Iptables et Shorewall qui est maître qui est l'esclave ... ?

loreleil · Février 21, 2016, 12:45am

Bien le bonjour chez vous …

Pourquoi ce fil … ?

J’ai dû tout dernièrement ajouter une règle iptables pour éventuellement faciliter l’obtention de clé … … ça c’est pas gagné.

iptables -A OUTPUT -o eth0 -m state --state NEW -p tcp --dport 11371 -j ACCEPT[/code]
[color=#BF0000]4° Toujours est il que cette règle je ne la retrouve pas avec "shorewall" en fonction. ... ou alors sous un autre aspect .....  enfin à mes yeux .....[/color]  <img src="/uploads/default/original/1X/d14bbab5e0eb9167fe7ed1d009c5a9b723425957.gif" width="21" height="21" alt=":083" title="yeux-ciel"/> [color=#BF0000].... et pire elle à disparut après arrêt de Shorewall[/color] 

[color=#4000FF]Bizarre vous avez dit .... [/color] <img src="/uploads/default/original/1X/42cd8bd0447ecac24cdff1e26fa990a5c8442791.gif" width="39" height="18" alt=":033" title="petard"/> 

[color=#0000FF]1° Shorewall arrêter, Iptables + Fail2ban en fonction[/color]


[code]root@Debian-pc-1:/home/loreleil# iptables-save
# Generated by iptables-save v1.4.8 on Sun Feb 13 16:21:49 2011
*raw
:PREROUTING ACCEPT [32119]
:OUTPUT ACCEPT [29716:4469535]
COMMIT
# Completed on Sun Feb 13 16:21:49 2011
# Generated by iptables-save v1.4.8 on Sun Feb 13 16:21:49 2011
*nat
:PREROUTING ACCEPT [918:56437]
:POSTROUTING ACCEPT [2606:161308]
:OUTPUT ACCEPT [2606:161308]
COMMIT
# Completed on Sun Feb 13 16:21:49 2011
# Generated by iptables-save v1.4.8 on Sun Feb 13 16:21:49 2011
*mangle
:PREROUTING ACCEPT [32119]
:INPUT ACCEPT [32119]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [29716:4469535]
:POSTROUTING ACCEPT [29731:4470790]
COMMIT
# Completed on Sun Feb 13 16:21:49 2011
# Generated by iptables-save v1.4.8 on Sun Feb 13 16:21:49 2011
*filter
:INPUT DROP [941:58924]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [29659:4466115]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -i eth0 -p udp -m udp --dport 67:68 -j ACCEPT 
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -i eth0 -o eth0 -p udp -m udp --dport 67:68 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 11371 -j ACCEPT 
COMMIT
# Completed on Sun Feb 13 16:21:49 2011
root@Debian-pc-1:/home/loreleil#

Ma nouvelle régle est bien présente !

-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 11371 -j ACCEPT

2° démarrage de Shorewall avec Iptables + Fail2ban

root@Debian-pc-1:/home/loreleil# shorewall start Compiling... Processing /etc/shorewall/shorewall.conf... Loading Modules... Compiling /etc/shorewall/zones... Compiling /etc/shorewall/interfaces... Determining Hosts in Zones... Preprocessing Action Files... Compiling ... Pre-processing /usr/share/shorewall/action.Drop... Pre-processing /usr/share/shorewall/action.Reject... Compiling /etc/shorewall/policy... Adding Anti-smurf Rules Adding rules for DHCP Compiling TCP Flags filtering... Compiling Kernel Route Filtering... Compiling Martian Logging... Compiling MAC Filtration -- Phase 1... Compiling /etc/shorewall/rules... Generating Transitive Closure of Used-action List... Processing /usr/share/shorewall/action.Reject for chain Reject... Compiling ... Processing /usr/share/shorewall/action.Drop for chain Drop... Compiling MAC Filtration -- Phase 2... Applying Policies... Generating Rule Matrix... Creating iptables-restore input... Compiling iptables-restore input for chain mangle:... Shorewall configuration compiled to /var/lib/shorewall/.start Starting Shorewall.... Initializing... Setting up Route Filtering... Setting up Martian Logging... Setting up Traffic Control... Preparing iptables-restore input... Running /sbin/iptables-restore... done. root@Debian-pc-1:/home/loreleil#

