWARD Chain
  656. #
  658. echo "Process FORWARD chain ..."
  660. # Used if forwarding for a private network
  662. # Drop bad packets
  663. $IPT -A FORWARD -p ALL -j bad_packets
  665. # Accept TCP packets we want to forward from internal sources
  666. $IPT -A FORWARD -p tcp -i $LOCAL_IFACE -j tcp_outbound
  668. # Accept UDP packets we want to forward from internal sources
  669. $IPT -A FORWARD -p udp -i $LOCAL_IFACE -j udp_outbound
  671. # If not blocked, accept any other packets from the internal interface
  672. $IPT -A FORWARD -p ALL -i $LOCAL_IFACE -j ACCEPT
  674. # Deal with responses from the internet
  675. $IPT -A FORWARD -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
  676.      -j ACCEPT
  678. # Log packets that still don't match
  679. $IPT -A FORWARD -j LOG --log-prefix "fp=FORWARD:99 a=DROP "
  681. ###############################################################################
  682. #
  683. # OUTPUT Chain
  684. #
  686. echo "Process OUTPUT chain ..."
  688. # Generally trust the firewall on output
  690. # However, invalid icmp packets need to be dropped
  691. # to prevent a possible exploit.
  692. $IPT -A OUTPUT -m state -p icmp --state INVALID -j DROP
  694. # Localhost
  695. $IPT -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
  696. $IPT -A OUTPUT -p ALL -o $LO_IFACE -j ACCEPT
  698. # To internal network
  699. $IPT -A OUTPUT -p ALL -s $LOCAL_IP -j ACCEPT
  700. $IPT -A OUTPUT -p ALL -o $LOCAL_IFACE -j ACCEPT
  702. # To internet
  703. $IPT -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT
  705. # Log packets that still don't match
  706. $IPT -A OUTPUT -j LOG --log-prefix "fp=OUTPUT:99 a=DROP "
  708. ###############################################################################
  709. #
  710. # nat table
  711. #
  712. ###############################################################################
  714. # The nat table is where network address translation occurs if there
  715. # is a private network.  If the gateway is connected to the Internet
  716. # with a static IP, snat is used.  If the gateway has a dynamic address,
  717. # masquerade must be used instead.  There is more overhead associated
  718. # with masquerade, so snat is better when it can be used.
  719. # The nat table has a builtin chain, PREROUTING, for dnat and redirects.
  720. # Another, POSTROUTING, handles snat and masquerade.
  722. echo "Load rules for nat table ..."
  724. ###############################################################################
  725. #
  726. # PREROUTING chain
  727. #
  730. ###############################################################################
  731. #
  732. # POSTROUTING chain
  733. #
  735. $IPT -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE
  737. ###############################################################################
  738. #
  739. # mangle table
  740. #
  741. ###############################################################################
  743. # The mangle table is used to alter packets.  It can alter or mangle them in
  744. # several ways.  For the purposes of this generator, we only use its ability
  745. # to alter the TTL in packets.  However, it can be used to set netfilter
  746. # mark values on specific packets.  Those marks could then be used in another
  747. # table like filter, to limit activities associated with a specific host, for
  748. # instance.  The TOS target can be used to set the Type of Service field in
  749. # the IP header.  Note that the TTL target might not be included in the
  750. # distribution on your system.  If it is not and you require it, you will
  751. # have to add it.  That may require that you build from source.
  753. echo "Load rules for mangle table ..."

 
 
CF : http://easyfwgen.morizot.net/
 
Vais me coucher moi ... :pt1cable:


Message édité par sebweb le 03-05-2003 à 02:42:55
Reply

Marsh Posté le 03-05-2003 à 11:48:17    

merci pour ton post, jolie script beaucoup de commantaires !
 
edit : en plus c un script php !
mais j'ai fini d'installer gnome hier soir (3h10) et fwbuilder est vraiment beau! par contre pour le configurer je cherche mais je crois avoir trouvé ...
 
wait & see ....


Message édité par stef_dobermann le 03-05-2003 à 11:50:47

---------------
Tout à commencé par un rêve...
Reply

Marsh Posté le 03-05-2003 à 13:15:18    

SteF_DOBERMANN a écrit :

merci pour ton post, jolie script beaucoup de commantaires !
 
edit : en plus c un script php !
mais j'ai fini d'installer gnome hier soir (3h10) et fwbuilder est vraiment beau! par contre pour le configurer je cherche mais je crois avoir trouvé ...
 
wait & see ....


li les tuto ils sont super bien fait .... et hyper rapide !!


---------------
FFFF
Reply

Marsh Posté le 03-05-2003 à 13:23:35    

ok, mais l'anglais et moi on est pas trop pote, si tu voi ce que je dir ...  :whistle:


---------------
Tout à commencé par un rêve...
Reply

Marsh Posté le 03-05-2003 à 14:06:01    

SteF_DOBERMANN a écrit :

ok, mais l'anglais et moi on est pas trop pote, si tu voi ce que je dir ...  :whistle:  

files moi ton mail je t'envoie le fichier de ma stratégie fwbuilder (*.xml) ... avec sa version compilé !!


---------------
FFFF
Reply

Marsh Posté le    

Reply

Sujets relatifs:

Leave a Replay

Make sure you enter the(*)required information where indicate.HTML code is not allowed