(Courriels de diversion: <convenais@tarees-vidangera.com> <perturbateurs@fumigation-inseres.com> <bureaucratie@emanciperiez-demoulerais.com> <lezardes@talismans-gauchissiez.com> <entraviez@parierez-soupeseront.com> <adore@psychomotricite-incomberent.com> <suscites@disparurent-affublee.com> <survolerais@quadrilles-changee.com> <quadrichromies@mecanisaient-decalaminages.com> <casait@saignants-arpentes.com> )
On Wed, 2002-05-08 at 10:42, frederic.zulian wrote:
> Mais alors, ayez pitié, proposez moi un script fonctionnant sous mdk et
> incluant le masquage des adresses ip (nat) interne à mon reseau.
Donc j'ai pitie ;--)
Ce script marche pour mon reseau, ou le firewall (externe 192.168.1.2 /
interne 192.168.2.1) est connecte a un routeur (IP 192.168.1.1) lui meme
connecte a l'ADSL. Mon reseau interne est sur 192.168.2.*
Je me souvient plus bien de l'adresse du modem ADSL, ca doit etre
10.0.0.1 qu'il doit falloir mettre dans $router
A part ca (et eventuellement changer les addresses pour le reseau
interne et ouvrir/fermer different ports ca doit etre bon)
Michel
#!/bin/sh
# load functions
. /etc/init.d/functions
echo "Setting up IPtables rules"
IPTABLES=/sbin/iptables # where iptables binary lies
# Setting up Forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Setting up IP spoofing protection
if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]
then
for f in /proc/sys/net/ipv4/conf/*/rp_filter
do
echo 1 > $f
done
fi
# Rules objects
firewall_adsl="192.168.1.2" # My Firewall external IP
router="192.168.1.1" # IP of my router
localhost="127.0.0.1" # no comments
firewall_intranet="192.168.2.2" # my LAN gateway.
intranet="192.168.2.0/24" # My subnet & bits.
any="0.0.0.0/0" # Internet # Devices
dev_intra="eth1" # device for Intranet
dev_inter="eth0" # device for ADSL or router
# High ports
hports="1024:"
# Flush all
$IPTABLES -F
$IPTABLES -X
# Deny all by default
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
KEEPSTATE=" -m state --state ESTABLISHED,RELATED"
# ADSL Tunnel rules
$IPTABLES -A INPUT -j ACCEPT -i $dev_inter -s $router -d $firewall_adsl
$IPTABLES -A OUTPUT -j ACCEPT -o $dev_inter -d $router -s $firewall_adsl
# accept anything on localhost device
$IPTABLES -A INPUT -j ACCEPT -p ALL -i lo
$IPTABLES -A OUTPUT -j ACCEPT -p ALL -o lo
# accept anything IntraNet if from IntraNet device
$IPTABLES -A INPUT -j ACCEPT -p ALL -i $dev_intra
$IPTABLES -A OUTPUT -j ACCEPT -p ALL -o $dev_intra
# Redirectly transparently to Squid WWW requests (you have to setup a
#proxy (Squid for example) listeting on this IP & port)
#$IPTABLES -t nat -A PREROUTING -i $dev_intra -p TCP -j DNAT \
# --dport 80 --to-destination $firewall_intranet:3128
# Activate Forwarding
$IPTABLES -A FORWARD -j ACCEPT -i $dev_intra -o $dev_inter -s $intranet
$IPTABLES -A FORWARD -j ACCEPT -o $dev_intra -i $dev_inter -s $any
# and masquerade IntraNet to Internet with Firewall Internet IP.
$IPTABLES -t nat -A POSTROUTING -o $dev_inter -j MASQUERADE
# activate established mode on all protocols (statefull inspection)
$IPTABLES -A OUTPUT -j ACCEPT -o $dev_inter -p TCP $KEEPSTATE
$IPTABLES -A INPUT -j ACCEPT -i $dev_inter -p TCP $KEEPSTATE
$IPTABLES -A OUTPUT -j ACCEPT -o $dev_inter -p UDP $KEEPSTATE
$IPTABLES -A INPUT -j ACCEPT -i $dev_inter -p UDP $KEEPSTATE
$IPTABLES -A OUTPUT -j ACCEPT -o $dev_inter -p ICMP $KEEPSTATE
$IPTABLES -A INPUT -j ACCEPT -i $dev_inter -p ICMP $KEEPSTATE
# Accept ports back from ppp, if flow return, all protocols
$IPTABLES -A OUTPUT -j ACCEPT -p ALL -o $dev_inter
# Special for service providers
# If you want to provide FTP server to Internet
#$IPTABLES -A INPUT -j ACCEPT -p TCP -i $dev_inter --sport $hports
--dport 20
# $IPTABLES -A INPUT -j ACCEPT -p TCP -i $dev_inter --sport $hports
--dport 21
# or a HTTP server
$IPTABLES -A INPUT -j ACCEPT -p TCP -i $dev_inter --sport $hports
--dport 80
# SSH
$IPTABLES -A INPUT -j ACCEPT -p TCP -i $dev_inter --sport $hports
--dport 22
# Mail
$IPTABLES -A INPUT -j ACCEPT -p TCP -i $dev_inter --sport $hports
--dport 25
# HTTPS
$IPTABLES -A INPUT -j ACCEPT -p TCP -i $dev_inter --sport $hports
--dport 443
# Gnutella
$IPTABLES -A INPUT -j ACCEPT -p TCP -i $dev_inter --sport $hports
--dport 6346
# Drop broadcasts pollution (not logged)
#$IPTABLES -A INPUT -i $dev_inter -p ALL -j DROP -s 10.0.0.255
#$IPTABLES -A INPUT -i $dev_inter -p ALL -j DROP -d 10.0.0.255
#$IPTABLES -A OUTPUT -o $dev_inter -p ALL -j DROP -s 10.0.0.255
#$IPTABLES -A OUTPUT -o $dev_inter -p ALL -j DROP -d 10.0.0.255
$IPTABLES -A INPUT -i $dev_inter -p ALL -j DROP -s 0.0.0.0
$IPTABLES -A INPUT -i $dev_inter -p ALL -j DROP -d 0.0.0.0
$IPTABLES -A OUTPUT -o $dev_inter -p ALL -j DROP -s 0.0.0.0
$IPTABLES -A OUTPUT -o $dev_inter -p ALL -j DROP -d 0.0.0.0
$IPTABLES -A INPUT -i $dev_inter -p ALL -j DROP -s 255.255.255.255
$IPTABLES -A INPUT -i $dev_inter -p ALL -j DROP -d 255.255.255.255
$IPTABLES -A OUTPUT -o $dev_inter -p ALL -j DROP -s 255.255.255.255
$IPTABLES -A OUTPUT -o $dev_inter -p ALL -j DROP -d 255.255.255.255
---------------------------------------------------------------------
Aide sur la liste: <URL:mailto:linux-31-help@CULTe.org>Le CULTe sur le web: <URL:http://www.CULTe.org/>