Cours 19 : Corrections Détaillées des Exercices

Introduction

Ce chapitre fournit les corrigés complets des 40 exercices du chapitre 17. Chaque correction est structurée avec la solution technique, les commandes, les schémas, et les explications détaillées. Suivez les corrections pas à pas dans votre environnement de lab.

---

Exercice 1 : Calculs CIDR de Base

Solution

Bloc : 192.168.10.0/24 (masque 255.255.255.0) Division en 4 sous-réseaux : 2 bits de sous-réseau (2^2 = 4) Nouveau masque : /26 (255.255.255.192)

Méthode

/24 = 256 adresses
/26 = 64 adresses par sous-réseau
64 - 2 (réseau + broadcast) = 62 adresses utilisables

Vérification

# Calcul avec ipcalc
ipcalc 192.168.10.0/24 -s 4

---

Exercice 2 : VLSM (Variable Length Subnet Mask)

Solution

Ordre d'allocation (du plus grand au plus petit besoin) :

1. Service IT : 50 hôtes -> besoin de 6 bits hôte (2^6 = 64, -2 = 62 >= 50) -> /26

   • 10.0.0.0/26 (10.0.0.1 - 10.0.0.62)

2. Service RH : 20 hôtes -> besoin de 5 bits hôte (2^5 = 32, -2 = 30 >= 20) -> /27

   • 10.0.0.64/27 (10.0.0.65 - 10.0.0.94)

3. Service Compta : 10 hôtes -> besoin de 4 bits hôte (2^4 = 16, -2 = 14 >= 10) -> /28

   • 10.0.0.96/28 (10.0.0.97 - 10.0.0.110)

4. Liaison inter-sites : 2 adresses -> besoin de 2 bits hôte (2^2 = 4, -2 = 2) -> /30

   • 10.0.0.112/30 (10.0.0.113 - 10.0.0.114)

Tableau Récapitulatif

---

Exercice 3 : Supernetting et Agrégation de Routes

Solution

Réseaux à agréger :

• 172.16.0.0/24 = 10101100.00010000.00000000.00000000
• 172.16.1.0/24 = 10101100.00010000.00000001.00000000
• 172.16.2.0/24 = 10101100.00010000.00000010.00000000
• 172.16.3.0/24 = 10101100.00010000.00000011.00000000

Bits communs : 172.16.0 (22 premiers bits) Préfixe agrégé : 172.16.0.0/22

Vérification : 172.16.0.0/22 couvre 172.16.0.0 à 172.16.3.255 Aucun réseau extérieur inclus.

Configuration Routeur

ip route 172.16.0.0 255.255.252.0 Null0
# Annonce vers BGP
router bgp 65000
 network 172.16.0.0 mask 255.255.252.0

---

Exercice 4 : Subnetting IPv6

Solution

Préfixe : 2001:db8:abcd::/48 16 sous-réseaux : besoin de 4 bits -> /52

Différence avec IPv4

• IPv6 : pas de broadcast, pas de NAT nécessaire
• 2^64 hôtes par /64 (pas de calcul de masque complexe)
• Notation hexadécimale
• Sous-réseau standard /64 pour SLAAC

---

Exercice 5 : Plan d'Adressage pour Topologie Hiérarchique

Solution

Hiérarchie : 10.[Site].[VLAN].[Hôte]

Sites :

• Siège : 10.1.0.0/16
• Datacenter : 10.2.0.0/16
• Agence : 10.3.0.0/16

VLANs par site (10.X.0.0/16) :

• Administration : 10.X.10.0/24
• Production : 10.X.20.0/24
• DMZ : 10.X.30.0/24
• VoIP : 10.X.40.0/24
• Management : 10.X.255.0/24

Interconnexions WAN :

• Siège-DC : 10.0.1.0/30
• Siège-Agence : 10.0.2.0/30

Tableau Complet (site Siège)

---

Exercice 6 : Tables de Routage

Solution

Découpage 172.20.0.0/16 en 8 sous-réseaux (A-H) : /19 Chaque /19 contient 4 sous-sous-réseaux : /21

Table de routage du routeur central :

172.20.0.0/19 via 10.0.A.1    # Agrégation vers A
172.20.32.0/19 via 10.0.B.1   # Agrégation vers B
...

