Bonsoir,
Merci pour ton temps PascalHambourg.
Voici le contenu de iptables save, j’ai tronqué les règles Fail2ban qui sont en fin de fichier, car ça fait trop long…
[i][code]*raw
:PREROUTING ACCEPT [52504]
:OUTPUT ACCEPT [41457:4567806]
COMMIT
Completed on Tue May 26 21:30:01 2015
Generated by iptables-save v1.4.14 on Tue May 26 21:30:01 2015
*nat
:PREROUTING ACCEPT [4023:819641]
:INPUT ACCEPT [790:100710]
:OUTPUT ACCEPT [6656:443255]
:POSTROUTING ACCEPT [1889:134465]
:dnat - [0:0]
:net_dnat - [0:0]
-A POSTROUTING -s 192.168.3.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.2.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.4.0/24 -o eth0 -j MASQUERADE
COMMIT
Completed on Tue May 26 21:30:01 2015
Generated by iptables-save v1.4.14 on Tue May 26 21:30:01 2015
*mangle
:PREROUTING ACCEPT [52504]
:INPUT ACCEPT [47468]
:FORWARD ACCEPT [1946:1447054]
:OUTPUT ACCEPT [41457:4567806]
:POSTROUTING ACCEPT [46943:6282942]
:tcfor - [0:0]
:tcin - [0:0]
:tcout - [0:0]
:tcpost - [0:0]
:tcpre - [0:0]
COMMIT
Completed on Tue May 26 21:30:01 2015
Generated by iptables-save v1.4.14 on Tue May 26 21:30:01 2015
*filter
:INPUT DROP [3:120]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [12352:1320472]
:fail2ban-apache - [0:0]
…[/code][/i]
Le fichier la est vide, car j’ai fait du nettoyage dans les règles.
Voici un script que j’avais créer pour réinitialiser le pare-feu en cas de problème :
[code][i]#!/bin/bash
±---------------+ ±---------------+
| 192.168.1.0/24 | eth0 --------------------- eth1 | 192.168.2.0/24 |
±---------------+ | ±---------------+
|
| ±---------------+
----------- eth2 | 192.168.3.0/24 |
| ±---------------+
|
| ±---------------+
----------- eth3 | 192.168.4.0/24 |
±---------------+
#empty known rules
iptables --flush
iptables --table nat --flush
iptables --table mangle --flush
iptables --delete-chain
Default policies:
#DROP input and forward if they are not filtered
iptables --policy INPUT DROP
iptables --policy FORWARD DROP
#for now, accept output
iptables --policy OUTPUT ACCEPT
Basics rules
#Rules to allow connections on loopback (localhost ==> 127.0.0.1)
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
#allow ping
iptables -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
#allow port for sc
iptables -A INPUT -p tcp --dport 13000 -j ACCEPT
iptables -A INPUT -p tcp --dport 14000 -j ACCEPT
iptables -A INPUT -p tcp --dport 13292 -j ACCEPT
iptables -A INPUT -p tcp --dport 17000 -j ACCEPT
iptables -A INPUT -p tcp --dport 17100 -j ACCEPT
#redirect port to sc
iptables -t nat -A PREROUTING -j DNAT -i eth0 -p tcp --dport 13000 --to-destination 192.168.3.13
iptables -t nat -A PREROUTING -j DNAT -i eth0 -p tcp --dport 14000 --to-destination 192.168.3.13
iptables -t nat -A PREROUTING -j DNAT -i eth0 -p tcp --dport 13292 --to-destination 192.168.3.13
iptables -t nat -A PREROUTING -j DNAT -i eth0 -p tcp --dport 17000 --to-destination 192.168.3.13
iptables -t nat -A PREROUTING -j DNAT -i eth0 -p tcp --dport 17100 --to-destination 192.168.3.13
iptables -t nat -A POSTROUTING -j MASQUERADE -o eth0 -p tcp --dport 13000 -d 192.168.3.13
iptables -t nat -A POSTROUTING -j MASQUERADE -o eth0 -p tcp --dport 14000 -d 192.168.3.13
iptables -t nat -A POSTROUTING -j MASQUERADE -o eth0 -p tcp --dport 13292 -d 192.168.3.13
iptables -t nat -A POSTROUTING -j MASQUERADE -o eth0 -p tcp --dport 17000 -d 192.168.3.13
iptables -t nat -A POSTROUTING -j MASQUERADE -o eth0 -p tcp --dport 17100 -d 192.168.3.13
Gateway
#allow new or established or related connections
iptables -A INPUT -m state --state NEW -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -o eth2 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -o eth3 -m state --state ESTABLISHED,RELATED -j ACCEPT
#allow forward from the eth0 to outside
iptables -A FORWARD -i eth2 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth3 -o eth0 -j ACCEPT
#allow forward from outside to eth0 if connection is established or related
iptables -A FORWARD -i eth0 -o eth2 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -o eth3 -m state --state ESTABLISHED,RELATED -j ACCEPT
#if you don’t know your outside interface ip:
#this rule does the “masquerade” ==> changes packets ip
iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.3.0/24 -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.4.0/24 -o eth0 -j MASQUERADE
#Don’t allow forward from output to output
iptables -A FORWARD -i eth0 -o eth0 -j REJECT[/i][/code]
Y a des tests aussi 
, mais aucune des règles n’est fonctionnel…
Voici la table de routage, toute simple mais je pense qu’elle est bonne… :
# route -n
Table de routage IP du noyau
Destination Passerelle Genmask Indic Metric Ref Use Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
192.168.4.0 0.0.0.0 255.255.255.0 U 0 0 0 eth3
Par avance, merci de votre aide
