un exemple parmi d'autres

# un exemple parmi d'autres

Posté par robertix le 28 novembre 2019 à 06:25. En réponse au message iptables + récent qui ne marche pas. Évalué à -10. Dernière modification le 28 novembre 2019 à 06:25.
# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DOS_PROTECT
-N FORWARD_FIREWALL
-N INPUT_FIREWALL
-A INPUT -j DOS_PROTECT
-A INPUT -j INPUT_FIREWALL
-A FORWARD -j FORWARD_FIREWALL
-A DOS_PROTECT -i eth0 -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j RETURN
-A DOS_PROTECT -i eth0 -p icmp -m icmp --icmp-type 8 -j DROP
-A DOS_PROTECT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN
-A DOS_PROTECT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -j DROP
-A DOS_PROTECT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 10000/sec --limit-burst 100 -j RETURN
-A DOS_PROTECT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A FORWARD_FIREWALL -i lo -j ACCEPT
-A FORWARD_FIREWALL -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD_FIREWALL -p tcp -m multiport --dports 22,25,80,443,465,995 -j RETURN
-A INPUT_FIREWALL -i lo -j ACCEPT
-A INPUT_FIREWALL -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT_FIREWALL -p tcp -m multiport --dports 22,25,80,443,465,995 -j RETURN
# ip6tables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DOS_PROTECT
-N FORWARD_FIREWALL
-N INPUT_FIREWALL
-A INPUT -j DOS_PROTECT
-A INPUT -j INPUT_FIREWALL
-A FORWARD -j FORWARD_FIREWALL
-A DOS_PROTECT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN
-A DOS_PROTECT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -j DROP
-A DOS_PROTECT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 10000/sec --limit-burst 100 -j RETURN
-A DOS_PROTECT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A FORWARD_FIREWALL -i lo -j ACCEPT
-A FORWARD_FIREWALL -s fe80::/10 -p icmpv6 -m icmp6 --icmpv6-type 133 -j ACCEPT
-A FORWARD_FIREWALL -s fe80::/10 -p icmpv6 -m icmp6 --icmpv6-type 134 -j ACCEPT
-A FORWARD_FIREWALL -p icmpv6 -m icmp6 --icmpv6-type 135 -j ACCEPT
-A FORWARD_FIREWALL -p icmpv6 -m icmp6 --icmpv6-type 136 -j ACCEPT
-A FORWARD_FIREWALL -s fe80::/10 -p icmpv6 -m icmp6 --icmpv6-type 137 -j ACCEPT
-A FORWARD_FIREWALL -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD_FIREWALL -p tcp -m multiport --dports 22,25,80,443,465,995 -j RETURN
-A INPUT_FIREWALL -i lo -j ACCEPT
-A INPUT_FIREWALL -s fe80::/10 -p icmpv6 -m icmp6 --icmpv6-type 133 -j ACCEPT
-A INPUT_FIREWALL -s fe80::/10 -p icmpv6 -m icmp6 --icmpv6-type 134 -j ACCEPT
-A INPUT_FIREWALL -p icmpv6 -m icmp6 --icmpv6-type 135 -j ACCEPT
-A INPUT_FIREWALL -p icmpv6 -m icmp6 --icmpv6-type 136 -j ACCEPT
-A INPUT_FIREWALL -s fe80::/10 -p icmpv6 -m icmp6 --icmpv6-type 137 -j ACCEPT
-A INPUT_FIREWALL -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT_FIREWALL -p tcp -m multiport --dports 22,25,80,443,465,995 -j RETURN