eueuh oui sauf que netfilter c le projet initila, donc si il y a un site à connaitre et à prendre en reference c celui la!
sinon, prends bien soin d'activer les options netfilter pour ton nouveau noyau (et oui, il faut recompiler..), a la limite active les toutes sauf les experimentales si tu n'est pas sur de toi, et vi powa
je te file un exemple, adapte ensuite à ta sauce:
EDIT:pas la peine de te prendre la tete avec les modules spécifiques, maintenant si tu as des questions n'hesites pas
#!/bin/bash
# Another iptables fw-masq-ppp example ....
# 4 Dec 2002 00:58 by MdK
echo "Launching firewall : iptables."
INTERNAL_INTERFACE="eth0" # My LAN card
EXTERNAL_INTERFACE="ppp0" # My Modem
LOCAL_NET="192.168.0.0/24" # My LAN adress range
LOCAL_BCAST="192.168.0.255" # My LAN broadcast adress
LOCAL_ADRESS="192.168.0.1" # My LAN unique adress
# Initialization section
#------------------------------
# Close Reset except for us
# Do NOT use ACCEPT for INPUT rule if you dont know what you are doing ! Prefer the Close reset and consult man pages or HOWTO ...
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle -X
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
#
# Anti-abuse rules ---
#
# First we create a specific rule for our needs
iptables -N ABUSE
# Abusive ping protect
iptables -A ABUSE -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT # Against "Ping of Death"
iptables -A ABUSE -p icmp --icmp-type 8 -m length --length 93: -j DROP
iptables -A ABUSE -p icmp --icmp-type 8 -j ACCEPT
iptables -A ABUSE -p icmp --icmp-type 11 -j ACCEPT
# Portscan protect
# Need psd.patch from netfilter patch-o-matic
iptables -A ABUSE -m psd -i $EXTERNAL_INTERFACE -j REJECT --reject-with icmp-host-unreachable
iptables -A ABUSE -p tcp -i $EXTERNAL_INTERFACE --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
#iptables -A ABUSE -p icmp --icmp-type 0 -j REJECT --reject-with icmp-host-unreachable # If you are not born to be alive..
#iptables -A ABUSE -p icmp --icmp-type 5 -j REJECT --reject-with icmp-host-unreachable #
# ---
#
#
# Black widow rules ---
#
# Blacklisted ip protect
# Use with AcidLab module BlackWidow (thx MdK)
# First we create a specific rule for our needs
iptables -N BLACK_WIDOW
BW_DIR=/usr/share/acidlab/BW
$BW_DIR/black_widow.sh 3 >/tmp/blacklist
for ip in `cat /tmp/blacklist`
do
iptables -A BLACK_WIDOW -s $ip -j DROP
done
rm -f /tmp/blacklist
# ---
#
#
# External traffic rules ---
#
# First we create a specific rule for our needs
iptables -N DOOR
# Then we release our local net except for possible traffic on NetBios
iptables -A DOOR -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A DOOR -i $EXTERNAL_INTERFACE -p tcp ! --syn -m state --state NEW -j DROP # Reject "new-not-syn" packets
iptables -A DOOR -i $EXTERNAL_INTERFACE -p tcp --dport 139 -j DROP # Reject any NetBIOS stuff
iptables -A DOOR -i $EXTERNAL_INTERFACE -p tcp --dport 445 -j DROP # Idem
iptables -A DOOR -i ! $EXTERNAL_INTERFACE -m state --state NEW -j ACCEPT # Let's connect us to the world!
# And here we work around worldwide net ingoing connections
iptables -A DOOR -m state --state NEW -p tcp --dport 22 -j ACCEPT #SSH
iptables -A DOOR -m state --state NEW -p tcp --dport 80 -j ACCEPT #HTTP
iptables -A DOOR -m state --state NEW -p tcp --dport 443 -j ACCEPT #HTTPS
iptables -A DOOR -m state --state NEW -p tcp --dport 25 -j ACCEPT #SMTP
# HALFLIFE
#iptables -A DOOR -m state --state NEW -p udp --dport 27015 -j ACCEPT
# VPN
#iptables -A DOOR -m state --state NEW -i ipsec+ -o $EXTERNAL_INTERFACE -j ACCEPT
#iptables -A DOOR -m state --state NEW -i $EXTERNAL_INTERFACE -o ipsec+ -j ACCEPT
# And now close any else stuff
iptables -A DOOR -j DROP
# ---
#
#---------------------------------------------------------------------------------
# FILTER section
#---------------------------------------------------------------------------------
# Against abuse
iptables -A INPUT -j ABUSE
iptables -A INPUT -j BLACK_WIDOW
# Then we open our door
iptables -A INPUT -j DOOR
iptables -A FORWARD -j DOOR
#---------------------------------------------------------------------------------
# NAT section
#---------------------------------------------------------------------------------
# Masquerade local net
iptables -t nat -A POSTROUTING -s $LOCAL_NET -o $EXTERNAL_INTERFACE -j MASQUERADE
iptables -t nat -A PREROUTING -s 127.0.0.1/8 -i ! lo -j DROP
#---------------------------------------------------------------------------------
# MANGLE section
#---------------------------------------------------------------------------------
# Rendo il server invisibile ai traceroute dall'interno (thx Ghezzo)
# Need TTL.patch from netfilter patch-o-matic
iptables -t mangle -A PREROUTING -j TTL --ttl-inc 1
# EOF
# Enjoy! and see
http://www.netfilter.com for updates
