Bonjour à tous,

Je vous explik ma situation : J'ai une passerelle avec Mandrake 9.2 connecté à internet par linterface ppp0 et connecté au reseau locale en eth0 (ip : 192.168.1.10).
J'ai un serveur ftp sur un poste Windows 2000 de mon reseau (ip : 192.168.1.17).
Je voudrais donc que celui ci soit accessible depuis l'éxterieur !
J'ai donc récuperer un script Iptable qui a priori est pas mal du tout mais en ce qui concerne mon serveur ftp, ca ne marche pas.
En pensant que c'était peut etre le script j'ai essayer d'autre manip que j'ai trouvé sur le net mais aucune fonctionne !
Le niveau de sécurité de ma mandrake est au niveau "Normal" et DrakeFirewall est désactivé !! Peut etre que mon script est correct mais qu'il y a peut etre une otre couche de securité ???

Sinon voici mon script :

#!/bin/sh

#path to iptables
IPT="/sbin/iptables"

#interface connected to the internet
EXTERNAL_IF="ppp0"

#interface connected to the LAN
INTERNAL_IF="eth0"

#Address of your network
INTERNAL_NETWORK="192.168.1.0/24"

#Services that are available on the firewall
FIREWALL_SERVICES_TCP="ftp ftp-data ssh 21"
FIREWALL_SERVICES_UDP="domain"

#Services which are routed by the firewall
ROUTED_SERVICES_TCP="ftp ftp-data ssh https domain"
ROUTED_SERVICES_UDP="domain"

#Services which are available on LAN only
SERVICES_ON_LAN_TCP="domain netbios-ssn netbios-ns netbios-dgm"
SERVICES_ON_LAN_UDP="domain netbios-ssn netbios-ns netbios-dgm"

#Accepted ICMP types
ICMP="echo-reply destination-unreachable echo-request time-exceeded source-quench"

#ports that will be forwarded
FORWARDED_PORTS="4662:192.168.1.17:4662 20:192.168.1.17:20 21:192.168.1.17:21"

#If something try to connect more than this number, the connections will be logged
MAX_CONNECT_PER_SECOND=1

function start(){
modprobe ip_conntrack_irc
modprobe ip_conntrack_ftp

echo "1" > /proc/sys/net/ipv4/ip_forward

echo -n "Drop ALL rulez ..."
$IPT -P INPUT DROP
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
echo "done"

#accept traffic for lo
echo -n "Accept Traffic on lo ... "
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
echo "done"

#accept traffic for LAN
$IPT -A FORWARD -i $INTERNAL_IF -o $EXTERNAL_IF -j ACCEPT
$IPT -A FORWARD -i $EXTERNAL_IF -o $INTERNAL_IF -j ACCEPT
echo "done"

#masquerading
echo -n "Masquerading network $INTERNAL_NETWORK ..."
$IPT -t nat -A POSTROUTING -s $INTERNAL_NETWORK -o $EXTERNAL_IF -j MASQUERADE
echo "done"

for v in $FIREWALL_SERVICES_TCP; do
echo -n "Accepting port $v for server usage (tcp) ... "
$IPT -A INPUT -i $INTERNAL_IF -p tcp --dport $v -j ACCEPT
$IPT -A OUTPUT -o $INTERNAL_IF -p tcp --sport $v -j ACCEPT
$IPT -A INPUT -i $EXTERNAL_IF -p tcp --dport $v -j ACCEPT
$IPT -A OUTPUT -o $EXTERNAL_IF -p tcp --sport $v -j ACCEPT
echo "done"
done

for v in $FIREWALL_SERVICES_UDP; do
echo -n "Accepting port $v for server usage (udp) ... "
$IPT -A INPUT -i $INTERNAL_IF -p udp --dport $v -j ACCEPT
$IPT -A OUTPUT -o $INTERNAL_IF -p udp --sport $v -j ACCEPT
$IPT -A INPUT -i $EXTERNAL_IF -p udp --dport $v -j ACCEPT
$IPT -A OUTPUT -o $EXTERNAL_IF -p udp --sport $v -j ACCEPT
echo "done"
done

for v in $ROUTED_SERVICES_TCP; do
echo -n "Routing port $v (tcp) ... "
$IPT -A INPUT -i $INTERNAL_IF -p tcp --dport $v -j ACCEPT
$IPT -A OUTPUT -o $INTERNAL_IF -p tcp --sport $v -j ACCEPT
$IPT -A INPUT -i $EXTERNAL_IF -p tcp --sport $v -j ACCEPT
$IPT -A OUTPUT -o $EXTERNAL_IF -p tcp --dport $v -j ACCEPT
echo "done"
done

