NetFilter : connexion refusee gestion de la connexion

Bonjour,

J'ai modifié la configuration du serveur SSH pour que le serveurs écoute
sur le port 443. Dans le fichier /etc/ssh/sshd_config :

Port 443


Quand j'essaye depuis ma machine la connection suivante :
ssh -2 -p 443 theusername@themachinename
Ca marche nickel mais ce ne marche depuis internet.

En logguant netfilter, je vois mes packets de connexions droppés dans
/var/log/messages :
.
Sep 8 13:24:48 paradise kernel: IPTABLES TCP-IN: IN=eth1 OUT=
MAC:60:4c:14:d8:2e:00:60:4c:14:d8:2f:08:00 SRC5.248.192.4
DST.57.11.43 LENd TOS=0x00 PREC=0x00 TTLS IDB043 DF PROTO=TCP
SPT)333 DPTD3 WINDOW2850 RES=0x00 SYN URGP=0
Sep 8 13:24:51 paradise kernel: IPTABLES TCP-IN: IN=eth1 OUT=
MAC:60:4c:14:d8:2e:00:60:4c:14:d8:2f:08:00 SRC5.248.192.4
DST.57.11.43 LENd TOS=0x00 PREC=0x00 TTLS IDB044 DF PROTO=TCP
SPT)333 DPTD3 WINDOW2850 RES=0x00 SYN URGP=0
.

Je lis une bonne documentation sur :
http://www.kalamazoolinux.org/prese...track.html
mais je n'arrive toujours pas à trouver un bon ensemble de règles pour
permettre ma connectionSSH. Les règles concernant SSH sont les suivantes :
/sbin/iptables -A INPUT -p tcp --sport 443 -m state --state
NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 443 -m state --state
NEW,ESTABLISHED -j ACCEPT

idées, conseils sont vraiment les bienvenus.

Cordialement,

Jeannot Lelapin


L'ensemble des règles : /etc/iptables.rules


##
#!/bin/bash
## ==
## Load modules

IPTABLES="/sbin/iptables"
DEPMOD="/sbin/depmod"
MODPROBE="/sbin/modprobe"

# Load all required IPTables modules
# Needed to initially load modules
$DEPMOD -a
# Load appropriate modules.
$MODPROBE ip_tables
# Support for connection tracking
$MODPROBE ip_conntrack
$MODPROBE ip_conntrack_ftp

# MODIF BEGIN
$MODPROBE ip_conntrack_irc
# Adds some $IPTABLES targets like LOG, REJECT and MASQUARADE.
$MODPROBE ipt_LOG
$MODPROBE ipt_REJECT
$MODPROBE ipt_MASQUERADE
# Support for owner matching
$MODPROBE ipt_owner
# MODIF END

## ==
## Reset all configurations

$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z

## ==
## Default Policy

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

## ==
## Some definitions:

##
## Kernel flags
#
/bin/echo "1" > /proc/sys/net/ipv4/ip_dynaddr
/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
/bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
/bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
/bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
/bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
for interface in /proc/sys/net/ipv4/conf/*/rp_filter; do
/bin/echo "1" > ${interface}
done
/bin/echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
/bin/echo "0" > /proc/sys/net/ipv4/ip_forward

##
# RULES

## LOOPBACK
# Allow unlimited traffic on the loopback interface.
$IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A OUTPUT -o lo -j ACCEPT

## SYN-FLOODING PROTECTION
$IPTABLES -N syn-flood
$IPTABLES -A INPUT -p tcp --syn -j syn-flood
$IPTABLES -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN
$IPTABLES -A syn-flood -j DROP

## FRAGMENTS
$IPTABLES -A INPUT -f -j LOG --log-prefix "IPTABLES FRAGMENTS: "
$IPTABLES -A INPUT -f -j DROP

## Make sure NEW tcp connections are SYN packets
$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

## DNS
# Allow UDP packets in for DNS client from nameservers.
$IPTABLES -A INPUT -p udp -s 212.27.32.5 --sport 53 -m state --state
ESTABLISHED -j ACCEPT
# Allow UDP packets to DNS servers from client.
$IPTABLES -A OUTPUT -p udp -d 212.27.32.5 --dport 53 -m state --state
NEW,ESTABLISHED -j ACCEPT

## WWW
# Allow www outbound to 80.
$IPTABLES -A INPUT -p tcp --sport 80 -m state --state ESTABLISHED -j
ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED
-j ACCEPT

## SSH
# Allow ssh outbound.
$IPTABLES -A INPUT -p tcp --sport 443 -m state --state NEW,ESTABLISHED
-j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED
-j ACCEPT

# ICMP
# We accept icmp in if it is "related" to other connections
$IPTABLES -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
# We always allow icmp out.
$IPTABLES -A OUTPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j
ACCEPT

## LOGGING
# Any udp not already allowed is logged and then dropped.
$IPTABLES -A INPUT -p udp -j LOG --log-prefix "IPTABLES UDP-IN: "
$IPTABLES -A INPUT -p udp -j DROP
$IPTABLES -A OUTPUT -p udp -j LOG --log-prefix "IPTABLES UDP-OUT: "
$IPTABLES -A OUTPUT -p udp -j DROP
# Any icmp not already allowed is logged and then dropped.
$IPTABLES -A INPUT -p icmp -j LOG --log-prefix "IPTABLES ICMP-IN: "
$IPTABLES -A INPUT -p icmp -j DROP
$IPTABLES -A OUTPUT -p icmp -j LOG --log-prefix "IPTABLES ICMP-OUT: "
$IPTABLES -A OUTPUT -p icmp -j DROP
# Any tcp not already allowed is logged and then dropped.
$IPTABLES -A INPUT -p tcp -j LOG --log-prefix "IPTABLES TCP-IN: "
$IPTABLES -A INPUT -p tcp -j DROP
$IPTABLES -A OUTPUT -p tcp -j LOG --log-prefix "IPTABLES TCP-OUT: "
$IPTABLES -A OUTPUT -p tcp -j DROP
# Anything else not already allowed is logged and then dropped.
$IPTABLES -A INPUT -j LOG --log-prefix "IPTABLES PROTOCOL-X-IN: "
$IPTABLES -A INPUT -j DROP
$IPTABLES -A OUTPUT -j LOG --log-prefix "IPTABLES PROTOCOL-X-OUT: "
$IPTABLES -A OUTPUT -j DROP