Re: ton serveur hote n'ecoute pas sur l'IP VPN

[^] # Re: ton serveur hote n'ecoute pas sur l'IP VPN

Posté par fanto30 le 09 août 2013 à 17:12. En réponse au message Accès ssh par un VPN. Évalué à 0. Dernière modification le 09 août 2013 à 17:15.

# Generated by iptables-save v1.4.8 on Fri Aug 9 15:11:41 2013
*nat
:PREROUTING ACCEPT [2193980:169780406]
:POSTROUTING ACCEPT [6823211:592020009]
:OUTPUT ACCEPT [6597700:581565837]
:none-postrouting - [0:0]
:none-prerouting - [0:0]
:zFive-postrouting - [0:0]
:zFive-prerouting - [0:0]
:zFour-postrouting - [0:0]
:zFour-prerouting - [0:0]
:zOne-postrouting - [0:0]
:zOne-prerouting - [0:0]
:zSrv-postrouting - [0:0]
:zSrv-prerouting - [0:0]
:zThree-postrouting - [0:0]
:zThree-prerouting - [0:0]
:zTwo-postrouting - [0:0]
:zTwo-prerouting - [0:0]
-A PREROUTING -j zSrv-prerouting 
-A PREROUTING -j zOne-prerouting 
-A PREROUTING -j zTwo-prerouting 
-A PREROUTING -j zThree-prerouting 
-A PREROUTING -j zFour-prerouting 
-A PREROUTING -j zFive-prerouting 
-A POSTROUTING -j zSrv-postrouting 
-A POSTROUTING -j zOne-postrouting 
-A POSTROUTING -j zTwo-postrouting 
-A POSTROUTING -j zThree-postrouting 
-A POSTROUTING -j zFour-postrouting 
-A POSTROUTING -j zFive-postrouting 
-A zFive-postrouting -s 10.10.110.0/24 -o vmbr0 -j SNAT --to-source 178.33.171.175 
-A zFour-postrouting -s 10.10.110.0/24 -o vmbr0 -j SNAT --to-source 178.33.171.174 
-A zFour-prerouting -d 178.33.171.174/32 -i vmbr0 -p tcp -m tcp --dport 22 -j DNAT --to-destination 10.10.110.204:22 
-A zFour-prerouting -d 178.33.171.174/32 -i vmbr0 -p tcp -m tcp --dport 21 -j DNAT --to-destination 10.10.110.204:21 
-A zFour-prerouting -d 178.33.171.174/32 -i vmbr0 -p tcp -m tcp --dport 3306 -j DNAT --to-destination 10.10.110.204:3306 
-A zOne-postrouting -s 10.10.110.0/24 -o vmbr0 -j SNAT --to-source 178.33.171.171 
-A zOne-prerouting -d 178.33.171.171/32 -i vmbr0 -p tcp -m tcp --dport 22 -j DNAT --to-destination 10.10.110.201:22 
-A zSrv-postrouting -s 10.10.110.0/24 -o vmbr0 -j SNAT --to-source 37.59.19.187 
-A zSrv-prerouting -d 37.59.19.187/32 -i vmbr0 -p tcp -m tcp --dport 22203 -j DNAT --to-destination 10.10.110.203:22 
-A zSrv-prerouting -d 37.59.19.187/32 -i vmbr0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 10.10.110.203:8080 
-A zSrv-prerouting -d 37.59.19.187/32 -i vmbr0 -p tcp -m tcp --dport 22202 -j DNAT --to-destination 10.10.110.202:22 
-A zSrv-prerouting -d 37.59.19.187/32 -i vmbr0 -p tcp -m tcp --dport 3306 -j DNAT --to-destination 10.10.110.202:3306 
-A zSrv-prerouting -d 37.59.19.187/32 -i vmbr0 -p tcp -m tcp --dport 22204 -j DNAT --to-destination 10.10.110.204:22 
-A zSrv-prerouting -d 37.59.19.187/32 -i vmbr0 -p tcp -m tcp --dport 21 -j DNAT --to-destination 10.10.110.204:21 
-A zSrv-prerouting -d 37.59.19.187/32 -i vmbr0 -p tcp -m tcp --dport 22201 -j DNAT --to-destination 10.10.110.201:22 
-A zThree-postrouting -s 10.10.110.0/24 -o vmbr0 -j SNAT --to-source 178.33.171.173 
-A zThree-prerouting -d 178.33.171.173/32 -i vmbr0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 10.10.110.203:8080 
-A zThree-prerouting -d 178.33.171.173/32 -i vmbr0 -p tcp -m tcp --dport 22 -j DNAT --to-destination 10.10.110.203:22 
-A zTwo-postrouting -s 10.10.110.0/24 -o vmbr0 -j SNAT --to-source 178.33.171.172 
-A zTwo-prerouting -d 178.33.171.172/32 -i vmbr0 -p tcp -m tcp --dport 22 -j DNAT --to-destination 10.10.110.202:22 