[code]root@Debian-pc-1:/home/loreleil# iptables-save

Generated by iptables-save v1.4.8 on Sun Feb 13 16:24:13 2011

*raw
:PREROUTING ACCEPT [20:1412]
:OUTPUT ACCEPT [20:1444]
COMMIT

Completed on Sun Feb 13 16:24:13 2011

Generated by iptables-save v1.4.8 on Sun Feb 13 16:24:13 2011

*nat
:PREROUTING ACCEPT [4:128]
:POSTROUTING ACCEPT [10:672]
:OUTPUT ACCEPT [10:672]
COMMIT

Completed on Sun Feb 13 16:24:13 2011

Generated by iptables-save v1.4.8 on Sun Feb 13 16:24:13 2011

*mangle
:PREROUTING ACCEPT [20:1412]
:INPUT ACCEPT [20:1412]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [20:1444]
:POSTROUTING ACCEPT [26:1840]
:tcfor - [0:0]
:tcout - [0:0]
:tcpost - [0:0]
:tcpre - [0:0]
-A PREROUTING -j tcpre
-A FORWARD -j MARK --set-xmark 0x0/0xff
-A FORWARD -j tcfor
-A OUTPUT -j tcout
-A POSTROUTING -j tcpost
COMMIT

Completed on Sun Feb 13 16:24:13 2011

Generated by iptables-save v1.4.8 on Sun Feb 13 16:24:13 2011

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:Drop - [0:0]
:Reject - [0:0]
:dropBcast - [0:0]
:dropInvalid - [0:0]
:dropNotSyn - [0:0]
:dynamic - [0:0]
:eth0_fwd - [0:0]
:fw2net - [0:0]
:logdrop - [0:0]
:logflags - [0:0]
:logreject - [0:0]
:net2fw - [0:0]
:reject - [0:0]
:shorewall - [0:0]
:smurflog - [0:0]
:smurfs - [0:0]
:tcpflags - [0:0]
-A INPUT -m conntrack --ctstate INVALID,NEW -j dynamic
-A INPUT -i eth0 -j net2fw
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j Reject
-A INPUT -j LOG --log-prefix “Shorewall:INPUT:REJECT:” --log-level 6
-A INPUT -g reject
-A FORWARD -m conntrack --ctstate INVALID,NEW -j dynamic
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j Reject
-A FORWARD -j LOG --log-prefix “Shorewall:FORWARD:REJECT:” --log-level 6
-A FORWARD -g reject
-A OUTPUT -o eth0 -j fw2net
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -j Reject
-A OUTPUT -j LOG --log-prefix “Shorewall:OUTPUT:REJECT:” --log-level 6
-A OUTPUT -g reject
-A Drop
-A Drop -p tcp -m tcp --dport 113 -m comment --comment “Auth” -j reject
-A Drop -j dropBcast
-A Drop -p icmp -m icmp --icmp-type 3/4 -m comment --comment “Needed ICMP types” -j ACCEPT
-A Drop -p icmp -m icmp --icmp-type 11 -m comment --comment “Needed ICMP types” -j ACCEPT
-A Drop -j dropInvalid
-A Drop -p udp -m multiport --dports 135,445 -m comment --comment “SMB” -j DROP
-A Drop -p udp -m udp --dport 137:139 -m comment --comment “SMB” -j DROP
-A Drop -p udp -m udp --sport 137 --dport 1024:65535 -m comment --comment “SMB” -j DROP
-A Drop -p tcp -m multiport --dports 135,139,445 -m comment --comment “SMB” -j DROP
-A Drop -p udp -m udp --dport 1900 -m comment --comment “UPnP” -j DROP
-A Drop -p tcp -j dropNotSyn
-A Drop -p udp -m udp --sport 53 -m comment --comment “Late DNS Replies” -j DROP
-A Reject
-A Reject -p tcp -m tcp --dport 113 -m comment --comment “Auth” -j reject
-A Reject -j dropBcast
-A Reject -p icmp -m icmp --icmp-type 3/4 -m comment --comment “Needed ICMP types” -j ACCEPT
-A Reject -p icmp -m icmp --icmp-type 11 -m comment --comment “Needed ICMP types” -j ACCEPT
-A Reject -j dropInvalid
-A Reject -p udp -m multiport --dports 135,445 -m comment --comment “SMB” -j reject
-A Reject -p udp -m udp --dport 137:139 -m comment --comment “SMB” -j reject
-A Reject -p udp -m udp --sport 137 --dport 1024:65535 -m comment --comment “SMB” -j reject
-A Reject -p tcp -m multiport --dports 135,139,445 -m comment --comment “SMB” -j reject
-A Reject -p udp -m udp --dport 1900 -m comment --comment “UPnP” -j DROP
-A Reject -p tcp -j dropNotSyn
-A Reject -p udp -m udp --sport 53 -m comment --comment “Late DNS Replies” -j DROP
-A dropBcast -m addrtype --dst-type BROADCAST -j DROP
-A dropBcast -d 224.0.0.0/4 -j DROP
-A dropInvalid -m conntrack --ctstate INVALID -j DROP
-A dropNotSyn -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A eth0_fwd -m conntrack --ctstate INVALID,NEW -j smurfs
-A eth0_fwd -p tcp -j tcpflags
-A fw2net -p udp -m udp --dport 67:68 -j ACCEPT
-A fw2net -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A fw2net -p icmp -j ACCEPT
-A fw2net -j ACCEPT
-A logdrop -j DROP
-A logflags -j LOG --log-prefix “Shorewall:logflags:DROP:” --log-level 6 --log-ip-options
-A logflags -j DROP
-A logreject -j reject
-A net2fw -m conntrack --ctstate INVALID,NEW -j smurfs
-A net2fw -p udp -m udp --dport 67:68 -j ACCEPT
-A net2fw -p tcp -j tcpflags
-A net2fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A net2fw -p icmp -m icmp --icmp-type 8 -m comment --comment “Ping” -j reject
-A net2fw -p tcp -m tcp --dport 113 -j DROP
-A net2fw -j Drop
-A net2fw -j LOG --log-prefix “Shorewall:net2fw:DROP:” --log-level 6
-A net2fw -j DROP
-A reject -m addrtype --src-type BROADCAST -j DROP
-A reject -s 224.0.0.0/4 -j DROP
-A reject -p igmp -j DROP
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -p udp -j REJECT --reject-with icmp-port-unreachable
-A reject -p icmp -j REJECT --reject-with icmp-host-unreachable
-A reject -j REJECT --reject-with icmp-host-prohibited
-A smurflog -j LOG --log-prefix “Shorewall:smurfs:DROP:” --log-level 6
-A smurflog -j DROP
-A smurfs -s 0.0.0.0/32 -j RETURN
-A smurfs -m addrtype --src-type BROADCAST -g smurflog
-A smurfs -s 224.0.0.0/4 -g smurflog
-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -g logflags
-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -g logflags
-A tcpflags -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -g logflags
-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -g logflags
-A tcpflags -p tcp -m tcp --sport 0 --tcp-flags FIN,SYN,RST,ACK SYN -g logflags
COMMIT