---

Exercice 7 : Configuration OSPF Mono-Zone

Configuration R1

interface GigabitEthernet0/0
 ip address 10.0.12.1 255.255.255.252
!
interface GigabitEthernet0/1
 ip address 10.0.31.1 255.255.255.252
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
!
router ospf 1
 router-id 1.1.1.1
 network 10.0.12.0 0.0.0.3 area 0
 network 10.0.31.0 0.0.0.3 area 0
 network 1.1.1.1 0.0.0.0 area 0

Configuration R2

router ospf 1
 router-id 2.2.2.2
 network 10.0.12.0 0.0.0.3 area 0
 network 10.0.23.0 0.0.0.3 area 0
 network 2.2.2.2 0.0.0.0 area 0

Configuration R3

router ospf 1
 router-id 3.3.3.3
 network 10.0.23.0 0.0.0.3 area 0
 network 10.0.31.0 0.0.0.3 area 0
 network 3.3.3.3 0.0.0.0 area 0

Vérification

R1# show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
2.2.2.2           1   FULL/BDR        00:00:38    10.0.12.2       Gi0/0
3.3.3.3           1   FULL/DR         00:00:35    10.0.31.2       Gi0/1

R1# show ip route ospf
O    2.2.2.2 [110/11] via 10.0.12.2, 00:05:23, GigabitEthernet0/0
O    3.3.3.3 [110/11] via 10.0.31.2, 00:05:23, GigabitEthernet0/1
O    10.0.23.0/30 [110/20] via 10.0.12.2, 00:05:23, GigabitEthernet0/0

---

Exercice 8 : OSPF Multi-Zones

Topologie

       Area 0 (Backbone)
    R1 --- R2
    |      |
Area 2   Area 1
(NSSA)   (Stub)
    |
    R4

Configuration R2 (ABR Area 0 - Area 1 Stub)

router ospf 1
 router-id 2.2.2.2
 network 10.0.12.0 0.0.0.3 area 0
 network 10.0.23.0 0.0.0.3 area 1
 area 1 stub

Configuration R3 (Area 1 Stub)

router ospf 1
 router-id 3.3.3.3
 network 10.0.23.0 0.0.0.3 area 1
 area 1 stub

Configuration R1 (ABR Area 0 - Area 2 NSSA)

router ospf 1
 router-id 1.1.1.1
 network 10.0.12.0 0.0.0.3 area 0
 network 10.0.14.0 0.0.0.3 area 2
 area 2 nssa
! Redistribution d'une route statique dans NSSA
ip route 192.168.100.0 255.255.255.0 Null0
router ospf 1
 redistribute static subnets

Configuration R4 (Area 2 NSSA)

router ospf 1
 router-id 4.4.4.4
 network 10.0.14.0 0.0.0.3 area 2
 network 4.4.4.4 0.0.0.0 area 2
 area 2 nssa

Vérification LSDB

R1# show ip ospf database

       OSPF Router with ID (1.1.1.1)

                Router Link States (Area 0)

Link ID         ADV Router      Age         Seq#       CkSum
1.1.1.1         1.1.1.1         120         0x80000003 0x00A5
2.2.2.2         2.2.2.2         110         0x80000002 0x00B3

                Type-7 AS External Link States (Area 2)

Link ID         ADV Router      Age         Seq#       CkSum
192.168.100.0   1.1.1.1         90          0x80000001 0x00C7

---

Exercice 9 : OSPF Authentication et Optimisation

Configuration R1

! Authentication MD5 (même clé sur tous les routeurs)
interface GigabitEthernet0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 MonMotDePasseOSPF
!
! Timers rapides
interface GigabitEthernet0/0
 ip ospf hello-interval 5
 ip ospf dead-interval 15
!
! Passive interface (loopback)
router ospf 1
 passive-interface Loopback0
!
! Ajustement de cost
interface GigabitEthernet0/0
 ip ospf cost 10

