blocage ping

par **blackbird** » 31 Oct 2003 18:39

Bonjour à tous, Via des infos prises sur le site d'Antolien j'ai essayé d'empêcher mon gateway ipcop de répondre aux pings sur l"interface rouge. J'ai donc ajouté dans /etc/rc.d/firewall.rc /sbin/iptables -A INPUT -p icmp --icmp-type 0 -i $RED_DEV -j DROP /sbin/iptables -A INPUT -p icmp --icmp-type 5 -i $RED_DEV -j DROP /sbin/iptables -A INPUT -p icmp --icmp-type 8 -i $RED_DEV -j DROP Après # localhost and ethernet. /sbin/iptables -A INPUT -i lo -j ACCEPT Et avant /sbin/iptables -A INPUT -p icmp -j ACCEPT Ce qui donne donc : # localhost and ethernet. /sbin/iptables -A INPUT -i lo -j ACCEPT /sbin/iptables -A INPUT -p icmp --icmp-type 0 -i $RED_DEV -j DROP /sbin/iptables -A INPUT -p icmp --icmp-type 5 -i $RED_DEV -j DROP /sbin/iptables -A INPUT -p icmp --icmp-type 8 -i $RED_DEV -j DROP /sbin/iptables -A INPUT -p icmp -j ACCEPT Malgré tout, on sait encore pinger mon interface WAN. Any ideas ? Thxs

par **tomtom** » 31 Oct 2003 19:01

1- As-tu redemarré ton ipcop ? 2- d'ou fais-tu tes tests ? 3- quelle est ta version de ipcop ? T.

par **blackbird** » 31 Oct 2003 19:31

J'ai fait des tests depuis l'extérieur. J'ai rebooté ma machine et voici mon ip : 81.240.114.131 Help <IMG SRC="images/smiles/icon_smile.gif">

par **linlau** » 31 Oct 2003 21:25

idem pour moi. Avec les mêmes règles <IMG SRC="images/smiles/icon_razz.gif">

par **grosbedos** » 31 Oct 2003 21:55

salu tomtom avait pausé trois questions

par **blackbird** » 01 Nov 2003 00:12

sorry, pour la troisième question : ipcop 1.3 avec tous les patchs.

par **grosbedos** » 01 Nov 2003 00:35

tu n'as pas modifié les regles precedentes ???? peux tu donner un resultat d'un iptables -L ?? bizard bizard, ces regles ont eté testé sur plusieurs conf sans prob.. <IMG SRC="images/smiles/icon_confused.gif"> _________________ Pour retrouver une aiguille dans une botte de foin, il suffit d'y mettre le feu puis de fouiller les cendres avec un aimant. Bernard Werber

par **grosbedos** » 01 Nov 2003 00:41

tu pourrais aussi essayer de relancer le firewall manuellement : /etc/rc.d/rc.firewall restart voir si y donne ^pas d'erreur...

par **blackbird** » 01 Nov 2003 00:55

Tout d'abord merci pour ton aide. J'ai relancé le firewall manuellement -> aucune erreur. Voici le résultat d'un iptables -L Chain INPUT (policy DROP) target prot opt source destination PSCAN tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG PSCAN tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE tcp -- anywhere anywhere tcp flags:SYN,RST,ACK/SYN limit: avg 10/sec burst 5 CUSTOMINPUT all -- anywhere anywhere ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere DROP icmp -- anywhere anywhere icmp echo-reply DROP icmp -- anywhere anywhere icmp redirect DROP icmp -- anywhere anywhere icmp echo-request ACCEPT icmp -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere RED all -- anywhere anywhere XTACCESS all -- anywhere anywhere LOG all -- anywhere anywhere limit: avg 10/min burst 5 LOG level warning prefix `INPUT ' Chain FORWARD (policy DROP) target prot opt source destination PSCAN tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG PSCAN tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE CUSTOMFORWARD all -- anywhere anywhere ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere PORTFWACCESS all -- anywhere anywhere DMZHOLES all -- anywhere anywhere LOG all -- anywhere anywhere limit: avg 10/min burst 5 LOG level warning prefix `OUTPUT ' Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain CUSTOMFORWARD (1 references) target prot opt source destination Chain CUSTOMINPUT (1 references) target prot opt source destination Chain DMZHOLES (1 references) target prot opt source destination Chain PORTFWACCESS (1 references) target prot opt source destination Chain PSCAN (4 references) target prot opt source destination LOG tcp -- anywhere anywhere limit: avg 10/min burst 5 LOG level warning prefix `TCP Scan? ' LOG udp -- anywhere anywhere limit: avg 10/min burst 5 LOG level warning prefix `UDP Scan? ' LOG icmp -- anywhere anywhere limit: avg 10/min burst 5 LOG level warning prefix `ICMP Scan? ' LOG all -f anywhere anywhere limit: avg 10/min burst 5 LOG level warning prefix `FRAG Scan? ' DROP all -- anywhere anywhere Chain RED (1 references) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT gre -- anywhere anywhere ACCEPT ipv6-crypt-- anywhere anywhere ACCEPT ipv6-auth-- anywhere anywhere ACCEPT udp -- anywhere anywhere udp spt:isakmp dpt:isakmp Chain XTACCESS (1 references)

par **tomtom** » 01 Nov 2003 00:56

ACCEPT all -- anywhere anywhere C'est koi ca ??? Tu as modifieé d'autres regles !!! t.