-A zTwo-prerouting -d 178.33.171.172/32 -i vmbr0 -p tcp -m tcp --dport 3306 -j DNAT --to-destination 10.10.110.202:3306 
COMMIT
# Completed on Fri Aug 9 15:11:41 2013
# Generated by iptables-save v1.4.8 on Fri Aug 9 15:11:41 2013
*mangle
:PREROUTING ACCEPT [205336522:51813689510]
:INPUT ACCEPT [164126014:42464207017]
:FORWARD ACCEPT [40538740:9276177158]
:OUTPUT ACCEPT [179321481:41392494593]
:POSTROUTING ACCEPT [225946990:55166703834]
COMMIT
# Completed on Fri Aug 9 15:11:41 2013
# Generated by iptables-save v1.4.8 on Fri Aug 9 15:11:41 2013
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:after-forwarding - [0:0]
:after-input - [0:0]
:after-output - [0:0]
:before-forwarding - [0:0]
:before-input - [0:0]
:before-output - [0:0]
:fail2ban-ssh - [0:0]
:none-brforward - [0:0]
:none-forwarding - [0:0]
:none-input - [0:0]
:none-output - [0:0]
:zFive-brforward - [0:0]
:zFive-forwarding - [0:0]
:zFive-input - [0:0]
:zFive-output - [0:0]
:zFour-brforward - [0:0]
:zFour-forwarding - [0:0]
:zFour-input - [0:0]
:zFour-output - [0:0]
:zOne-brforward - [0:0]
:zOne-forwarding - [0:0]
:zOne-input - [0:0]
:zOne-output - [0:0]
:zSrv-brforward - [0:0]
:zSrv-forwarding - [0:0]
:zSrv-input - [0:0]
:zSrv-output - [0:0]
:zThree-brforward - [0:0]
:zThree-forwarding - [0:0]
:zThree-input - [0:0]
:zThree-output - [0:0]
:zTwo-brforward - [0:0]
:zTwo-forwarding - [0:0]
:zTwo-input - [0:0]
:zTwo-output - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh 
-A INPUT -p udp -m state --state NEW -m multiport --dports 5404,5405 -j ACCEPT 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -m state --state INVALID -j DROP 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m tcp ! --tcp-option 2 --tcp-flags SYN SYN -j DROP 
-A INPUT -j before-input 
-A INPUT -j none-input 
-A INPUT -j zSrv-input 
-A INPUT -j zOne-input 
-A INPUT -j zTwo-input 
-A INPUT -j zThree-input 
-A INPUT -j zFour-input 
-A INPUT -j zFive-input 
-A INPUT -j after-input 
-A INPUT -i lo -j ACCEPT 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -p tcp -j REJECT --reject-with tcp-reset 
-A INPUT -j REJECT --reject-with icmp-port-unreachable 
-A FORWARD -m state --state INVALID -j DROP 
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -j before-forwarding 
-A FORWARD -j zSrv-forwarding 
-A FORWARD -j zOne-forwarding 
-A FORWARD -j zTwo-forwarding 
-A FORWARD -j zThree-forwarding 
-A FORWARD -j zFour-forwarding 
-A FORWARD -j zFive-forwarding 
-A FORWARD -j after-forwarding 
-A FORWARD -j zSrv-brforward 
-A FORWARD -j zOne-brforward 
-A FORWARD -j zTwo-brforward 
-A FORWARD -j zThree-brforward 
-A FORWARD -j zFour-brforward 
-A FORWARD -j zFive-brforward 
-A OUTPUT -m state --state INVALID -j DROP 
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A OUTPUT -j before-output 
-A OUTPUT -j zSrv-output 
-A OUTPUT -j zOne-output 
-A OUTPUT -j zTwo-output 
-A OUTPUT -j zThree-output 
-A OUTPUT -j zFour-output 
-A OUTPUT -j zFive-output 
-A OUTPUT -j after-output 
-A OUTPUT -j ACCEPT 
-A after-forwarding -i openvpnbr+ -o venet+ -j ACCEPT 
-A after-forwarding -i venet+ -o openvpnbr+ -j ACCEPT 
-A fail2ban-ssh -j RETURN 
-A none-input -i vmbr0 -p tcp -m tcp --dport 22 -j ACCEPT 
-A none-input -i vmbr0 -p tcp -m tcp --dport 8006 -j ACCEPT 
-A none-input -i vmbr0 -p udp -m udp --dport 1194 -j ACCEPT 
