URL: https://linuxfr.org/forums/linux-debian-ubuntu/posts/iptables-ip6tables-avis
Title: Iptables - Ip6tables - avis
Authors: redraven
Date: 2019年05月01日T08:14:25+02:00
License: CC By-SA
Tags: pare-feu, sécurité et iptables
Score: 0
Bonjour bonjour !
Après avoir créé un thread pour la configuration, je me permet d'en créer un nouveau pour recueillir vos avis et optimisations, vu que l'on commençait à s'y perdre avec la tonne de message du premier thread.
Alors, vos avis ? Merci d'avance !
Voilà donc à quoi ressemble la configuration :
```sh
#!/bin/bash
#iptables-restore < /etc/iptables.test.rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP 
 
# Autorise les connexions déjà établies et localhost 
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT 
iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT 
iptables -A INPUT -i lo -j ACCEPT
#TOR
iptables -A OUTPUT -p tcp -m tcp --dport 9050 -m state --state NEW -j ACCEPT
# ICMP (Ping) 
iptables -A INPUT -p icmp -j DROP 
iptables -A OUTPUT -p icmp -j DROP
 
# DNS 
iptables -A OUTPUT -p tcp --dport 53 -m state --state NEW -j ACCEPT 
iptables -A OUTPUT -p udp --dport 53 -m state --state NEW -j ACCEPT 
 
# HTTP 
iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
 
# HTTPS
iptables -A OUTPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT 
# Mail SMTP 
iptables -A OUTPUT -p tcp --dport 25 -m state --state NEW -j ACCEPT 
#Transmission
iptables -A INPUT -p udp --dport 51413 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp --sport 51413 -m state --state NEW -j ACCEPT
 
# NTP (horloge du serveur) 
iptables -A OUTPUT -p udp --dport 123 -m state --state NEW -j ACCEPT 
# On log les paquets en entrée.
iptables -A INPUT -j LOG
# On log les paquets en sortie.
iptables -A OUTPUT -j LOG
 
# On log les paquets forward.
iptables -A FORWARD -j LOG 
ip6tables -F
ip6tables -X
ip6tables -t nat -F
ip6tables -t nat -X
ip6tables -t mangle -F
ip6tables -t mangle -X
ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT DROP 
 
# Autorise les connexions déjà établies et localhost 
ip6tables -A INPUT -m state --state ESTABLISHED -j ACCEPT 
ip6tables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT 
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type router-advertisement -m state --state UNTRACKED -m hl --hl-eq 255 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbour-advertisement -m state --state UNTRACKED -m hl --hl-eq 255 -j ACCEPT
ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbour-solicitation -m state --state UNTRACKED -m hl --hl-eq 255 -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type router-solicitation -m state --state UNTRACKED -m hl --hl-eq 255 -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbour-advertisement -m state --state UNTRACKED -m hl --hl-eq 255 -j ACCEPT
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type neighbour-solicitation -m state --state UNTRACKED -m hl --hl-eq 255 -j ACCEPT
ip6tables -A INPUT -p icmpv6 -j DROP
ip6tables -A OUTPUT -p icmpv6 -j DROP
#TOR
ip6tables -A OUTPUT -p tcp -m tcp --dport 9050 -m state --state NEW -j ACCEPT
 
# DNS 
ip6tables -A OUTPUT -p tcp --dport 53 -m state --state NEW -j ACCEPT 
ip6tables -A OUTPUT -p udp --dport 53 -m state --state NEW -j ACCEPT 
# HTTP 
ip6tables -A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT 
 
# HTTPS
ip6tables -A OUTPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT 
# Mail SMTP 
ip6tables -A OUTPUT -p tcp --dport 587 -m state --state NEW -j ACCEPT
#Transmission
ip6tables -A INPUT -p udp --dport 51413 -m state --state NEW -j ACCEPT
ip6tables -A OUTPUT -p udp --sport 51413 -m state --state NEW -j ACCEPT
 
# NTP (horloge du serveur) 
ip6tables -A OUTPUT -p udp --dport 123 -m state --state NEW -j ACCEPT 
# On log les paquets en entrée.
ip6tables -A INPUT -j LOG
# On log les paquets en sortie.
ip6tables -A OUTPUT -j LOG
 
# On log les paquets forward.
ip6tables -A FORWARD -j LOG 
exit 0
```
</div><div class="naked_ctrl">
<form action="/index.cgi/contrast" method="get" name="gate">
<p><a href="http://altstyle.alfasado.net">AltStyle</a> によって変換されたページ <a href="httpS://linuxfr.org/forums/linux-debian-ubuntu/posts/iptables-ip6tables-avis.md">(-&gt;オリジナル)</a>
/ <label>アドレス: <input type="text" name="naked_post_url" value="httpS://linuxfr.org/forums/linux-debian-ubuntu/posts/iptables-ip6tables-avis.md" size="22" /></label> <label>モード: <select name="naked_post_mode">
<option value="default">デフォルト</option>
<option value="speech">音声ブラウザ</option>
<option value="ruby">ルビ付き</option>
<option value="contrast" selected="selected">配色反転</option>
<option value="larger-text">文字拡大</option>
<option value="mobile">モバイル</option>
</select>
<input type="submit" value="表示" />
</p>
</form>
</div>