Bonjour,
j'ai besoin d'un petit coup de main pour ouvrir les ports
edonkey/emule sur mon firewall, j'ai rajouté les quelques lignes
concernant emule mais ça ne fonctionne pas.
Dans les log j'ai ce type de ligne:
Apr 20 23:31:42 (none) kernel: IN=eth1 OUT=eth0 SRC.14.30.81
DST2.168.0.2 LEN` TOS=0x00 PREC=0x00 TTLR ID'299 DF PROTO=TCP
SPT3317 DPTF62 WINDOWX40 RES=0x00 SYN URGP=0
Je précise que depuis mon firewall, lorsque je fais un telnet sur
192.168.0.2 (machin windows avec emule) sur le port 4662, la
connection s'établit mais pas depuis l'extèrieur)
Si quelqu'un a une idée...merci.
Le script:
####################################################################
#!/bin/sh
#
IPTABLES=/usr/sbin/iptables
EXTIF="eth1"
INTIF="eth0"
IPEMULE="192.168.0.2"
/sbin/insmod ip_tables > /dev/null
/sbin/insmod ip_conntrack > /dev/null
/sbin/insmod ip_conntrack_ftp > /dev/null
/sbin/insmod iptable_nat > /dev/null
/sbin/insmod ip_nat_ftp > /dev/null
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
#Clearing any previous configuration
#
# Unless specified, the defaults for INPUT and OUTPUT is ACCEPT
# The default for FORWARD is DROP
#
#echo " clearing any existing rules and setting default policy.."
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
#$IPTABLES -t nat -Froot
#EMULE
echo "EMULE OK POUR $IPEMULE"
iptables -A INPUT -p tcp --dport 4661 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp --dport 4662 -m state --state NEW -j ACCEPT
iptables -A INPUT -p udp --dport 4665 -m state --state NEW -j ACCEPT
iptables -t nat -A PREROUTING -i $EXTIF -p tcp --dport 4661 -j DNAT
--to-destination $IPEMULE:4661
iptables -t nat -A PREROUTING -i $EXTIF -p tcp --dport 4662 -j DNAT
--to-destination $IPEMULE:4662
iptables -t nat -A PREROUTING -i $EXTIF -p udp --dport 4665 -j DNAT
--to-destination $IPEMULE:4665
#echo " FWD: Allow all connections OUT and only existing and related
ones IN"
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state
ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG
#echo " Enabling SNAT (MASQUERADE) functionality on $EXTIF"
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
####################################################################
> iptables -L donne:
mood:~ # iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp
dpt:kar2ouche state NEW
ACCEPT tcp -- anywhere anywhere tcp
dpt:4662 state NEW
ACCEPT udp -- anywhere anywhere udp
dpt:4662 state NEW
ACCEPT udp -- anywhere anywhere udp
dpt:4665 state NEW
Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state
RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level
warning
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain LnD (0 references)
target prot opt source destination
LOG tcp -- anywhere anywhere limit: avg
1/sec burst 5 LOG level warning prefix `TCP drop '
LOG udp -- anywhere anywhere limit: avg
1/sec burst 5 LOG level warning prefix `UDP drop '
LOG icmp -- anywhere anywhere limit: avg
1/sec burst 5 LOG level warning prefix `ICMP drop '
LOG all -f anywhere anywhere limit: avg
1/sec burst 5 LOG level warning prefix `FRAG drop '
DROP all -- anywhere anywhere
Chain LnR (0 references)
target prot opt source destination
LOG tcp -- anywhere anywhere limit: avg
1/sec burst 5 LOG level warning prefix `TCP reject '
LOG udp -- anywhere anywhere limit: avg
1/sec burst 5 LOG level warning prefix `UDP reject '
LOG icmp -- anywhere anywhere limit: avg
1/sec burst 5 LOG level warning prefix `ICMP reject '
LOG all -f anywhere anywhere limit: avg
1/sec burst 5 LOG level warning prefix `FRAG reject '
REJECT all -- anywhere anywhere
reject-with icmp-port-unreachable
Chain ScanD (0 references)
target prot opt source destination
LOG tcp -- anywhere anywhere limit: avg
1/sec burst 5 LOG level warning prefix `TCP Scan? '
LOG udp -- anywhere anywhere limit: avg
1/sec burst 5 LOG level warning prefix `UDP Scan? '
LOG icmp -- anywhere anywhere limit: avg
1/sec burst 5 LOG level warning prefix `ICMP Scan? '
LOG all -f anywhere anywhere limit: avg
1/sec burst 5 LOG level warning prefix `FRAG Scan? '
DROP all -- anywhere anywhere
######################################