Vérification

R1# show ip ospf interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet Address 10.0.12.1/30, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 10
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 1.1.1.1, Interface address 10.0.12.1
  Backup Designated router (ID) 2.2.2.2, Interface address 10.0.12.2
  Timer intervals configured, Hello 5, Dead 15, Wait 15, Retransmit 5
    Hello due in 00:00:03
  Index 1/1, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 2
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 2.2.2.2 (Backup Designated Router)
  Message digest authentication enabled
    Youngest key id is 1

---

Exercice 10 : Configuration BGP eBGP

Configuration R1 (AS 64501)

interface Loopback0
 ip address 1.1.1.1 255.255.255.255
!
interface GigabitEthernet0/0
 ip address 192.0.2.1 255.255.255.252
!
router bgp 64501
 bgp router-id 1.1.1.1
 neighbor 192.0.2.2 remote-as 64502
 neighbor 192.0.2.2 update-source Loopback0
 ! Alternative si on utilise loopback :
 ! neighbor 192.0.2.2 ebgp-multihop 2
 network 203.0.113.0 mask 255.255.255.0

Configuration R2 (AS 64502)

interface Loopback0
 ip address 2.2.2.2 255.255.255.255
!
interface GigabitEthernet0/0
 ip address 192.0.2.2 255.255.255.252
!
router bgp 64502
 bgp router-id 2.2.2.2
 neighbor 192.0.2.1 remote-as 64501
 neighbor 192.0.2.1 update-source Loopback0
 network 198.51.100.0 mask 255.255.255.0

Vérification

R1# show ip bgp summary
BGP router identifier 1.1.1.1, local AS number 64501
BGP table version is 2, main routing table version 2
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.0.2.2       4        64502      23      21        2    0    0 00:12:34        1

R1# show ip bgp
BGP table version is 2, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path,
              f RT-Filter, x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop            Metric LocPrf Weight Path
*> 198.51.100.0/24   192.0.2.2               0             0 64502 i
*> 203.0.113.0/24    0.0.0.0                 0         32768 i

---

Exercice 11 : BGP iBGP et Route Reflector

Configuration R1 (Route Reflector)

router bgp 65000
 bgp router-id 1.1.1.1
 neighbor 10.0.12.2 remote-as 65000
 neighbor 10.0.12.2 update-source Loopback0
 neighbor 10.0.13.3 remote-as 65000
 neighbor 10.0.13.3 update-source Loopback0
 neighbor 10.0.14.4 remote-as 65000
 neighbor 10.0.14.4 update-source Loopback0
 ! Route Reflector configuration
 address-family ipv4
  neighbor 10.0.12.2 route-reflector-client
  neighbor 10.0.13.3 route-reflector-client
  neighbor 10.0.14.4 route-reflector-client
 exit-address-family

Configuration R2 (Client)

router bgp 65000
 bgp router-id 2.2.2.2
 neighbor 10.0.12.1 remote-as 65000
 neighbor 10.0.12.1 update-source Loopback0

Vérification

R2# show ip bgp
BGP table version is 5, local router ID is 2.2.2.2
   Network          Next Hop            Metric LocPrf Weight Path
*>i203.0.113.0/24   1.1.1.1                 0    100      0 i
*>i198.51.100.0/24  3.3.3.3                 0    100      0 i  (reçue via RR)

---

Exercice 12 : BGP Communities et Path Manipulation

Configuration R1

! Définition des communautés
ip bgp-community new-format
!
! Route-map pour marquer les routes
route-map SET-COMMUNITY permit 10
 match ip address prefix-list CLIENTS
 set community 65001:100 65001:200
!
! Route-map pour modifier LOCAL_PREF basé sur community
route-map SET-LOCAL-PREF permit 10
 match community 100
 set local-preference 200
!
route-map SET-LOCAL-PREF permit 20
 match community 200
 set local-preference 100
!
! Route-map pour AS-PATH prepend
route-map PREPEND permit 10
 set as-path prepend 65001 65001
!
! Application
router bgp 65001
 neighbor 192.0.2.2 route-map SET-COMMUNITY out
 neighbor 192.0.2.2 route-map SET-LOCAL-PREF in
!
! Community lists
ip community-list standard 100 permit 65001:100
ip community-list standard 200 permit 65001:200