par **grosbedos** » 01 Nov 2003 01:00

et ca revient plusieurs fois... envoie voir ton rc.firewall?? <IMG SRC="images/smiles/icon_eek.gif">

par **blackbird** » 01 Nov 2003 01:08

Chain INPUT (policy DROP) target prot opt source destination PSCAN tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG PSCAN tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE tcp -- anywhere anywhere tcp flags:SYN,RST,ACK/SYN limit: avg 10/sec burst 5 CUSTOMINPUT all -- anywhere anywhere ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere DROP icmp -- anywhere anywhere icmp echo-reply DROP icmp -- anywhere anywhere icmp redirect #!/bin/sh . /var/ipcop/ppp/settings . /var/ipcop/ethernet/settings IFACE=`/bin/cat /var/ipcop/red/iface | /usr/bin/tr -d '012'` iptables_init() { echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route echo 1 > /proc/sys/net/ipv4/conf/all/log_martians # Reduce DoS'ing ability by reducing timeouts echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout echo 0 > /proc/sys/net/ipv4/tcp_window_scaling echo 0 > /proc/sys/net/ipv4/tcp_timestamps echo 0 > /proc/sys/net/ipv4/tcp_sack echo 1024 > /proc/sys/net/ipv4/tcp_max_syn_backlog # Flush all rules and delete all custom chains /sbin/iptables -F /sbin/iptables -t nat -F /sbin/iptables -X /sbin/iptables -t nat -X # Set up policies /sbin/iptables -P INPUT DROP /sbin/iptables -P FORWARD DROP /sbin/iptables -P OUTPUT ACCEPT # This chain will log, then DROPs "Xmas" and Null packets which might # indicate a port-scan attempt /sbin/iptables -N PSCAN /sbin/iptables -A PSCAN -p tcp -m limit --limit 10/minute -j LOG --log-prefix "TCP Scan? " /sbin/iptables -A PSCAN -p udp -m limit --limit 10/minute -j LOG --log-prefix "UDP Scan? " /sbin/iptables -A PSCAN -p icmp -m limit --limit 10/minute -j LOG --log-prefix "ICMP Scan? " /sbin/iptables -A PSCAN -f -m limit --limit 10/minute -j LOG --log-prefix "FRAG Scan? " /sbin/iptables -A PSCAN -j DROP # Disallow packets frequently used by port-scanners, XMas and Null /sbin/iptables -A INPUT -p tcp --tcp-flags ALL ALL -j PSCAN /sbin/iptables -A FORWARD -p tcp --tcp-flags ALL ALL -j PSCAN /sbin/iptables -A INPUT -p tcp --tcp-flags ALL NONE -j PSCAN /sbin/iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j PSCAN } iptables_red() { /sbin/iptables -F RED /sbin/iptables -t nat -F RED # PPPoE / PPTP Device if [ "$IFACE" != "" ]; then # PPPoE / PPTP if [ "$DEVICE" != "" ]; then /sbin/iptables -A RED -i $DEVICE -j ACCEPT fi if [ "$RED_TYPE" = "PPTP" -o "$RED_TYPE" = "PPPOE" ]; then if [ "$RED_DEV" != "" ]; then /sbin/iptables -A RED -i $RED_DEV -j ACCEPT fi fi fi if [ "$IFACE" != "" -a -f /var/ipcop/red/active ]; then # DHCP if [ "$RED_DEV" != "" -a "$RED_TYPE" = "DHCP" ]; then /sbin/iptables -A RED -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT /sbin/iptables -A RED -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT fi if [ "$PROTOCOL" = "RFC1483" -a "$METHOD" = "DHCP" ]; then /sbin/iptables -A RED -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT /sbin/iptables -A RED -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT fi # Allow IPSec /sbin/iptables -A RED -p 47 -i $IFACE -j ACCEPT /sbin/iptables -A RED -p 50 -i $IFACE -j ACCEPT /sbin/iptables -A RED -p 51 -i $IFACE -j ACCEPT /sbin/iptables -A RED -p udp -i $IFACE --sport 500 --dport 500 -j ACCEPT # Outgoing masquerading /sbin/iptables -t nat -A RED -o $IFACE -j MASQUERADE fi } # See how we were called. case "$1" in start) iptables_init # Limit Packets- helps reduce dos/syn attacks /sbin/iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit --limit 10/sec # CUSTOM chains, can be used by the users themselves /sbin/iptables -N CUSTOMINPUT /sbin/iptables -A INPUT -j CUSTOMINPUT /sbin/iptables -N CUSTOMFORWARD /sbin/iptables -A FORWARD -j CUSTOMFORWARD /sbin/iptables -t nat -N CUSTOMPREROUTING /sbin/iptables -t nat -A PREROUTING -j CUSTOMPREROUTING # Accept everyting connected /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT /sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT # localhost and ethernet. /sbin/iptables -A INPUT -i lo -j ACCEPT /sbin/iptables -A INPUT -p icmp --icmp-type 0 -i $RED_DEV -j DROP /sbin/iptables -A INPUT -p icmp --icmp-type 5 -i $RED_DEV -j DROP /sbin/iptables -A INPUT -p icmp --icmp-type 8 -i $RED_DEV -j DROP /sbin/iptables -A INPUT -p icmp -j ACCEPT /sbin/iptables -A INPUT -i $GREEN_DEV -j ACCEPT /sbin/iptables -A FORWARD -i $GREEN_DEV -j ACCEPT # accept all traffic from ipsec interfaces /sbin/iptables -A INPUT -i ipsec+ -j ACCEPT /sbin/iptables -A FORWARD -i ipsec+ -j ACCEPT # Port forwarding if [ "$ORANGE_DEV" != "" ]; then # This rule enables a host on ORANGE network to connect to the outside /sbin/iptables -A FORWARD -i $ORANGE_DEV -o ipsec+ -j DROP /sbin/iptables -A FORWARD -i $ORANGE_DEV -p tcp -o ! $GREEN_DEV -j ACCEPT /sbin/iptables -A FORWARD -i $ORANGE_DEV -p udp -o ! $GREEN_DEV -j ACCEPT fi # RED chain, used for the red interface /sbin/iptables -N RED /sbin/iptables -A INPUT -j RED /sbin/iptables -t nat -N RED /sbin/iptables -t nat -A POSTROUTING -j RED iptables_red # XTACCESS chain, used for external access /sbin/iptables -N XTACCESS /sbin/iptables -A INPUT -j XTACCESS # PORTFWACCESS chain, used for portforwarding /sbin/iptables -N PORTFWACCESS /sbin/iptables -A FORWARD -j PORTFWACCESS # DMZ pinhole chain. setdmzholes setuid prog adds rules here to allow # ORANGE to talk to GREEN. /sbin/iptables -N DMZHOLES /sbin/iptables -A FORWARD -o $GREEN_DEV -j DMZHOLES # Custom prerouting chains (for transparent proxy and port forwarding) /sbin/iptables -t nat -N SQUID /sbin/iptables -t nat -A PREROUTING -j SQUID /sbin/iptables -t nat -N PORTFW /sbin/iptables -t nat -A PREROUTING -j PORTFW # last rule in input and forward chain is for logging. /sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "INPUT " /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "OUTPUT " ;; stop) iptables_init # Accept everyting connected /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # localhost and ethernet. /sbin/iptables -A INPUT -i lo -j ACCEPT /sbin/iptables -A INPUT -i $GREEN_DEV -j ACCEPT if [ "$RED_DEV" != "" -a "$RED_TYPE" = "DHCP" ]; then /sbin/iptables -A INPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT /sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT fi if [ "$PROTOCOL" = "RFC1483" -a "$METHOD" = "DHCP" ]; then /sbin/iptables -A INPUT -p tcp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT /sbin/iptables -A INPUT -p udp --source-port 67 --destination-port 68 -i $IFACE -j ACCEPT fi /sbin/iptables -A INPUT -m limit --limit 10/minute -j LOG --log-prefix "INPUT " /sbin/iptables -A FORWARD -m limit --limit 10/minute -j LOG --log-prefix "OUTPUT " ;; reload) iptables_red ;; restart) $0 stop $0 start ;; *) echo "Usage: $0 {start|stop|reload|restart}" exit 1 ;; esac exit 0

par **tomtom** » 01 Nov 2003 01:28

j'pige po.. On va faire un test : tape ceci dans une console : iptables -I INPUT -p icmp --icmp-type echo-request -j DROP pis tu reteste le ping ! t. _________________ "Unix is user friendly. He's just very picky about who his friends are... "

par **grosbedos** » 01 Nov 2003 01:35

j'attendais demain pour dire que je pige pas...mais ca a l'air normal lol ce qui est bizard c'est que si t'as fait ce que je T dit de faire, tu as fait un firewall restart...et ton ping fonctionne encore ! normalement toutes les regles sont rechargé, et seulement les regles du rc.firewall... donc euh..ca doit etre la (??)

par **tomtom** » 01 Nov 2003 01:48

et ben voila ca bloque ces pings <IMG SRC="images/smiles/icon_wink.gif"> Bon, je vois pas ou est le problème du rc.firewall... Tu l'as edité sous windows ?? T.

blocage ping

Qui est en ligne ?