| Article original Publié le : 21 aout 2022 Mise à jour le : – |
Introduction
J’ai besoin de refaire un labs, (sous Proxmox puis ESXi), pour cela, j’ai repris un serveur chez Kimsufi
Je vais le garder 3 mois, le coût reste important sans être non plus onéreux au rapport au bruit / maintenance / électricité ..
KS-GAME-2 Intel Core i7-4790K 4c/8t 4GHz 32Go DDR3 1600MHz 240Go 100 Mbps 27,99 € HT (soit 33,59 € TTC)
Pré-requis
Je repars sur ce que j’ai déjà fait, j’en ai profité pour corriger quelques coquilles.
- Part 1/2 https://it.izero.fr/proxmox-cloud-serveur-proxmox-6-x-sur-un-serveur-kimsufi/
- Part 2/2 https://it.izero.fr/proxmox-cloud-serveur-proxmox-6-x-sur-un-serveur-kimsufi-avec-pfsense-et-openvpn/
Interface réseau
Kimsufi attribue une ip public, auquel on ajoute deux bridges
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 |
auto lo iface lo inet loopback iface enp1s0 inet manual iface enp2s0 inet manual auto vmbr0 iface vmbr0 inet static address IPPUB-KIMSUFI gateway IPGW-KIMSUFI bridge-ports enp1s0 bridge-stp off bridge-fd 0 hwaddress xx:xx:xx:xx:xx:xx auto vmbr1 iface vmbr1 inet static address 10.0.0.1 netmask 30 bridge-ports none bridge-stp off bridge-fd 0 auto vmbr2 iface vmbr2 inet static address 192.168.50.1 netmask 24 bridge-ports none bridge-stp off bridge-fd 0 post-up iptables-restore < /etc/iptables/rules.v4 |
Iptables
Les règles basiques pour l’accès ssh et webgui pour socle, les vms passeront elle par le pfSense
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
Chain INPUT (policy DROP) target prot opt source destination ACCEPT udp -- anywhere anywhere udp spts:bootps:bootpc dpts:bootps:bootpc ACCEPT all -- anywhere anywhere ACCEPT tcp -- MONIPPUB anywhere tcp dpt:2222 ACCEPT tcp -- MONIPPUB anywhere tcp dpt:8006 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:https ACCEPT tcp -- anywhere anywhere tcp dpts:5900:5999 /* vnc port */ ACCEPT tcp -- 10.0.0.2 anywhere tcp dpt:8006 LOG all -- anywhere anywhere limit: avg 2/min burst 5 LOG level warning prefix "iptables:" Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED Chain OUTPUT (policy DROP) target prot opt source destination ACCEPT udp -- anywhere anywhere udp spts:bootps:bootpc dpts:bootps:bootpc ACCEPT all -- anywhere anywhere ACCEPT tcp -- MONIPPUB anywhere tcp dpt:2222 ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp -- anywhere anywhere tcp dpt:domain ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:https ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere ACCEPT udp -- anywhere anywhere udp dpt:ntp ACCEPT tcp -- anywhere anywhere tcp dpts:5900:5999 |
Et la NAT
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
Chain PREROUTING (policy ACCEPT) num target prot opt source destination 1 ACCEPT tcp -- anywhere anywhere tcp dpt:8006 2 ACCEPT tcp -- anywhere anywhere tcp dpt:11710 3 DNAT all -- anywhere anywhere to:10.0.0.2 Chain INPUT (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination Chain POSTROUTING (policy ACCEPT) num target prot opt source destination 1 SNAT all -- 10.0.0.0/30 anywhere to:IPPUB-KIMSUFI |
Deux nouvelles règles sont apparues dans l’INPUT, je les détaille dans cet article
|
1 2 |
ACCEPT tcp -- 10.0.0.2 anywhere tcp dpt:8006 LOG all -- anywhere anywhere limit: avg 2/min burst 5 LOG level warning prefix "iptables:" |
Ip et route
|
1 |
$ ip a |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master vmbr0 state UP group default qlen 1000 link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff 3: enp2s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff 4: vmbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff inet IPPUB-KIMSUFI scope global vmbr0 valid_lft forever preferred_lft forever 5: vmbr1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 56:5c:4c:3e:e1:e9 brd ff:ff:ff:ff:ff:ff inet 10.0.0.1/30 scope global vmbr1 valid_lft forever preferred_lft forever 6: vmbr2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether f6:5a:04:27:8a:92 brd ff:ff:ff:ff:ff:ff inet 192.168.50.1/24 scope global vmbr2 valid_lft forever preferred_lft forever |
|
1 |
$ ip r |
|
1 2 3 4 |
default via IPGW-KIMSUFI dev vmbr0 proto kernel onlink 10.0.0.0/30 dev vmbr1 proto kernel scope link src 10.0.0.1 PLAGEIP-KIMSUFI/24 dev vmbr0 proto kernel scope link src IPPUB-KIMSUFI 192.168.50.0/24 via 10.0.0.2 dev vmbr1 |