-A none-input -i vmbr0 -p tcp -m tcp --dport 80 -j ACCEPT 
-A zFive-brforward -i venet0 -o vmbr0 -j ACCEPT 
-A zFive-brforward -i vmbr0 -o venet0 -j ACCEPT 
-A zFive-brforward -i venet0 -o venet0 -j ACCEPT 
-A zFive-input -i venet0 -j ACCEPT 
-A zFour-brforward -i venet0 -o vmbr0 -j ACCEPT 
-A zFour-brforward -i vmbr0 -o venet0 -j ACCEPT 
-A zFour-brforward -i venet0 -o venet0 -j ACCEPT 
-A zFour-input -i venet0 -j ACCEPT 
-A zFour-input -d 178.33.171.174/32 -i vmbr0 -p tcp -m tcp --dport 22 -j ACCEPT 
-A zFour-input -d 178.33.171.174/32 -i vmbr0 -p tcp -m tcp --dport 21 -j ACCEPT 
-A zFour-input -d 178.33.171.174/32 -i vmbr0 -p tcp -m tcp --dport 3306 -j ACCEPT 
-A zOne-brforward -i venet0 -o vmbr0 -j ACCEPT 
-A zOne-brforward -i vmbr0 -o venet0 -j ACCEPT 
-A zOne-brforward -i venet0 -o venet0 -j ACCEPT 
-A zOne-input -i venet0 -j ACCEPT 
-A zOne-input -d 178.33.171.171/32 -i vmbr0 -p tcp -m tcp --dport 22 -j ACCEPT 
-A zSrv-brforward -i venet0 -o vmbr0 -j ACCEPT 
-A zSrv-brforward -i vmbr0 -o venet0 -j ACCEPT 
-A zSrv-brforward -i venet0 -o venet0 -j ACCEPT 
-A zSrv-input -i venet0 -j ACCEPT 
-A zSrv-input -d 37.59.19.187/32 -i vmbr0 -p tcp -m tcp --dport 22203 -j ACCEPT 
-A zSrv-input -d 37.59.19.187/32 -i vmbr0 -p tcp -m tcp --dport 8080 -j ACCEPT 
-A zSrv-input -d 37.59.19.187/32 -i vmbr0 -p tcp -m tcp --dport 22202 -j ACCEPT 
-A zSrv-input -d 37.59.19.187/32 -i vmbr0 -p tcp -m tcp --dport 3306 -j ACCEPT 
-A zSrv-input -d 37.59.19.187/32 -i vmbr0 -p tcp -m tcp --dport 22204 -j ACCEPT 
-A zSrv-input -d 37.59.19.187/32 -i vmbr0 -p tcp -m tcp --dport 21 -j ACCEPT 
-A zSrv-input -d 37.59.19.187/32 -i vmbr0 -p tcp -m tcp --dport 22201 -j ACCEPT 
-A zThree-brforward -i venet0 -o vmbr0 -j ACCEPT 
-A zThree-brforward -i vmbr0 -o venet0 -j ACCEPT 
-A zThree-brforward -i venet0 -o venet0 -j ACCEPT 
-A zThree-input -i venet0 -j ACCEPT 
-A zThree-input -d 178.33.171.173/32 -i vmbr0 -p tcp -m tcp --dport 8080 -j ACCEPT 
-A zThree-input -d 178.33.171.173/32 -i vmbr0 -p tcp -m tcp --dport 22 -j ACCEPT 
-A zTwo-brforward -i venet0 -o vmbr0 -j ACCEPT 
-A zTwo-brforward -i vmbr0 -o venet0 -j ACCEPT 
-A zTwo-brforward -i venet0 -o venet0 -j ACCEPT 
-A zTwo-input -i venet0 -j ACCEPT 
-A zTwo-input -d 178.33.171.172/32 -i vmbr0 -p tcp -m tcp --dport 22 -j ACCEPT 
-A zTwo-input -d 178.33.171.172/32 -i vmbr0 -p tcp -m tcp --dport 3306 -j ACCEPT 
COMMIT
# Completed on Fri Aug 9 15:11:41 2013

Me suis demandé si y avait des trucs à cacher là-dedans et j'ai décidé que non ...

Alors, j'utilise un script (Fridu-Firewall) pour me simplifier la config de iptables, parce que avec des containers, un nginx en load-balancer et quelques autres joyeusetés je m'en sortais pas (surtout au début tout ça n'avait qu'une IP publique).

Donc sur ce serveur (37.59.19.187 et 10.10.110.10), il y a 4 containers qui tournent sur 10.10.110.201 à 204 et des IP publiques (178.33.171.171 à 175) pour les services dispatchés sur les containers (du web, de la BDD, du git, etc ...).

Y a aussi quelques règles à la mimine, notamment :

-A after-forwarding -i openvpnbr+ -o venet+ -j ACCEPT 
-A after-forwarding -i venet+ -o openvpnbr+ -j ACCEPT

Pour que justement, chaque "zone" (@IP publique) accède au VPN et vice-versa.

Mais ca reste pas non plus, super clair our moi :(.

Y traine aussi quelques trucs, plus vraiment utiles, genre les accès SSH en 22XXX.