for v in $ROUTED_SERVICES_UDP; do
echo -n "Accepting port $v (udp) ... "
$IPT -A INPUT -i $INTERNAL_IF -p udp --dport $v -j ACCEPT
$IPT -A OUTPUT -o $INTERNAL_IF -p udp --sport $v -j ACCEPT
$IPT -A INPUT -i $EXTERNAL_IF -p udp --sport $v -j ACCEPT
$IPT -A OUTPUT -o $EXTERNAL_IF -p udp --dport $v -j ACCEPT
echo "done"
done

for v in $SERVICES_ON_LAN_TCP; do
echo -n "Accepting port $v for LAN only (tcp) ..."
$IPT -A INPUT -i $INTERNAL_IF -p tcp --dport $v -j ACCEPT
$IPT -A OUTPUT -o $INTERNAL_IF -p tcp --sport $v -j ACCEPT
echo "done"
done

for v in $SERVICES_ON_LAN_UDP; do
echo -n "Accepting port $v for LAN only (udp) ..."
$IPT -A INPUT -i $INTERNAL_IF -p udp --dport $v -j ACCEPT
$IPT -A OUTPUT -o $INTERNAL_IF -p udp --sport $v -j ACCEPT
echo "done"
done

for v in $ICMP; do
echo -n "Accepting ICMP type $v (icmp) ... "
$IPT -A INPUT -i $INTERNAL_IF -p icmp --icmp-type $v -j ACCEPT
$IPT -A OUTPUT -o $INTERNAL_IF -p icmp --icmp-type $v -j ACCEPT
$IPT -A INPUT -i $EXTERNAL_IF -p icmp --icmp-type $v -j ACCEPT
$IPT -A OUTPUT -o $EXTERNAL_IF -p icmp --icmp-type $v -j ACCEPT
echo "done"
done

for v in $FORWARDED_PORTS; do
SOURCE_PORT=`echo $v | awk -F ":" '{ print $1}'`
IP_DEST=`echo $v | awk -F ":" '{ print $2}'`
DEST_PORT=`echo $v | awk -F ":" '{ print $1}'`

echo -n "Forward port $SOURCE_PORT to $IP_DEST whith port $DEST_PORT ... "
$IPT -t nat -A PREROUTING -i $EXTERNAL_IF -p tcp --dport ${SOURCE_PORT}:${DEST_PORT} -j DNAT --to $IP_DEST
$IPT -t nat -A PREROUTING -i $EXTERNAL_IF -p udp --dport ${SOURCE_PORT}:${DEST_PORT} -j DNAT --to $IP_DEST


$IPT -A INPUT -i $INTERNAL_IF -p tcp --sport $DEST_PORT -j ACCEPT
$IPT -A OUTPUT -o $INTERNAL_IF -p tcp --dport $DEST_PORT -j ACCEPT
$IPT -A INPUT -i $INTERNAL_IF -p tcp --sport $DEST_PORT -j ACCEPT
$IPT -A OUTPUT -o $INTERNAL_IF -p tcp --dport $DEST_PORT -j ACCEPT

$IPT -A INPUT -i $EXTERNAL_IF -p tcp --dport $SOURCE_PORT -j ACCEPT
$IPT -A OUTPUT -o $EXTERNAL_IF -p tcp --sport $SOURCE_PORT -j ACCEPT
$IPT -A INPUT -i $EXTERNAL_IF -p tcp --dport $SOURCE_PORT -j ACCEPT
$IPT -A OUTPUT -o $EXTERNAL_IF -p tcp --sport $SOURCE_PORT -j ACCEPT
echo "done"
done


echo -n "accept clients connections ..."
$IPT -A INPUT -p tcp --dport 1025: -j ACCEPT
echo "done ..."

echo -n "Matching state for connections ... "
$IPT -A INPUT -i $EXTERNAL_IF -p tcp -m state --state ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -o $EXTERNAL_IF -p udp -m state --state NEW,ESTABLISHED -j ACCEPT
echo "done"

echo -n "Start Logging ... "
$IPT -A INPUT -m limit --limit ${MAX_CONNECT_PER_SECOND}/second -j LOG
$IPT -N LOGGING
$IPT -A LOGGING -j LOG --log-prefix 'Firewall DROP : '
$IPT -A INPUT -i $EXTERNAL_IF -j LOGGING
echo "done"
}



function stop(){
echo -n "Stopping firewall (flush rules) ... "
$IPT -F
$IPT -X
$IPT -X LOGGING

$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
echo "done"
}

Si qqun peut maider ce serait vraiment tres sympa car la je galere !!

Merci d'avance