[iptables] un pti coudmain vite fait pour comprendre bien ?
un pti coudmain vite fait pour comprendre bien ? [iptables] - réseaux et sécurité - Linux et OS Alternatifs
Marsh Posté le 09-06-2003 à 15:23:11
Apparemment c'est Shorewall qui gère le firewall http://www.shorewall.net/
L'utilisation de iptables -L ne donne pas toujours une sortie digeste, regarde plutot les fichiers de configuration de shorewall qui sont TRES parlant.
J'ai même traduit les 3 guides d'installations en français sur le site de l'auteur :
http://www.shorewall.net/standalone_fr.html
http://www.shorewall.net/two-interface_fr.html
http://www.shorewall.net/three-interface_fr.html
++
---------------
Forum d'entre-aide pour la Debian : http://www.andesi.org/forum
Sujets relatifs:
- Problème VIA Epia-800 / eMovix ... Urgent bien sûr :)
- Noyau 2.4.20, GCC 2.95 et iptables
- Besoin de règles iptables... [RESOLU]
- Iptables : logiciel TeamSpeak
- [iptables] : j'pète un cable !
- [MPlayer] J'ai beau chercher sans comprendre :(
- module iptables ip_string quelqu'un connait ?????
- Problème avec les logs iptables
- comment faire du NAT avec iptables ?
- NFS not responding - alors qu'une autre machine y arrive très bien !
Marsh Posté le 08-06-2003 à 17:12:45
salut,
la mandrake qu'a installé un pote lui a tout configuré toute seule, mais ya des trucs zarbes, que je ne pige pas tres bien ... il me semblait qu'il fallait spécifier l'interface concernée à chaque fois, mais quand on tape iptables -L ca donne ça:
>Chain INPUT (policy DROP)
>target prot opt source destination
>ACCEPT all -- anywhere anywhere
>ppp_in all -- anywhere anywhere
>eth0_in all -- anywhere anywhere
>common all -- anywhere anywhere
>LOG all -- anywhere anywhere LOG level info prefix `Shorewall:INPUT:REJECT:'
>reject all -- anywhere anywhere
>
>Chain FORWARD (policy DROP)
>target prot opt source destination
>ppp_fwd all -- anywhere anywhere
>eth0_fwd all -- anywhere anywhere
>common all -- anywhere anywhere
>LOG all -- anywhere anywhere LOG level info prefix `Shorewall:FORWARD:REJECT:'
>reject all -- anywhere anywhere
>
>Chain OUTPUT (policy DROP)
>target prot opt source destination
>ACCEPT all -- anywhere anywhere
>ACCEPT icmp -- anywhere anywhere
>fw2net all -- anywhere anywhere
>fw2masq all -- anywhere anywhere
>common all -- anywhere anywhere
>LOG all -- anywhere anywhere LOG level info prefix `Shorewall:OUTPUT:REJECT:'
>reject all -- anywhere anywhere
>
>Chain all2all (2 references)
>target prot opt source destination
>ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
>newnotsyn tcp -- anywhere anywhere state NEW tcp flags:!SYN,RST,ACK/SYN
>common all -- anywhere anywhere
>LOG all -- anywhere anywhere LOG level info prefix `Shorewall:all2all:REJECT:'
>reject all -- anywhere anywhere
>
>Chain common (5 references)
>target prot opt source destination
>icmpdef icmp -- anywhere anywhere
>DROP tcp -- anywhere anywhere state INVALID
>REJECT udp -- anywhere anywhere udp dpts:netbios-ns:netbios-ssn reject-with icmp-port-unreachable
>REJECT udp -- anywhere anywhere udp dpt:microsoft-ds reject-with icmp-port-unreachable
>reject tcp -- anywhere anywhere tcp dpt:135
>DROP udp -- anywhere anywhere udp dpt:1900
>DROP all -- anywhere 255.255.255.255
>DROP all -- anywhere BASE-ADDRESS.MCAST.NET/4
>reject tcp -- anywhere anywhere tcp dpt:auth
>DROP all -- anywhere 192.168.1.255
>
>Chain dynamic (4 references)
>target prot opt source destination
>
>Chain eth0_fwd (1 references)
>target prot opt source destination
>dynamic all -- anywhere anywhere
>masq2net all -- anywhere anywhere
>
>Chain eth0_in (1 references)
>target prot opt source destination
>dynamic all -- anywhere anywhere
>masq2fw all -- anywhere anywhere
>
>Chain fw2masq (1 references)
>target prot opt source destination
>ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
>newnotsyn tcp -- anywhere anywhere state NEW tcp flags:!SYN,RST,ACK/SYN
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ipp
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:printer
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:netbios-ns
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:netbios-dgm
