Pour faire un truc rapide et efficace pour partager un accès internet/réseau à tout une série de machine derrière une autre avec du NAT.
#!bin/sh # basic network filtering and natting # # # Wild | blueboite ( Wi-Fi ) ath0 | boiteblanche | eth0 --- lan # MODULES="ip_tables \ ipt_string \ ip_conntrack \ ip_conntrack_ftp \ ip_nat_ftp" # CHANGE THIS : external interface (wan) EXT_IF="ath0" # CHANGE THIS : external interface (wan) INTERNET_NAT="ath0" # CHANGE THIS : internal interface (lan) INT_IF="eth0" # CHANGE THIS : lan pool INT_NET="192.168.42.0/24" # CHANGE THIS : wan pool EXT_NET="192.168.1.0/24" IPTABLES=`which iptables` MODPROBE=`which modprobe` RED="\033[31m" GREEN="\033[32m" YELLOW="\033[33m" NORMAL="\033[m" BOLD="\033[1m" # erasing oldies echo -en "${BOLD}${YELLOW}Erasing old rules :${NORMAL}" ${IPTABLES} -t filter -F INPUT ${IPTABLES} -t filter -F OUTPUT ${IPTABLES} -t filter -F FORWARD ${IPTABLES} -t nat -F PREROUTING ${IPTABLES} -t nat -F OUTPUT ${IPTABLES} -t nat -F POSTROUTING ${IPTABLES} -t mangle -F PREROUTING ${IPTABLES} -t mangle -F OUTPUT echo -e "\t\t\t\t${GREEN}OK${NORMAL}" # back to zeros echo -en "${BOLD}${YELLOW}Reseting to zero :${NORMAL}" ${IPTABLES} -t filter -Z ${IPTABLES} -t nat -Z ${IPTABLES} -t mangle -Z echo -e "\t\t\t\t${GREEN}OK${NORMAL}" # default policy : tous au karcher ! echo -en "${BOLD}${YELLOW}Default policy setup :${NORMAL}" ${IPTABLES} -t filter -P INPUT DROP ${IPTABLES} -t filter -P OUTPUT ACCEPT ${IPTABLES} -t filter -P FORWARD DROP echo -e "\t\t\t\t${GREEN}OK${NORMAL}\n" # filtering echo -en "${BOLD}${YELLOW}Setting up the filters :${NORMAL}" ${IPTABLES} -A INPUT -i lo -j ACCEPT ${IPTABLES} -A INPUT -i ${EXT_IF} -s ${INT_NET} -j DROP ${IPTABLES} -A INPUT -i ${INT_IF} -j ACCEPT # network specific ${IPTABLES} -A INPUT -i ${INT_IF} -d ${EXT_NET} -j ACCEPT ${IPTABLES} -A INPUT -i ${INT_IF} -d ${INT_NET} -p udp -j ACCEPT ${IPTABLES} -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT echo -e "\t\t\t${GREEN}OK${NORMAL}" # nat echo -en "${BOLD}${YELLOW}Setting up NAT :${NORMAL}" ${IPTABLES} -t nat -A POSTROUTING -s ${INT_NET} -o ${EXT_IF} -j MASQUERADE ${IPTABLES} -A FORWARD -i ${INT_IF} -o ${EXT_IF} -s ${INT_NET} -j ACCEPT ${IPTABLES} -A FORWARD -i ${EXT_IF} -o ${INT_IF} -m state --state RELATED,ESTABLISHED -j ACCEPT echo -e "\t\t\t\t${GREEN}OK${NORMAL}" # letting things out echo -en "${BOLD}${YELLOW}Letting things out :${NORMAL}" ${IPTABLES} -A OUTPUT -s ${INT_NET} -o ${EXT_IF} -j ACCEPT ${IPTABLES} -A OUTPUT -o ${EXT_IF} -j ACCEPT ${IPTABLES} -A OUTPUT -o ${INT_IF} -p udp -j ACCEPT echo -e "\t\t\t\t${GREEN}OK${NORMAL}" # end, dropping what's left ${IPTABLES} -A INPUT -j DROP
et voila.
Merci à Seb pour le debuggage et l'aide pour faire marcher tout ça.