[firewall] help pour la config please

help pour la config please [firewall] - Codes et scripts - Linux et OS Alternatifs

Marsh Posté le 03-10-2002 à 14:55:55    

Hello,
 
J'ai installé un script pour mon firewall mais je dois avouer que je ne me suis pas trop penché sur la doc pour l'instant. J'ai besoin d'ouvrir certains ports pour les gars qui partagent la connexion avec moi donc si qqun pouviat m'indiquer ce qu'il faut faire ce serait cool. Si y'a des ports qui sont ouverts et qui ne devraient pas ce serait sympa de me le dire aussi. ;)
 
voila a quoi ressemble le script >
 

Code :
  1. # Main configuration, modify to suit your setup.  Help can be found at:
  2. #    http://www.mplug.org/phpwiki/index [...] renceGuide
  3. IPTABLES="/sbin/iptables"   # set to your iptables location, must be set
  4. TCP_ALLOW="22 6699 119"    # TCP ports to allow
  5. UDP_ALLOW="68 6112 6119 4000"   # UDP ports to allow
  6. INET_IFACE="eth1"    # the interface your internet's on (one only), must be set
  7. LAN_IFACE="eth0"    # the interface your LAN's on (one only)
  8. INTERNAL_LAN="192.168.0.254/24 192.168.0.11/24 192.168.0.12/24 192.168.0.13/24" # The internal LAN (including DMZs but not censored hosts)
  9. MASQ_LAN="192.168.0.254/24 192.168.0.11/24 192.168.0.12/24 192.168.0.13/24" # the internal network(s) to be masqueraded (this is overridden by MAC_MASQ)
  10. SNAT_LAN=""     # Internal networks/hosts to use static NAT (format is <internal ip or network>:<external ip> ) (this is overridden by MAC_SNAT)
  11. DROP="TREJECT"     # What to do with packets we don't want: DROP, REJECT, TREJECT (Reject with tcp-reset for TCP), LDROP (log and drop), LREJECT (log and reject), LTREJECT (log and reject with tcp-reset)
  12. DENY_ALL=""     # Internet hosts to explicitly deny from accessing your system at all
  13. DENY_HOSTWISE_TCP=""    # Specific hosts to deny access to specific TCP ports; format is "IP>PORT"
  14. DENY_HOSTWISE_UDP=""    # Specific hosts to deny access to specific UDP ports; format is "IP>PORT"
  15. BLACKHOLE=""     # People you don't want to have anything to do with (equivlent of my old TK_DROP).  This is a bidirectional drop.
  16. BLACKHOLE_DROP="DROP"    # What to do for the blackholes (same options as DROP directive above)
  17. ALLOW_HOSTWISE_TCP=""    # Specific hosts allowed access to specific TCP ports; format is "IP>PORT"
  18. ALLOW_HOSTWISE_UDP=""    # Specific hosts allowed access to specific UDP ports; format is "IP>PORT"
  19. TCP_FW=""     # TCP port forwards, form is "SPORT:DPORT>IP"
  20. UDP_FW=""     # UDP port forwards, form is "SPORT:DPORT>IP"
  21. MANGLE_TOS_OPTIMIZE="TRUE"   # TOS "optimizations" on or off (TRUE/FALSE toggle)
  22. ENABLE="Y"     # Set to 'Y' when it's configured; this is for your own saftey
  25. # Flood Params.  You will still recieve the packets and the bandwidth will be used, but this will cause floods to be ignored (useful against SYNFLOODS especially)
  26. LOG_FLOOD="2/s"     # Limit on logging (for LTREJECT, LREJECT and LDROP, the packet will always take the policy regardless of logging)
  27. SYN_FLOOD="20/s"    # GLOBAL limit on SYN packets (servers will probably need even higher sustained rates as this isn't on a per IP basis)
  28. PING_FLOOD="1/s"    # GLOBAL limit on ICMP echo-requests to reply to
  30. # Outbound filters (they work, but are of limited functionality), probably better to use a proxy here
  31. ALLOW_OUT_TCP=""    # Internal hosts allowed to be forwarded out on TCP (internet censorship!) (do not put this/these host/s in INTERNAL_LAN, but do define their method of access [snat, masq] if not a public ip)
  33. # Below here is experimental (please report your successes/failures)
  34. MAC_MASQ=""     # MAC addresses permitted to use masquerading, leave blank to not use
  35. MAC_SNAT=""     # MAC addresses permitted to use static NAT, leave blank to not use (format is <MAC Address>:<external ip> )
  36. TTL_SAFE=""     # How many hops packets need to make once they get on your LAN (null disables the mangling) (requires patch from patch-o-matic)
  37. USE_SYNCOOKIES="TRUE"    # TCP SynCookies on or off (TRUE/FALSE toggle)
  38. PROXY=""     # Redirect for Squid or other transparent proxy. Syntax to specify the proxy is "host:port".
  39. DHCP_SERVER="FALSE"    # Set to true if you run a DHCP server. DHCP clients do not need this. This allows broadcasts to the server from potential clients on the LAN to succeede. MUST DEFINE LAN_IFACE IF YOU USE THIS!
  41. # Only touch these if you're daring (PREALPHA stuff, as in basically non-functional)
  42. DMZ_IFACE=""     # Interface your DMZ is on (leave blank if you don't have one) MUST DEFINE LAN_IFACE IF YOU USE THIS!


 
(je vous fais grace des commentaires et de la partie script en elle-meme :p)
 
- pour TCP > quel genre d'applis demande que les ports 22 et 6699 soient ouverts (119 c'est pour les news, c'est moi qui l'ai rajouté) ?
 
- pour UDP > j'ai pas mal de trucs la, je sais pas trop quelle appli a besoin de quel port :(
 
En gros il faudrait que le jeu sur le net soit possible (Battlenet est ok avec cette config pour l'instant), que WinMX fonctionne et puis aussi MSN et Netmeeting (2 fois beurk).
 
Voila.


Message édité par impulse le 03-10-2002 à 15:20:57
Reply

Marsh Posté le 03-10-2002 à 14:55:55   

Reply

Marsh Posté le 03-10-2002 à 14:57:43    


tcp 22 > SSH


Message édité par xtress le 03-10-2002 à 14:58:10
Reply

Marsh Posté le 03-10-2002 à 15:04:56    

pour UDP > les ports 4000, 6112 et 6119 sont pour BNet et le 68 pour  le DHCP. Le 6699 est pour Napster (Lopster).
pour TCP > port 22 = ssh, port 119 = NG
 
ça avance ;)


Message édité par impulse le 03-10-2002 à 15:26:02
Reply

Marsh Posté le 03-10-2002 à 15:58:32    

J'ai trouvé un site sympa : http://www.tantalo.net/ports/index.php :D

Reply

Sujets relatifs:

Leave a Replay

Make sure you enter the(*)required information where indicate.HTML code is not allowed