Table des matières
- 2026:
- 2025:
4 billet(s) pour septembre 2026
| Notes HTTP Strict Transport Security - HSTS | 2026/09/18 11:04 | Jean-Baptiste |
| Notes GNU Linux GPU carte graphiques | 2026/09/08 15:49 | Jean-Baptiste |
| Notes GNU Linux graphique | 2026/09/08 15:42 | Jean-Baptiste |
| Notes urlencoding - passer des mots de passe en HTTPS | 2026/09/03 17:58 | Jean-Baptiste |
nftables un remplaçant à iptables
Voir :
A écouter : https://www.nolimitsecu.fr/nftables/
Une commande pour supprimer tous les paquets avec l'adresse IP de destination 1.2.3.4 :
apt-get install nft nftables systemctl enable nftables.service
cp /usr/share/doc/nftables/examples/workstation.nft /etc/nftables.conf
nft list ruleset
Migration iptables vers nftable
#/sbin/iptables-translate -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT nft add rule ip filter INPUT tcp dport 22 ct state new counter accept
# iptables -A OUTPUT -d 1.2.3.4 -j DROP nft add rule ip filter output ip daddr 1.2.3.4 drop
Ouvrir un port en sortie tout en logant
nft add rule output tcp dport 22 log accept
Ouvrir un port en entrée
#iptables -A INPUT -t superinput -p tcp --sport emule -j ACCEPT
nft add rule input tcp sport emule accept
Plusieurs IP en une seule règle
ip daddr { 192.168.0.0/24 => drop, 192.168.0.100 => accept}
NFS quel client est connecte à ce montage ?
cat /var/lib/nfs/rmtab
NFS - Exécuter NFSv3 derrière un pare-feu
Source : http://underpop.online.fr/l/linux/en/centos/s2-sysconfig-nfs.htm
NFS requires portmap/rcpbind, which dynamically assigns ports for RPC services. This causes problems for configuring firewall rules. To overcome this problem, use the /etc/sysconfig/nfs file to control which ports the required RPC services run on.
Deprecate /etc/sysconfig/nfs and only use /etc/nfs.conf to configure NFS daemons
The /etc/sysconfig/nfs may not exist by default on all systems. If it does not exist, create it and add the following variables (alternatively, if the file exists, un-comment and change the default entries as required):
MOUNTD_PORT=x \ control which TCP and UDP port mountd (rpc.mountd) uses. Replace x with an unused port number.
STATD_PORT=x \ control which TCP and UDP port status (rpc.statd) uses. Replace x with an unused port number.
LOCKD_TCPPORT=x \ control which TCP port nlockmgr (rpc.lockd) uses. Replace x with an unused port number.
LOCKD_UDPPORT=x \ control which UDP port nlockmgr (rpc.lockd) uses. Replace x with an unused port number.
If NFS fails to start, check /var/log/messages. Normally, NFS will fail to start if you specify a port number that is already in use. After editing /etc/sysconfig/nfs restart the NFS service by running the service nfs restart command. Run the rpcinfo -p command to confirm the changes.
To configure a firewall to allow NFS:
Allow TCP and UDP port 2049 for NFS.
Allow TCP and UDP port 111 (portmap/sunrpc).
Allow the TCP and UDP port specified with `MOUNTD_PORT=“x”`
Allow the TCP and UDP port specified with `STATD_PORT=“x”`
Allow the TCP port specified with `LOCKD_TCPPORT=“x”`
Allow the UDP port specified with `LOCKD_UDPPORT=“x”`
Network Namespaces - netns - /etc/hosts que pour une appli spécifique grâce aux espaces de noms
Voir :
- nsenter
Création de l'espace de nom
ip netns add NETNS1 mkdir -p /etc/netns/NETNS1/ cp -p /etc/hosts /etc/netns/NETNS1/ echo 127.0.0.2 srv-test1 >> /etc/netns/NETNS1/hosts ip netns exec NETNS1 getent hosts srv-test1
ça résout mais ça ne ping pas
# ip netns exec NETNS1 ping srv-test1 connect: Network is unreachable
Corrigeons ça
Configuration de localhost
ip link add veth1 type veth peer name vpeer1 ip netns exec NETNS1 ip link set lo up
# ip netns exec NETNS1 ping srv-test1 PING srv-test1 (127.0.0.2) 56(84) bytes of data. 64 bytes from srv-test1 (127.0.0.2): icmp_seq=1 ttl=64 time=0.072 ms
Configuration du routage
Pour les autres destinations
ip link set veth1 netns NETNS1 # Ne semble pas nécessaire #echo 1 > /proc/sys/net/ipv4/ip_forward ip netns exec NETNS1 ip addr add 172.16.1.1/31 dev veth1 ip link set vpeer1 up ip netns exec NETNS1 ip link set veth1 up ip netns exec NETNS1 ip route add default via 172.16.1.1
Bridge
ip link add br0 type bridge ip link set br0 up ip link set vpeer1 master br0 ip addr add 172.16.1.0 dev br0 ip route add 172.16.1.0/31 dev br0
Nettoyage
ip netns delete NETNS1 rm -rf /etc/netns/NETNS1/
Apache restriction par adresse IP
A mettre dans la conf du vhost
<Location /> Order deny,allow Deny from all Allow from 127.0.0.1 Allow from 192.168.1.0/24 </Location>