Completed on Sun Feb 13 16:24:13 2011

root@Debian-pc-1:/home/loreleil#
[/code]
3° Shorewall arrêt, Iptables + Fail2ban en fonction

root@Debian-pc-1:/home/loreleil# shorewall stop Stopping Shorewall.... Running /sbin/iptables-restore... done. root@Debian-pc-1:/home/loreleil#

[code]root@Debian-pc-1:/home/loreleil# iptables -L --line-numbers
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT all – anywhere anywhere ctstate RELATED,ESTABLISHED
2 ACCEPT all – anywhere anywhere
3 ACCEPT all – anywhere anywhere
4 ACCEPT udp – anywhere anywhere udp dpts:bootps:bootpc

Chain FORWARD (policy DROP)
num target prot opt source destination
1 ACCEPT all – anywhere anywhere ctstate RELATED,ESTABLISHED
2 ACCEPT udp – anywhere anywhere udp dpts:bootps:bootpc

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
root@Debian-pc-1:/home/loreleil#
[/code]
4° Ou est passé ma règle … ?

[quote]
iptables -A OUTPUT -o eth0 -m state --state NEW -p tcp --dport 11371 -j ACCEPT[/quote]
… … … … … Bizarre … vous avez dit Bizarre ? … Comme c’est Bizarre !

[Edit] : avec un peu de recul … à présent que le sujet est lancé… Ne serait-il pas judicieux d’implanter cette novelle règle à “Shorewall” … ?

Étant donner que "shorewall me la mange.

lol · Février 21, 2016, 12:45am

Salut,
Je n’ai bien entendu pas tout lu…

Mais je crois que c’est iptables OU shorewall, pas les deux à la fois… (éventuellement tu te sert d’iptables pour lire les règles chargées, mais pas pour créer de nouvelles règles… Ou alors tu vire shorewall)

loreleil · Février 21, 2016, 12:48am

Bien le bonjour chez vous …

Voilà, décision est prise.

C’est “Shorewall”.

[quote=“lol”]
(…) c’est iptables OU shorewall, pas les deux à la fois… (…) … Ou alors tu vire shorewall[/quote]

Oh …! … bien sûr les puristes vont certainement crier au loup … mais vaille que vaille !

Lorsque j’ai besoin de taper un clou dans mon garage ou ailleurs … ma foi je sors le marteau … il ne me viendrais pas à l’idée d’aller dans le jardin pour y ramasser un silex où tout autre objet contondant … …

Shorewall et moi nous nous comprenons …

Il est bien plus aisé de compréhention et d’utilisation pour mon neurone …

A voter … !