NAT IP_PUBLIQUE IP_DMZ

[targa]

Bonjour à tous, <BR> <BR>Je souhaite pouvoir atteindre mes serveurs qui se trouvent sur ma DMZ avec leurs adresses publiques. Je pense qu'il faut faire une double translation d 'adresse, mais ca na fonctionne pas. De plus je n'arrive pas à atteindre mes serveurs de la DMZ du LAN. <BR> <BR>#!/bin/sh <BR> <BR># les constantes réseau <BR> <BR># les interfaces <BR>IFGREEN="eth0" <BR>IFRED="eth1" <BR>IFORANGE="eth2" <BR>IFLO="lo" <BR> <BR># les adresses ip fixes <BR>IP_GREEN="10.0.1.18" <BR>IP_ORANGE="10.0.0.21" <BR>LOOPBACK="127.0.0.1" <BR>BADBROADCAST="255.255.255.255" <BR> <BR># les ranges d'adresses ip <BR>NET_GREEN="10.0.1.0/24" <BR>NET_ORANGE="10.0.0.0/24" <BR> <BR> <BR>#--------------------------------------------------------------------------# <BR># Activation du forwarding <BR>#--------------------------------------------------------------------------# <BR> <BR># Disable TCP ECN (incompatible avec certains réseaux comme celui de la SNCF ou de sun) <BR>echo 1 > /proc/sys/net/ipv4/ip_forward <BR> <BR> <BR>#--------------------------------------------------------------------------# <BR># Anti-spoofing <BR>#--------------------------------------------------------------------------# <BR> <BR>if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ] <BR>then <BR> for filtre in /proc/sys/net/ipv4/conf/*/rp_filter <BR> do <BR> echo 1 > $filtre <BR> done <BR>fi <BR> <BR>#--------------------------------------------------------------------------# <BR># Pas de icmp <BR>#--------------------------------------------------------------------------# <BR> <BR>echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all <BR>echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts <BR> <BR>#--------------------------------------------------------------------------# <BR># Module ip_tables <BR>#--------------------------------------------------------------------------# <BR>modprobe ip_tables <BR>modprobe iptable_filter <BR>modprobe ip_conntrack <BR>modprobe ip_conntrack_ftp <BR>modprobe ip_conntrack_irc <BR>modprobe iptable_nat <BR>modprobe ip_nat_ftp <BR>modprobe ip_nat_irc <BR>modprobe ipt_owner <BR>modprobe iptable_mangle <BR>modprobe ipt_limit <BR>modprobe ipt_state <BR>modprobe ipt_LOG <BR>modprobe ipt_REJECT <BR>modprobe ipt_MASQUERADE <BR> <BR># Vidage de toutes les règles <BR>/sbin/iptables -F <BR>/sbin/iptables -t nat -F <BR>/sbin/iptables -X <BR>/sbin/iptables -t nat -X <BR> <BR># Création des logs <BR>iptables -N LOG_DROP <BR>iptables -A LOG_DROP -j LOG --log-prefix '[IPTABLES DROP] : ' <BR>iptables -A LOG_DROP -j DROP <BR> <BR>iptables -N LOG_ACCEPT <BR>iptables -A LOG_ACCEPT -j LOG --log-prefix '[IPTABLES ACCEPT] : ' <BR>iptables -A LOG_ACCEPT -j ACCEPT <BR> <BR># Set up policies <BR>/sbin/iptables -P INPUT DROP <BR>/sbin/iptables -P FORWARD DROP <BR>/sbin/iptables -P OUTPUT ACCEPT <BR> <BR>#--------------------------------------------------------------------------# <BR># <BR>#--------------------------------------------------------------------------# <BR> <BR># Accès local <BR>iptables -A INPUT -i lo -j ACCEPT <BR>iptables -A OUTPUT -o lo -j ACCEPT <BR> <BR>iptables -t nat -A PREROUTING -d X.X.X.147 -p tcp --dport 80 -j DNAT --to-destination 10.0.0.6:80 <BR> <BR>iptables -t nat -A PREROUTING -d X.X.X.147 -i $IFGREEN -j DNAT --to 10.0.0.6 <BR> <BR> <BR>iptables -A INPUT -p tcp --dport 22 -i $IFGREEN -j LOG_ACCEPT <BR>iptables -A OUTPUT -p tcp --sport 22 -o $IFGREEN -j LOG_ACCEPT <BR> <BR> <BR>#--------------------------------------------------------------------------# <BR># FORWARDING <BR>#--------------------------------------------------------------------------# <BR> <BR># accès GREEN <--> RED <BR>iptables -A FORWARD -i $IFGREEN -o $IFRED -j ACCEPT <BR>iptables -A FORWARD -i $IFRED -o $IFGREEN -j ACCEPT <BR> <BR># accès DMZ <--> GREEN <BR>iptables -A FORWARD -i $IFGREEN -o $IFORANGE -m state --state NEW,ESTABLISHED -j ACCEPT <BR>iptables -A FORWARD -i $IFORANGE -o $IFGREEN -m state --state ESTABLISHED -j ACCEPT <BR> <BR># accès DMZ <--> RED <BR>iptables -A FORWARD -i $IFRED -o $IFORANGE -m state --state NEW,ESTABLISHED -j ACCEPT <BR>iptables -A FORWARD -i $IFORANGE -o $IFRED -m state --state ESTABLISHED -j ACCEPT <BR> <BR>#--------------------------------------------------------------------------# <BR># Masquerading <BR>#--------------------------------------------------------------------------# <BR> <BR>iptables -t nat -A POSTROUTING -s $NET_GREEN -j MASQUERADE <BR># Nat pour la DMZ <BR>iptables -t nat -A POSTROUTING -s $NET_ORANGE -j MASQUERADE <BR> <BR>iptables -A FORWARD -j LOG_DROP <BR>iptables -A INPUT -j LOG_DROP <BR>iptables -A OUTPUT -j LOG_DROP <BR> <BR> <BR>Quelqu'un pourrait il m'aider ? <BR>