AdminSysGNULinux

http://www.oregontechsupport.com/articles/icmp.txt

Commande iptables de base

Règles par défaut

/etc/sysctl.conf

kernel.panic=3
net.ipv4.conf.default.arp_ignore=1
net.ipv4.conf.all.arp_ignore=1
net.ipv4.ip_forward=1
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_responses=1
net.ipv4.tcp_ecn=0
net.ipv4.tcp_fin_timeout=30
net.ipv4.tcp_keepalive_time=120
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_timestamps=0
net.netfilter.nf_conntrack_checksum=0
net.ipv4.netfilter.ip_conntrack_checksum=0
net.ipv4.netfilter.ip_conntrack_max=16384
net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=3600
net.ipv4.netfilter.ip_conntrack_udp_timeout=60
net.ipv4.netfilter.ip_conntrack_udp_timeout_stream=180
# net.ipv6.conf.all.forwarding=1
 
# disable bridge firewalling by default
net.bridge.bridge-nf-call-arptables=0
net.bridge.bridge-nf-call-ip6tables=0
net.bridge.bridge-nf-call-iptables=0
 
### JIBE
 
# ??
net.netfilter.nf_conntrack_acct=1
 
# Enable IP spoofing protection, turn on Source Address Verification
# Disable routing triangulation. Respond to queries out
# the same interface, not another. Helps to maintain state
# Also protects against IP spoofing
net.ipv4.conf.all.rp_filter=1
 
# Don't send ICMP redirect messages
net.ipv4.conf.all.send_redirects=0
# Don't accept ICMP redirect messages
net.ipv4.conf.all.accept_redirects=0
 
# How may times to retry before killing TCP connection, closed by our side. 
# Default value 7 corresponds to 50sec-16min depending on RTO. 
# If your machine is a loaded WEB server, you should think about lowering this value, such sockets may consume significant resources. Cf. tcp_max_orphans.
net.ipv4.tcp_orphan_retries=0
 
# A boolean flag controlling the behaviour under lots of incoming connections. When enabled, this causes the kernel to actively send RST packets when a service is overloaded.
net.ipv4.tcp_abort_on_overflow=0
 
# if true :  may give a way to route a packet through a firewall to an unreachable IP by specifying that IP in the route
net.ipv4.conf.all.accept_source_route=0
 
# If set, the TCP stack behaves conforming to RFC1337. If unset (the default), we are not conforming to RFC, but prevent TCP TIME-WAIT assassination.
net.ipv4.tcp_rfc1337=0
 
# Limit the maximal rates for sending ICMP packets whose type matches
# icmp_ratemask (see below) to specific targets.
# 0 to disable any limiting, otherwise the maximal rate in jiffies(1)
net.ipv4.icmp_ratelimit=20
# https://wiki.ubuntu.com/ImprovedNetworking/KernelSecuritySettings
net.ipv4.icmp_ratemask = 88089
 
# This allows reusing sockets in TIME_WAIT state for new connections when it is safe from protocol viewpoint. Default value is 0 (disabled). It is generally a safer alternative to tcp_tw_recycle
# It should not be changed without advice/request of technical experts. (default =0)
net.ipv4.tcp_tw_reuse=0
 
# http://pic.dhe.ibm.com/infocenter/wasinfo/v6r1/topic/com.ibm.websphere.base.doc/info/aes/ae/tprf_tunelinux.html
# This determines the number of probes before timing out. (default: 9, recommended 5)
net.ipv4.tcp_keepalive_probes=5
 
# This determines the wait time between isAlive interval probes (default: 75 seconds, recommended: 15-30 seconds)
net.ipv4.tcp_keepalive_intvl=15
 
# http://www.symantec.com/connect/articles/linux-firewall-related-proc-entries
# Honor ICMP redirects only when they come from a router that is currently set up as a default gateway. Should only be enabled if you have multiple routers on your network. If your network is fairly static and stable, it's better to leave this disabled.
net.ipv4.conf.all.secure_redirects=0
 
# Reply to ARP requests if we have a route to the host in question. This may be necessary in some firewall or VPN/router setups, but is generally a bad idea on hosts.
net.ipv4.conf.all.proxy_arp=0
 
#### 
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.default.send_redirects=0
net.ipv4.conf.default.accept_redirects=0
net.ipv4.conf.default.accept_source_route=0
net.ipv4.conf.default.secure_redirects=0
net.ipv4.conf.default.proxy_arp=0
 
net.ipv4.conf.lo.rp_filter=1
net.ipv4.conf.lo.send_redirects=0
net.ipv4.conf.lo.accept_redirects=0
net.ipv4.conf.lo.accept_source_route=0
net.ipv4.conf.lo.secure_redirects=0
net.ipv4.conf.lo.proxy_arp=0
 
net.ipv4.conf.eth0.rp_filter=1
net.ipv4.conf.eth0.send_redirects=0
net.ipv4.conf.eth0.accept_redirects=0
net.ipv4.conf.eth0.accept_source_route=0
net.ipv4.conf.eth0.secure_redirects=0
net.ipv4.conf.eth0.proxy_arp=0
 
net.ipv4.conf.eth0.0.rp_filter=1
net.ipv4.conf.eth0.0.send_redirects=0
net.ipv4.conf.eth0.0.accept_redirects=0
net.ipv4.conf.eth0.0.accept_source_route=0
net.ipv4.conf.eth0.0.secure_redirects=0
net.ipv4.conf.eth0.0.proxy_arp=0
 
net.ipv4.conf.eth0.1.rp_filter=1
net.ipv4.conf.eth0.1.send_redirects=0
net.ipv4.conf.eth0.1.accept_redirects=0
net.ipv4.conf.eth0.1.accept_source_route=0
net.ipv4.conf.eth0.1.secure_redirects=0
net.ipv4.conf.eth0.1.proxy_arp=0
 
net.ipv4.conf.wlan0.rp_filter=1
net.ipv4.conf.wlan0.send_redirects=0
net.ipv4.conf.wlan0.accept_redirects=0
net.ipv4.conf.wlan0.accept_source_route=0
net.ipv4.conf.wlan0.secure_redirects=0
net.ipv4.conf.wlan0.proxy_arp=0
 
net.ipv4.conf.mon.wlan0.rp_filter=1
net.ipv4.conf.mon.wlan0.send_redirects=0
net.ipv4.conf.mon.wlan0.accept_redirects=0
net.ipv4.conf.mon.wlan0.accept_source_route=0
net.ipv4.conf.mon.wlan0.secure_redirects=0
net.ipv4.conf.mon.wlan0.proxy_arp=0
####