[IPTABLES] ne tient pas compte de mes règles ?

[moustic]

Voici le contenu de mon fichier /etc/iptables/iptables.rules:

# Generated by iptables-save v1.3.7 on Wed Jun 6 18:12:42 2007
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2212:606693]
:f0to1 - [0:0]
:f1to0 - [0:0]
:logaborted - [0:0]
:logaborted2 - [0:0]
:logdrop - [0:0]
:logdrop2 - [0:0]
:logreject - [0:0]
:logreject2 - [0:0]
:nicfilt - [0:0]
:s0 - [0:0]
:s1 - [0:0]
:srcfilt - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p igmp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A INPUT -p udp -m udp --dport 631 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 139 -j ACCEPT
-A INPUT -p udp -m udp --dport 139 -j ACCEPT
-A INPUT -p udp -m udp --dport 177 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 6001 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2401 -j ACCEPT
-A INPUT -p udp -m udp --dport 1234 -j ACCEPT
-A INPUT -d 224.2.127.254 -p udp -m udp --dport 9875 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 30000:33000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1720 -j ACCEPT
-A INPUT -p udp -m udp --dport 5000:5006 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Wed Jun 6 18:12:42 2007
# Generated by iptables-save v1.3.7 on Wed Jun 6 18:12:42 2007
*nat
REROUTING ACCEPT [52:6176]
OSTROUTING ACCEPT [657:47487]
:OUTPUT ACCEPT [657:47487]
COMMIT
# Completed on Wed Jun 6 18:12:42 2007

Et voici les règles appliquées par iptables:

iptables -L -v

Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
289 16002 ACCEPT 0 -- lo any anywhere anywhere
15 1110 ACCEPT icmp -- any any anywhere anywhere
0 0 ACCEPT igmp -- any any anywhere anywhere
3058 960K ACCEPT 0 -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ftp-data
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ftp
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:smtp
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:domain
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:domain
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:http
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:631
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:631
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:netbios-ssn
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:netbios-ssn
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:xdmcp
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:6001
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:cvspserver
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:1234
0 0 ACCEPT udp -- any any anywhere SAP.MCAST.NET udp dpt:9875
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpts:30000:33000
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1720
0 0 ACCEPT udp -- any any anywhere anywhere udp dpts:5000:5006
103 14537 REJECT 0 -- any any anywhere anywhere reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 4162 packets, 2346K bytes)
pkts bytes target prot opt in out source destination

Chain f0to1 (0 references)
pkts bytes target prot opt in out source destination

Chain f1to0 (0 references)
pkts bytes target prot opt in out source destination

Chain logaborted (0 references)
pkts bytes target prot opt in out source destination

Chain logaborted2 (0 references)
pkts bytes target prot opt in out source destination

Chain logdrop (0 references)
pkts bytes target prot opt in out source destination

Chain logdrop2 (0 references)
pkts bytes target prot opt in out source destination

Chain logreject (0 references)
pkts bytes target prot opt in out source destination

Chain logreject2 (0 references)
pkts bytes target prot opt in out source destination

Chain nicfilt (0 references)
pkts bytes target prot opt in out source destination

Chain s0 (0 references)
pkts bytes target prot opt in out source destination

Chain s1 (0 references)
pkts bytes target prot opt in out source destination

Chain srcfilt (0 references)
pkts bytes target prot opt in out source destination

???

C'est quoi le problème ? Mon pc n'a pas de parefeu !!!

Une aide serait la bienvenue...merci.

[Skunnyk]

Hum, je crois que ya un point a eclaircir
Par defaut iptables n'est pas activé => tout passe
La tu lui rajoute par exemple : -A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
=> accepter le port 20 en tcp, donc il "ouvre" la regle, mais vu qu'elle est deja ouverte .. bah rien ne se passe
Et ainsi de suite
Il faut faire en 1er lieu un "DROP" de tout, par exemple
# iptables -A INPUT -j DROP

La tu bloque TOUT traffic entrant
Ensuite tu appliques ton script, il devrais y avoir un meilleur résultat

[moustic]

En fait, mon parefeu IPTABLES fonctionne très bien et j'ai même amélioré les regles. Néanmoins, avec cette configuration il ne détecte plus mon modem-routeur UPnP ?

# Generated by iptables-save v1.3.7 on Wed Jun 6 18:12:42 2007
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p igmp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5335 -j ACCEPT
-A INPUT -p udp -m udp --dport 5237 -j ACCEPT
-A INPUT -p udp -m udp --dport 5591 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A INPUT -p udp -m udp --dport 631 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 139 -j ACCEPT
-A INPUT -p udp -m udp --dport 139 -j ACCEPT
-A INPUT -p udp -m udp --dport 177 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 6001 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2401 -j ACCEPT
-A INPUT -p udp -m udp --dport 1234 -j ACCEPT
-A INPUT -d 224.2.127.254 -p udp -m udp --dport 9875 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 30000:33000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1720 -j ACCEPT
-A INPUT -p udp -m udp --dport 5000:5006 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Wed Jun 6 18:12:42 2007

Avez-vous la solution ? Merci.

[moustic]

Il faut ouvrir le port 5000 tcp pour avoir UPnP ?

-A INPUT -p tcp -m tcp --dport 5000 -j ACCEPT