[quote=“PascalHambourg”]As-tu vérifié avec traceroute ou autre vers une adresse IP distante (8.8.8.8 par exemple) que tu arrives bien à “sortir” au delà de la box depuis la MV ?[/quote]Oui, et j’ai oublié de le noter dans mon message précédent. 
En fait, j’ai fait plusieurs tests :
[code]root@host:~# dig www.yahoo.fr
; <<>> DiG 9.9.4-P2-RedHat-9.9.4-18.P2.fc20 <<>> www.yahoo.fr
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13071
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.yahoo.fr. IN A
;; ANSWER SECTION:
www.yahoo.fr. 888 IN CNAME rc.yahoo.com.
rc.yahoo.com. 1785 IN CNAME src.g03.yahoodns.net.
src.g03.yahoodns.net. 555 IN A 188.125.73.108
src.g03.yahoodns.net. 555 IN A 77.238.184.150
;; Query time: 185 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: mer. avril 08 16:50:29 CEST 2015
;; MSG SIZE rcvd: 133[/code](ça nous confirme qu’il y a bien un serveur DNS récursif à l’adresse 192.168.1.1)[code]root@host:~# dig www.yahoo.fr @8.8.8.8
; <<>> DiG 9.9.4-P2-RedHat-9.9.4-18.P2.fc20 <<>> www.yahoo.fr @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6588
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.yahoo.fr. IN A
;; ANSWER SECTION:
www.yahoo.fr. 136 IN CNAME rc.yahoo.com.
rc.yahoo.com. 136 IN CNAME src.g03.yahoodns.net.
src.g03.yahoodns.net. 35 IN A 77.238.184.150
src.g03.yahoodns.net. 35 IN A 188.125.73.108
;; Query time: 292 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: mer. avril 08 17:03:44 CEST 2015
;; MSG SIZE rcvd: 133[/code](même résultat qu’avec la commande précédente -> normal…)
root@debian1:~# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_req=1 ttl=55 time=253 ms
64 bytes from 8.8.8.8: icmp_req=2 ttl=55 time=262 ms
64 bytes from 8.8.8.8: icmp_req=3 ttl=55 time=254 ms
64 bytes from 8.8.8.8: icmp_req=4 ttl=55 time=241 ms
64 bytes from 8.8.8.8: icmp_req=5 ttl=55 time=259 ms
^C
--- 8.8.8.8 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4005ms
rtt min/avg/max/mdev = 241.982/254.575/262.233/7.050 msroot@debian1:~# traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
1 192.168.2.254 (192.168.2.254) 0.078 ms 0.065 ms 0.043 ms
2 192.168.2.254 (192.168.2.254) 0.044 ms !X 0.042 ms !X 0.050 ms !X[code]root@debian1:~# dig www.yahoo.fr
; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> www.yahoo.fr
;; global options: +cmd
;; connection timed out; no servers could be reached[/code]
et résultat surprenant (puisque je ping bien l’IP du DNS de Google) :[code]root@debian1:~# dig www.yahoo.fr @8.8.8.8
; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> www.yahoo.fr @8.8.8.8
;; global options: +cmd
;; connection timed out; no servers could be reached[/code] 
Par acquis de conscience, j’ai re-vérifié les firewall des deux machines :
[code]root@host:~# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all – anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all – anywhere anywhere
INPUT_direct all – anywhere anywhere
INPUT_ZONES_SOURCE all – anywhere anywhere
INPUT_ZONES all – anywhere anywhere
ACCEPT icmp – anywhere anywhere
DROP all – anywhere anywhere ctstate INVALID
REJECT all – anywhere anywhere reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all – anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all – anywhere anywhere
FORWARD_direct all – anywhere anywhere
FORWARD_IN_ZONES_SOURCE all – anywhere anywhere
FORWARD_IN_ZONES all – anywhere anywhere
FORWARD_OUT_ZONES_SOURCE all – anywhere anywhere
FORWARD_OUT_ZONES all – anywhere anywhere
ACCEPT icmp – anywhere anywhere
DROP all – anywhere anywhere ctstate INVALID
REJECT all – anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
OUTPUT_direct all – anywhere anywhere
Chain FORWARD_IN_ZONES (1 references)
target prot opt source destination
FWDI_public all – anywhere anywhere [goto]
FWDI_public all – anywhere anywhere [goto]
FWDI_public all – anywhere anywhere [goto]
Chain FORWARD_IN_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_OUT_ZONES (1 references)
target prot opt source destination
FWDO_public all – anywhere anywhere [goto]
FWDO_public all – anywhere anywhere [goto]
FWDO_public all – anywhere anywhere [goto]
Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_direct (1 references)
target prot opt source destination
Chain FWDI_public (3 references)
target prot opt source destination
FWDI_public_log all – anywhere anywhere
FWDI_public_deny all – anywhere anywhere
FWDI_public_allow all – anywhere anywhere
Chain FWDI_public_allow (1 references)
target prot opt source destination
Chain FWDI_public_deny (1 references)
target prot opt source destination
Chain FWDI_public_log (1 references)
target prot opt source destination
Chain FWDO_public (3 references)
target prot opt source destination
FWDO_public_log all – anywhere anywhere
FWDO_public_deny all – anywhere anywhere
FWDO_public_allow all – anywhere anywhere
Chain FWDO_public_allow (1 references)
target prot opt source destination
Chain FWDO_public_deny (1 references)
target prot opt source destination
Chain FWDO_public_log (1 references)
target prot opt source destination
Chain INPUT_ZONES (1 references)
target prot opt source destination
IN_public all – anywhere anywhere [goto]
IN_public all – anywhere anywhere [goto]
IN_public all – anywhere anywhere [goto]
Chain INPUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain INPUT_direct (1 references)
target prot opt source destination
Chain IN_public (3 references)
target prot opt source destination
IN_public_log all – anywhere anywhere
IN_public_deny all – anywhere anywhere
IN_public_allow all – anywhere anywhere
Chain IN_public_allow (1 references)
target prot opt source destination
ACCEPT udp – anywhere 224.0.0.251 udp dpt:mdns ctstate NEW
ACCEPT tcp – anywhere anywhere tcp dpt:ssh ctstate NEW
Chain IN_public_deny (1 references)
target prot opt source destination
Chain IN_public_log (1 references)
target prot opt source destination
Chain OUTPUT_direct (1 references)
target prot opt source destination[/code]
- iptables MV :[code]root@debian1:~# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination[/code]
Pour ce qui est des règles iptables MASQUERADE : je teste ça ce soir et te donne le résultat dans la foulée…