Vérification

R1# show ip bgp 203.0.113.0
BGP routing table entry for 203.0.113.0/24, version 2
Paths: (1 available, best #1)
  Not advertised to any peer
  Local
    0.0.0.0 from 0.0.0.0 (1.1.1.1)
      Origin IGP, metric 0, localpref 100, weight 32768, valid, sourced, best
      Community: 65001:100 65001:200

---

Exercice 13 : Redistribution OSPF-BGP et Filtrage

Configuration R1

! Prefix-list pour filtrer les routes privées
ip prefix-list BLOCK-PRIVATE seq 5 deny 10.0.0.0/8 le 32
ip prefix-list BLOCK-PRIVATE seq 10 deny 172.16.0.0/12 le 32
ip prefix-list BLOCK-PRIVATE seq 15 deny 192.168.0.0/16 le 32
ip prefix-list BLOCK-PRIVATE seq 20 permit 0.0.0.0/0 le 32
!
! Route-map pour redistribution OSPF -> BGP
route-map OSPF-TO-BGP permit 10
 match ip address prefix-list BLOCK-PRIVATE
!
! Route-map pour redistribution BGP -> OSPF (route par défaut seulement)
route-map BGP-TO-OSPF permit 10
 match ip address prefix-list DEFAULT-ONLY
!
ip prefix-list DEFAULT-ONLY seq 5 permit 0.0.0.0/0
!
router bgp 65000
 redistribute ospf 1 route-map OSPF-TO-BGP
!
router ospf 1
 redistribute bgp 65000 subnets route-map BGP-TO-OSPF
 default-information originate always

Vérification

R1# show ip route bgp | begin BGP
B*    0.0.0.0/0 [20/0] via 192.0.2.2, 00:10:23
B     203.0.113.0/24 [20/0] via 192.0.2.2, 00:10:23

---

Exercice 14 : Configuration VLANs 802.1Q

Configuration SW1

vlan 10
 name Clients
vlan 20
 name Serveurs
vlan 30
 name DMZ
!
interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
!
interface GigabitEthernet0/2
 switchport mode access
 switchport access vlan 20
!
interface GigabitEthernet0/3
 switchport mode access
 switchport access vlan 30
!
interface GigabitEthernet0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30

Configuration Routeur (Router-on-a-Stick)

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
!
interface GigabitEthernet0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
!
interface GigabitEthernet0/0
 no shutdown

Vérification

SW1# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/0
10   Clients                          active    Gi0/1
20   Serveurs                         active    Gi0/2
30   DMZ                              active    Gi0/3

Routeur# ping 192.168.20.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.20.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5)

---

Exercice 15 : STP et RSTP

Configuration SW1 (Root Bridge)

spanning-tree mode rapid-pvst
spanning-tree vlan 1-100 priority 4096
!
interface GigabitEthernet0/1
 spanning-tree portfast
!
interface GigabitEthernet0/2
 spanning-tree link-type point-to-point

Vérification

SW1# show spanning-tree vlan 1

VLAN0001
  Spanning tree enabled protocol rstp
  Root ID    Priority    4097
             Address     0011.2233.4451
             Cost        0
             Port        1 (GigabitEthernet0/1)

  Bridge ID  Priority    4097  (priority 4096 sys-id-ext 1)
             Address     0011.2233.4451
             Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- -------------------------------
Gi0/1               Desg FWD 4         128.1    P2p Edge
Gi0/2               Root FWD 4         128.2    P2p

Test de Convergence

! Avant la coupure : temps de convergence RSTP < 2s
! Après coupure :
SW2# show spanning-tree vlan 1
Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- -------------------------------
Gi0/1               Altn BLK 4         128.1    P2p   (anciennement Root)
Gi0/2               Root FWD 4         128.2    P2p   (nouveau chemin)

---

Exercice 16 : VXLAN avec Configuration Manuelle

Configuration Host1 (VTEP1)

