Configurations des interfaces
•auto eth0•iface eth0 inet static• address 10.10.15.111• netmask 255.255.255.0• network 10.10.15.0• broadcast 10.10.15.255• gateway 10.10.15.250
Configurations des interfaces
•auto eth1•iface eth1 inet static• address 172.16.0.1• netmask 255.255.255.0• network 172.16.0.1• broadcast 172.16.0.255
Configurations des interfaces
•auto eth2•iface eth1 inet static• address 192.168.1.1• netmask 255.255.255.0• network 192.168.1.0• broadcast 192.168.0.255
Routage sans les VPN
•echo "1" > /proc/sys/net/ipv4/ip_forward• /etc/sysctl.conf
• tcpdump -n -i eth2•10:53:22.426214 IP 192.168.1.8 >
192.168.2.7: ICMP echo request, id 256, seq 5598, length 72
•10:53:22.426361 IP 192.168.2.7 > 192.168.1.8: ICMP echo reply, id 256, seq 5598, length 72
Routage avec les VPN
•ip route flush table all•services networking stop•services networking start• ip route add 192.168.2.0/24 via
172.16.0.2•ip route add 172.17.0.0/24 via 172.16.0.2
Routage avec les VPN
•ip route flush table all•services networking stop•services networking start• ip route add 192.168.1.0/24 via
172.17.0.2•ip route add 172.16.0.0/24 via 172.17.0.2
Le NAT
•iptables -v -t nat -A POSTROUTING -j MAQUERADE
•iptavles -v -t nat -i eth2 -A PREROUTING -s 10.10.15.2 -j DNAT --to 172.16.0.2
Le NAT
•iptables -v -t nat -A POSTROUTING -j MAQUERADE
•iptavles -v -t nat -i eth2 -A PREROUTING -s 10.10.15.111 -j DNAT --to 172.17.0.2
Firewall
•Policy
•iptables -v -P INPUT ACCEPT•iptables -v -P OUTPUT ACCEPT•iptables -v -P FORWARD DROP
•iptables -v -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
Firewall
•ICMP, test réseau
•# Autorisons l'ICMP sur tout le réseau•iptables -v -A FORWARD -p ICMP -j
ACCEPT
•# Autorisons l'ip 8.8.8.8 de google•iptables -v -A FORWARD -d 8.8.8.8 -j
ACCEPT
Firewall
•Client WEB:
•iptables -v -A FORWARD -s 192.168.1.4 -p TCP -m multiport --dports 80,443 -j DROP
Firewall
•VPN:
•#GRE•iptables -v -A FORWARD -p 47 -j ACCEPT
•iptables -v -A FORWARD -s 172.16.0.2 -p TCP --sport 1723 -j ACCEPT
•iptables -v -A FORWARD -d 172.16.0.2 -p TCP --sport 1723 -j ACCEPT
Firewall•IPSEC:
•iptables -v -A FORWARD -p 50 -j ACCEPT# ESP
•iptables -v -A FORWARD -p 51 -j ACCEPT# AH
•iptables -v -A FORWARD -s 172.16.0.2 -p UDP -j ACCEPT
•iptables -v -A FORWARD -d 172.16.0.2 -p UDP -j ACCEPT
Firewall
•SSH, web, SQUID
• iptables -v -A FORWARD -d 172.16.0.4 -p TCP -m multiport --dports 22,80,8080,3128 -j ACCEPT
•MAIL:• iptables -v -A FORWARD -d 192.168.1.5 -p
TCP -m multiport --dports 25,110,587,995 -j ACCEPT
Firewall
•Active Directory
• iptables -v -A FORWARD -d 192.168.1.0/24 -p UDP -m multiport --dports 53,67,68,88,137,138,389,464,2535 -j ACCEPT
• iptables -v -A FORWARD -s 192.168.1.0/24 -p TCP -m multiport --dports 53,80,88,135,139,389,443,445,464,636,3128,3268,3269,5722,9389 -j ACCEPT