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:netbios-ssn
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:ipp
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:printer
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:netbios-ns
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:netbios-dgm
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:netbios-ssn
>all2all all -- anywhere anywhere
>
>Chain fw2net (1 references)
>target prot opt source destination
>ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
>newnotsyn tcp -- anywhere anywhere state NEW tcp flags:!SYN,RST,ACK/SYN
>ACCEPT all -- anywhere anywhere
>
>Chain icmpdef (1 references)
>target prot opt source destination
>
>Chain loc2net (0 references)
>target prot opt source destination
>ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
>newnotsyn tcp -- anywhere anywhere state NEW tcp flags:!SYN,RST,ACK/SYN
>ACCEPT all -- anywhere anywhere
>
>Chain masq2fw (1 references)
>target prot opt source destination
>ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
>newnotsyn tcp -- anywhere anywhere state NEW tcp flags:!SYN,RST,ACK/SYN
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:domain
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:bootps
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:http
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ipp
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:imap
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:pop3
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:smtp
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:nntp
>ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ntp
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:domain
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:bootps
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:http
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:https
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:ipp
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:imap
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:pop3
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:smtp
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:nntp
>ACCEPT udp -- anywhere anywhere state NEW udp dpt:ntp
>all2all all -- anywhere anywhere
>
>Chain masq2net (1 references)
>target prot opt source destination
>ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
>newnotsyn tcp -- anywhere anywhere state NEW tcp flags:!SYN,RST,ACK/SYN
>ACCEPT all -- anywhere anywhere
>
>Chain net2all (3 references)
>target prot opt source destination
>ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
>newnotsyn tcp -- anywhere anywhere state NEW tcp flags:!SYN,RST,ACK/SYN
>common all -- anywhere anywhere
>LOG all -- anywhere anywhere LOG level info prefix `Shorewall:net2all:DROP:'
>DROP all -- anywhere anywhere
>
>Chain newnotsyn (7 references)
>target prot opt source destination
>DROP all -- anywhere anywhere
>
>Chain ppp_fwd (1 references)
>target prot opt source destination
>dynamic all -- anywhere anywhere
>net2all all -- anywhere anywhere
>net2all all -- anywhere anywhere
>
>Chain ppp_in (1 references)
>target prot opt source destination
>dynamic all -- anywhere anywhere
>net2all all -- anywhere anywhere
>
>Chain reject (6 references)
>target prot opt source destination
>REJECT tcp -- anywhere anywhere reject-with tcp-reset
>REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
>
>Chain shorewall (0 references)
>target prot opt source destination
ya des trucs bizares, comme par exemple: pourquoi ils jertent toujours le newnotsyn ? et d'autres trucs, en fait, si j'ai bien compris, ils permettent de:
- faire ce qu'on veut des icmp (avec la table icmpdef) qui pour l'instannt sont rejetés (car policy DROP et aucun ACCEPT dans celle ci)
- faire du NAT avec dynamic (par exemple pour avoir un mldonkey dans une machine du sous réseau?)...
- figurer en tant que windows pour internet (reject udp netbios etc...)
- permettre que les connexion pour l'instant ouvertes depuis internet (par exemple un client ssh) soient encore permises, mais toutes les nouvelles refusées ...???