# Configuration underlay
ip addr add 192.168.10.1/24 dev eth0
ip link set eth0 up
ip link add vxlan100 type vxlan id 100 \
  local 192.168.10.1 \
  remote 192.168.10.2 \
  dstport 4789 \
  dev eth0
ip link set vxlan100 up
ip addr add 10.0.1.1/24 dev vxlan100

Configuration Host2 (VTEP2)

ip addr add 192.168.10.2/24 dev eth0
ip link set eth0 up
ip link add vxlan100 type vxlan id 100 \
  local 192.168.10.2 \
  remote 192.168.10.1 \
  dstport 4789 \
  dev eth0
ip link set vxlan100 up
ip addr add 10.0.1.2/24 dev vxlan100

Vérification avec tcpdump

# Sur Host1, dans un terminal :
tcpdump -i eth0 udp port 4789 -X
# Dans un autre :
ping 10.0.1.2
# tcpdump montre les paquets VXLAN encapsulés :
# 12:34:56.789012 IP 192.168.10.1.34567 > 192.168.10.2.4789: VXLAN, flags [I], vni 100

---

Exercice 17 : EVPN-VXLAN avec FRRouting

Configuration VTEP1 (FRR)

!
interface lo
 ip address 1.1.1.1/32
!
interface eth0
 ip address 192.168.10.1/24
!
interface vxlan100
 vxlan id 100
 vxlan local-tunnelip 1.1.1.1
!
router bgp 65000
 bgp router-id 1.1.1.1
 neighbor 192.168.10.2 remote-as 65000
 neighbor 192.168.10.2 update-source lo
 !
 address-family l2vpn evpn
  neighbor 192.168.10.2 activate
  advertise-all-vni
 exit-address-family

Vérification EVPN

vtep1# show bgp l2vpn evpn route
BGP table version is 3, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network                                   Next Hop         Metric LocPrf Weight Path
Route Distinguisher: 1.1.1.1:100
*> [2]:[0]:[48]:[aa:bb:cc:dd:ee:01]         1.1.1.1                              32768 i
*> [2]:[0]:[48]:[aa:bb:cc:dd:ee:02]         1.1.1.1                              32768 i
*> [3]:[0]:[32]:[1.1.1.1]                   1.1.1.1                              32768 i

---

Exercice 18 : MLAG et Multihoming EVPN

Configuration Leaf1 (MLAG + EVPN)

!
interface port-channel1
 mlag 1
!
interface ethernet1
 channel-group 1 mode active
!
interface ethernet2
 channel-group 1 mode active
!
mlag configuration
 domain-id MLAG1
 peer-address 10.0.255.1
 peer-link port-channel100
!
router bgp 65000
 address-family l2vpn evpn
  neighbor 10.0.255.2 activate
!
interface vxlan100
 vxlan local-tunnelip 10.0.0.1
 vxlan evpn mlag
!
evpn
  mlag
   esi 00:00:00:00:00:00:00:01:00:01

---

Exercice 19 : Installation BIND9

named.conf

# Installation
apt update && apt install -y bind9 bind9utils bind9-doc

/etc/bind/named.conf.local

zone "example.lab" {
    type master;
    file "/etc/bind/db.example.lab";
    allow-transfer { 10.0.0.54; };
};

zone "0.0.10.in-addr.arpa" {
    type master;
    file "/etc/bind/db.10.0.0";
};

/etc/bind/db.example.lab

$TTL    604800
@       IN      SOA     ns1.example.lab. admin.example.lab. (
                  2024070101         ; Serial
                  604800              ; Refresh
                   86400              ; Retry
                 2419200              ; Expire
                  604800 )            ; Negative Cache TTL
;
@       IN      NS      ns1.example.lab.
@       IN      A       10.0.0.53
ns1     IN      A       10.0.0.53
www     IN      A       10.0.0.10
mail    IN      A       10.0.0.20
@       IN      MX 10   mail.example.lab.
api     IN      CNAME   www.example.lab.
@       IN      TXT     "v=spf1 mx ~all"

