Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:firewall-iptables-icmp [2025/03/24 15:06] – créée - modification externe 127.0.0.1
+++ tech:firewall-iptables-icmp [2026/06/07 19:12] (Version actuelle) – modification externe 127.0.0.1
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>ICMP Réseau Sécurité iptables}}
+# Firewall iptables ICMP
+http://www.oregontechsupport.com/articles/icmp.txt
+Commande iptables de base
+Règles par défaut
+`/etc/sysctl.conf`
+~~~ini
+kernel.panic=3
+net.ipv4.conf.default.arp_ignore=1
+net.ipv4.conf.all.arp_ignore=1
+net.ipv4.ip_forward=1
+net.ipv4.icmp_echo_ignore_broadcasts=1
+net.ipv4.icmp_ignore_bogus_error_responses=1
+net.ipv4.tcp_ecn=0
+net.ipv4.tcp_fin_timeout=30
+net.ipv4.tcp_keepalive_time=120
+net.ipv4.tcp_syncookies=1
+net.ipv4.tcp_timestamps=0
+net.netfilter.nf_conntrack_checksum=0
+net.ipv4.netfilter.ip_conntrack_checksum=0
+net.ipv4.netfilter.ip_conntrack_max=16384
+net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=3600
+net.ipv4.netfilter.ip_conntrack_udp_timeout=60
+net.ipv4.netfilter.ip_conntrack_udp_timeout_stream=180
+# net.ipv6.conf.all.forwarding=1
+# disable bridge firewalling by default
+net.bridge.bridge-nf-call-arptables=0
+net.bridge.bridge-nf-call-ip6tables=0
+net.bridge.bridge-nf-call-iptables=0
+### JIBE
+# ??
+net.netfilter.nf_conntrack_acct=1
+# Enable IP spoofing protection, turn on Source Address Verification
+# Disable routing triangulation. Respond to queries out
+# the same interface, not another. Helps to maintain state
+# Also protects against IP spoofing
+net.ipv4.conf.all.rp_filter=1
+# Don't send ICMP redirect messages
+net.ipv4.conf.all.send_redirects=0
+# Don't accept ICMP redirect messages
+net.ipv4.conf.all.accept_redirects=0
+# How may times to retry before killing TCP connection, closed by our side.
+# Default value 7 corresponds to 50sec-16min depending on RTO.
+# If your machine is a loaded WEB server, you should think about lowering this value, such sockets may consume significant resources. Cf. tcp_max_orphans.
+net.ipv4.tcp_orphan_retries=0
+# A boolean flag controlling the behaviour under lots of incoming connections. When enabled, this causes the kernel to actively send RST packets when a service is overloaded.
+net.ipv4.tcp_abort_on_overflow=0
+# if true :  may give a way to route a packet through a firewall to an unreachable IP by specifying that IP in the route
+net.ipv4.conf.all.accept_source_route=0
+# If set, the TCP stack behaves conforming to RFC1337. If unset (the default), we are not conforming to RFC, but prevent TCP TIME-WAIT assassination.
+net.ipv4.tcp_rfc1337=0
+# Limit the maximal rates for sending ICMP packets whose type matches
+# icmp_ratemask (see below) to specific targets.
+# 0 to disable any limiting, otherwise the maximal rate in jiffies(1)
+net.ipv4.icmp_ratelimit=20
+# https://wiki.ubuntu.com/ImprovedNetworking/KernelSecuritySettings
+net.ipv4.icmp_ratemask = 88089
+# This allows reusing sockets in TIME_WAIT state for new connections when it is safe from protocol viewpoint. Default value is 0 (disabled). It is generally a safer alternative to tcp_tw_recycle
+# It should not be changed without advice/request of technical experts. (default =0)
+net.ipv4.tcp_tw_reuse=0
+# http://pic.dhe.ibm.com/infocenter/wasinfo/v6r1/topic/com.ibm.websphere.base.doc/info/aes/ae/tprf_tunelinux.html
+# This determines the number of probes before timing out. (default: 9, recommended 5)
+net.ipv4.tcp_keepalive_probes=5
+# This determines the wait time between isAlive interval probes (default: 75 seconds, recommended: 15-30 seconds)
+net.ipv4.tcp_keepalive_intvl=15
+# http://www.symantec.com/connect/articles/linux-firewall-related-proc-entries
+# Honor ICMP redirects only when they come from a router that is currently set up as a default gateway. Should only be enabled if you have multiple routers on your network. If your network is fairly static and stable, it's better to leave this disabled.
+net.ipv4.conf.all.secure_redirects=0
+# Reply to ARP requests if we have a route to the host in question. This may be necessary in some firewall or VPN/router setups, but is generally a bad idea on hosts.
+net.ipv4.conf.all.proxy_arp=0
+####
+net.ipv4.conf.default.rp_filter=1
+net.ipv4.conf.default.send_redirects=0
+net.ipv4.conf.default.accept_redirects=0
+net.ipv4.conf.default.accept_source_route=0
+net.ipv4.conf.default.secure_redirects=0
+net.ipv4.conf.default.proxy_arp=0
+net.ipv4.conf.lo.rp_filter=1
+net.ipv4.conf.lo.send_redirects=0
+net.ipv4.conf.lo.accept_redirects=0
+net.ipv4.conf.lo.accept_source_route=0
+net.ipv4.conf.lo.secure_redirects=0
+net.ipv4.conf.lo.proxy_arp=0
+net.ipv4.conf.eth0.rp_filter=1
+net.ipv4.conf.eth0.send_redirects=0
+net.ipv4.conf.eth0.accept_redirects=0
+net.ipv4.conf.eth0.accept_source_route=0
+net.ipv4.conf.eth0.secure_redirects=0
+net.ipv4.conf.eth0.proxy_arp=0
+net.ipv4.conf.eth0.0.rp_filter=1
+net.ipv4.conf.eth0.0.send_redirects=0
+net.ipv4.conf.eth0.0.accept_redirects=0
+net.ipv4.conf.eth0.0.accept_source_route=0
+net.ipv4.conf.eth0.0.secure_redirects=0
+net.ipv4.conf.eth0.0.proxy_arp=0
+net.ipv4.conf.eth0.1.rp_filter=1
+net.ipv4.conf.eth0.1.send_redirects=0
+net.ipv4.conf.eth0.1.accept_redirects=0
+net.ipv4.conf.eth0.1.accept_source_route=0
+net.ipv4.conf.eth0.1.secure_redirects=0
+net.ipv4.conf.eth0.1.proxy_arp=0
+net.ipv4.conf.wlan0.rp_filter=1
+net.ipv4.conf.wlan0.send_redirects=0
+net.ipv4.conf.wlan0.accept_redirects=0
+net.ipv4.conf.wlan0.accept_source_route=0
+net.ipv4.conf.wlan0.secure_redirects=0
+net.ipv4.conf.wlan0.proxy_arp=0
+net.ipv4.conf.mon.wlan0.rp_filter=1
+net.ipv4.conf.mon.wlan0.send_redirects=0
+net.ipv4.conf.mon.wlan0.accept_redirects=0
+net.ipv4.conf.mon.wlan0.accept_source_route=0
+net.ipv4.conf.mon.wlan0.secure_redirects=0
+net.ipv4.conf.mon.wlan0.proxy_arp=0
+####
+~~~