corrections de différents bugs de fonctionnement et configuration

2022-12-19 19:44:35 +01:00
parent 93d7f3fb2b
commit e0b5b425ed
11 changed files with 139 additions and 21 deletions
@@ -0,0 +1,46 @@
+*filter
+########### Regles iptables ###########
+# Flush des regles
+-F INPUT
+-F FORWARD
+-F OUTPUT
+
+# Policies par defaut
+-P INPUT DROP
+-P FORWARD DROP
+-P OUTPUT DROP
+
+# On accepte le loopback
+-A INPUT -i lo -j ACCEPT
+-A OUTPUT -o lo -j ACCEPT
+
+# On accepte le ping entrant et sortant
+-A INPUT  -p icmp --icmp-type echo-request -j ACCEPT
+-A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
+-A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
+-A INPUT  -p icmp --icmp-type echo-reply -j ACCEPT
+
+### http
+-A INPUT  -i wlan0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -o wlan0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
+
+### ssh
+-A INPUT  -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
+-A OUTPUT -o eth0 -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
+
+### bootp client (hostapd)
+-A INPUT  -i wlan0 -p udp --sport 68 -j ACCEPT
+-A OUTPUT -o wlan0 -p udp --dport 68 -j ACCEPT
+
+# Log des trames droppees
+-N LOGGING
+-A INPUT -i eth0 -j LOGGING
+-A OUTPUT -o eth0 -j LOGGING
+-A INPUT -i wlan0 -j LOGGING
+-A OUTPUT -o wlan0 -j LOGGING
+-A LOGGING -m limit --limit 20/min -j LOG --log-prefix "DROP:" --log-level 4
+-A LOGGING -j DROP
+
+COMMIT
+
+# vim: filetype=sh
@@ -0,0 +1,12 @@
+# Copyright (C) 2022 Vincent BENOIT <vincent.benoit@benserv.fr>
+# Release under the MIT license (see COPYING.MIT for the terms)
+FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
+
+SRC_URI += "file://iptables.rules"
+
+FILES:{PN} += "${sysconfdir}/iptables/iptables.rules"
+
+do_install:append() {
+	install -d ${D}${sysconfdir}/iptables/
+	install -m 0644 ${WORKDIR}/iptables.rules ${D}${sysconfdir}/iptables/
+}
@@ -65,3 +65,4 @@ net/ipv4/ip_forward=1
 # See https://www.kernel.org/doc/Documentation/sysctl/fs.txt
 #fs.protected_hardlinks = 1
 #fs.protected_symlinks = 1
+kernel.printk="2 4 1 7"