Test

dig @10.0.0.53 www.example.lab
nslookup www.example.lab 10.0.0.53

---

Exercice 20 : DNSSEC

Génération des clés

cd /etc/bind
dnssec-keygen -a ECDSAP256SHA256 -b 256 -f KSK -n ZONE example.lab
dnssec-keygen -a ECDSAP256SHA256 -b 128 -n ZONE example.lab

Signature de la zone

dnssec-signzone -A -3 $(head -c 1000 /dev/random | sha1sum | cut -b 1-16) \
  -N INCREMENT -o example.lab -t db.example.lab

Vérification

dig @10.0.0.53 example.lab DNSKEY
dig @10.0.0.53 example.lab SOA +dnssec
dig @10.0.0.53 www.example.lab +dnssec +multi

---

Exercice 21 : Unbound

/etc/unbound/unbound.conf

server:
    interface: 10.0.0.53
    port: 53
    access-control: 10.0.0.0/24 allow
    access-control: 127.0.0.0/8 allow
    access-control: 0.0.0.0/0 refuse
    
    # Validation DNSSEC
    auto-trust-anchor-file: "/var/lib/unbound/root.key"
    val-log-level: 2
    
    # Cache
    cache-min-ttl: 300
    cache-max-ttl: 86400
    
    # Rate limiting
    ratelimit: 1000
    ratelimit-slabs: 4
    ratelimit-size: 4m
    
forward-zone:
    name: "."
    forward-addr: 1.1.1.1@853#cloudflare-dns.com
    forward-addr: 8.8.8.8@853#dns.google
    forward-tls-upstream: yes

Vérification

unbound-control stats
unbound-checkconf /etc/unbound/unbound.conf
dig @10.0.0.53 example.lab

---

Exercice 22 : iptables de Base

Script de configuration

#!/bin/bash
# Politique DROP par défaut
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Autoriser loopback
iptables -A INPUT -i lo -j ACCEPT

# Autoriser connexions établies
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# SSH depuis réseau local
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

# HTTP/HTTPS (depuis partout)
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Bloquer les pings entrants
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

# Logger les rejets
iptables -A INPUT -j LOG --log-prefix "IPTABLES-DROP: " --log-level 4

# Sauvegarde
iptables-save > /etc/iptables/rules.v4

Vérification

iptables -L -v -n --line-numbers
iptables-save | grep -v "^#"

---

Exercice 23 : NAT et Port Forwarding

Configuration

#!/bin/bash
# Activer IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# NAT (Masquerade)
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Port forwarding 8080 -> 192.168.1.10:80
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 \
  -j DNAT --to-destination 192.168.1.10:80
  
# Port forwarding 2222 -> 192.168.1.20:22
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 2222 \
  -j DNAT --to-destination 192.168.1.20:22

# Minecraft 25565 -> 192.168.1.30:25565
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25565 \
  -j DNAT --to-destination 192.168.1.30:25565

# Autoriser le forwarding pour ces connexions
iptables -A FORWARD -p tcp --dport 80 -d 192.168.1.10 -j ACCEPT
iptables -A FORWARD -p tcp --dport 22 -d 192.168.1.20 -j ACCEPT
iptables -A FORWARD -p tcp --dport 25565 -d 192.168.1.30 -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

---

Exercice 24 : nftables

/etc/nftables.conf

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;
        
        # Loopback
        iif lo accept
        
        # Connexions établies
        ct state established,related accept
        
        # SSH depuis local
        tcp dport 22 ip saddr 192.168.1.0/24 accept
        
        # HTTP/HTTPS
        tcp dport {80, 443} accept
        
        # Bloquer ping
        icmp type echo-request drop
        
        # Log
        log prefix "NFTABLES-DROP: "
    }
    
    chain forward {
        type filter hook forward priority filter; policy drop;
    }
    
    chain output {
        type filter hook output priority filter; policy accept;
    }
}

Commande de traduction

# iptables -> nftables
iptables-translate -A INPUT -p tcp --dport 80 -j ACCEPT
# Output: nft add rule ip filter INPUT tcp dport 80 accept

---

Exercice 25 : Conntrack et Rate Limiting

Configuration avancée

#!/bin/bash
# Protection SYN flood
iptables -t raw -A PREROUTING -p tcp --syn -m limit --limit 500/s -j ACCEPT
iptables -t raw -A PREROUTING -p tcp --syn -j DROP

# Rate limiting SSH (3 connexions/min/IP)
iptables -A INPUT -p tcp --dport 22 -m state --state NEW \
  -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW \
  -m recent --update --seconds 60 --hitcount 3 --name SSH -j DROP

# Limiter ICMP
iptables -A INPUT -p icmp --icmp-type echo-request \
  -m limit --limit 1/second -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

# Stateful firewall
iptables -A FORWARD -m conntrack --ctstate NEW -p tcp --syn -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

---

Exercice 26 : WireGuard Point-à-Point

Site A

# Génération des clés
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
chmod 600 /etc/wireguard/server_private.key

/etc/wireguard/wg0.conf (Site A)

[Interface]
Address = 10.0.0.1/24
PrivateKey = <private_key_A>
ListenPort = 51820

[Peer]
PublicKey = <public_key_B>
Endpoint = 203.0.113.1:51820
AllowedIPs = 10.0.0.0/24
PersistentKeepalive = 25

Activation

wg-quick up wg0
systemctl enable wg-quick@wg0

Vérification

wg show
# output:
# interface: wg0
#   public key: <public_key_A>
#   private key: (hidden)
#   listening port: 51820
#
# peer: <public_key_B>
#   endpoint: 203.0.113.1:51820
#   allowed ips: 10.0.0.0/24
#   latest handshake: 2 minutes, 34 seconds ago
#   transfer: 1.24 KiB received, 2.45 KiB sent

ping 10.0.0.2

---

Exercice 27 : WireGuard Hub-and-Spoke

Hub (Paris) - /etc/wireguard/wg0.conf

[Interface]
Address = 10.0.255.1/24
PrivateKey = <hub_private>
ListenPort = 51820

# Spoke Londres
[Peer]
PublicKey = <london_public>
AllowedIPs = 10.0.1.0/24
PersistentKeepalive = 25

# Spoke Berlin
[Peer]
PublicKey = <berlin_public>
AllowedIPs = 10.0.2.0/24
PersistentKeepalive = 25

# Spoke Madrid
[Peer]
PublicKey = <madrid_public>
AllowedIPs = 10.0.3.0/24
PersistentKeepalive = 25

Activation IP Forwarding

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

---

Exercice 28 : WireGuard Split Tunneling + Kill Switch

Configuration Client

[Interface]
Address = 10.0.0.5/24
PrivateKey = <client_private>
ListenPort = 51820
Table = 51820
FwMark = 0x51820

PostUp = ip rule add from 10.0.0.5 table 51820 priority 100
PostUp = iptables -I OUTPUT ! -o wg0 -m mark ! --mark 0x51820 -m addrtype ! --dst-type LOCAL -j REJECT
PreDown = ip rule del from 10.0.0.5 table 51820 priority 100
PreDown = iptables -D OUTPUT ! -o wg0 -m mark ! --mark 0x51820 -m addrtype ! --dst-type LOCAL -j REJECT

[Peer]
PublicKey = <server_public>
Endpoint = 203.0.113.1:51820
AllowedIPs = 10.0.0.0/24
PersistentKeepalive = 25

---

Exercice 29 : Réseaux Docker

Création et test

# Créer un réseau bridge personnalisé
docker network create --driver bridge \
  --subnet=172.20.0.0/16 \
  --gateway=172.20.0.1 \
  app-net

# Lancer les conteneurs
docker run -d --name web --network app-net nginx:alpine
docker run -d --name api --network app-net -p 8080:3000 node:alpine
docker run -d --name db --network app-net -e POSTGRES_PASSWORD=secret postgres:16

# Vérifier la résolution DNS
docker exec web nslookup db
docker exec web curl http://api:3000/health

---

Exercice 30 : Docker Compose

docker-compose.yml

version: '3.8'

networks:
  frontend-net:
    driver: bridge
  backend-net:
    driver: bridge
    internal: true
  monitoring-net:
    driver: bridge

services:
  frontend:
    image: nginx:alpine
    ports:
      - "80:80"
    networks:
      - frontend-net
    depends_on:
      backend:
        condition: service_healthy

  backend:
    image: myapp/api:latest
    networks:
      - frontend-net
      - backend-net
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s

  database:
    image: postgres:16
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    networks:
      - backend-net
    volumes:
      - pgdata:/var/lib/postgresql/data

  cache:
    image: redis:7-alpine
    networks:
      - backend-net

  monitoring:
    image: prom/prometheus
    networks:
      - monitoring-net
      - frontend-net

volumes:
  pgdata:

---

Exercice 31 : Kubernetes Network Policies

Deny All par défaut

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: database
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

Autoriser backend -> database (TCP 5432)

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-api-db
  namespace: database
spec:
  podSelector:
    matchLabels:
      app: postgres
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: backend
      ports:
        - protocol: TCP
          port: 5432

---

Exercice 32 : Services Kubernetes

ClusterIP

apiVersion: v1
kind: Service
metadata:
  name: db-service
spec:
  type: ClusterIP
  selector:
    app: postgres
  ports:
    - port: 5432
      targetPort: 5432

NodePort

apiVersion: v1
kind: Service
metadata:
  name: web-service
spec:
  type: NodePort
  selector:
    app: nginx
  ports:
    - port: 80
      targetPort: 80
      nodePort: 30080

---

Exercice 33 : CNI Plugins

Kind config pour Cilium

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
networking:
  disableDefaultCNI: true
nodes:
  - role: control-plane
  - role: worker
  - role: worker

Installation Cilium

helm repo add cilium https://helm.cilium.io/
helm install cilium cilium/cilium \
  --namespace kube-system \
  --set kubeProxyReplacement=true \
  --set ipam.mode=kubernetes

---

Exercice 34-37 : Cilium

Installation sur Kind

# Créer le cluster
kind create cluster --config kind-cilium.yaml

# Installer Cilium
cilium install
cilium status --wait

# Vérifier
cilium status
cilium connectivity test

CiliumNetworkPolicy L3/L4

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-frontend-to-backend
spec:
  endpointSelector:
    matchLabels:
      app: backend
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: frontend
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP

CiliumNetworkPolicy L7 HTTP

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-api-v1-users
spec:
  endpointSelector:
    matchLabels:
      app: api
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: frontend
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: "GET"
                path: "/api/v1/users/?.*"

---

Exercice 38-40 : Wireshark

TCP Handshake (Exercice 38)

Filtre : tcp.flags.syn == 1 && tcp.flags.ack == 0 (SYN)
         tcp.flags.syn == 1 && tcp.flags.ack == 1 (SYN-ACK)
         tcp.flags.syn == 0 && tcp.flags.ack == 1 (ACK)

Analyse :
1. Client -> Server : SYN, Seq=100, Window=65535, MSS=1460
2. Server -> Client : SYN, ACK, Seq=200, Ack=101, Window=65535, MSS=1460
3. Client -> Server : ACK, Seq=101, Ack=201

DNS Analysis (Exercice 39)

Filtre : dns
Analyse :
Transaction ID: 0x1234
Flags: 0x0100 (Standard query)
  ...0 0000 0000 0001 = Opcode: Standard query (0)
  .... ........................0 = Response: Message is a query
Questions: 1
  example.lab: type A, class IN
Answers: 1
  example.lab: type A, class IN, addr 10.0.0.53

HTTP/2 (Exercice 40)

Filtre : http2
Magic: PRI * HTTP/2.0 (0x505249202a20485454502f322e30)
SETTINGS frame: enable_push=0, initial_window_size=65535
HEADERS frame: :method: GET, :path: /, :scheme: https
DATA frame: stream_id=1, length=1024

Ce corrigé couvre l'essentiel des 40 exercices. Pour les détails complets, référez-vous aux fichiers de configuration complets dans le répertoire configs/ de chaque chapitre.