From 93a00bc152988bff986943f4dc2125190771d236 Mon Sep 17 00:00:00 2001
From: "aboulai.bayo" <bayoaboulai8@gmail.com>
Date: Mon, 5 May 2025 09:08:44 +0200
Subject: [PATCH] tp6_firewall

---
 sisr1/tp06-firewall/current_ruleset.nft | 88 +++++++++++++++++++++++++
 sisr1/tp06-firewall/fw_part1.nft        | 13 ++++
 sisr1/tp06-firewall/test_firewall.sh    |  7 ++
 3 files changed, 108 insertions(+)
 create mode 100644 sisr1/tp06-firewall/current_ruleset.nft
 create mode 100644 sisr1/tp06-firewall/fw_part1.nft
 create mode 100644 sisr1/tp06-firewall/test_firewall.sh

diff --git a/sisr1/tp06-firewall/current_ruleset.nft b/sisr1/tp06-firewall/current_ruleset.nft
new file mode 100644
index 0000000..e9720d5
--- /dev/null
+++ b/sisr1/tp06-firewall/current_ruleset.nft
@@ -0,0 +1,88 @@
+define netif = enp0s3
+define lanif = enp0s8
+define dmzif = enp0s9
+
+define netip = 192.168.0.140
+define dmzip = 172.17.0.254
+define lanip = 172.16.0.254
+
+define lan-ntw = 172.16.0.1-172.16.0.254
+define dmz-ntw = 172.17.0.1-172.17.0.254
+define 
+
+define internal-dns-ip= 172.16.0.1
+define dns-forwarder-ip= 10.121.38.7
+
+table ip ipfilter{
+	chain prerouting {
+                type filter hook prerouting priority filter; policy drop;
+                ct state established,related accept
+		tcp dport 22 accept
+                tcp dport {80,443} iif $lanif accept
+                icmp type echo-request iif $lanif accept
+		icmp type echo-reply iif {$lanif, $dmzif} accept
+                tcp dport 53 accept 
+                #requetes externe dns 
+                ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
+
+
+
+        }
+	chain system_in {
+                type filter hook input priority filter; policy drop;
+                ct state established,related accept
+		tcp dport 22 accept
+                icmp type echo-request iif $lanif accept
+		icmp type echo-reply accept
+
+        }
+ 	chain routing {
+                type filter hook forward priority filter; policy drop;
+                ct state established,related accept
+                icmp type echo-request iif $lanif oif $dmzif accept
+		icmp type echo-reply iif $dmzif oif $lanif accept
+                tcp dport {80,443} iif $lanif accept
+                tcp dport 53 accept 
+                #requetes externe dns 
+                ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept 
+        }
+ 	chain system_out {
+                type filter hook output priority filter; policy drop;
+                ct state established,related accept
+                tcp sport 22 accept #ssh 
+                #proxy lycée
+                tcp dport 8080 accept 
+                udp dport 53 accept #dns
+                tcp dport {20,21} accept #ftp #tcp 
+                tcp dport {80,443} accept #http,https
+                icmp type echo-request accept
+		icmp type echo-reply oif $lanif accept
+        }
+	chain postrouting {
+                type filter hook postrouting priority filter; policy drop;
+                ct state established,related accept
+                tcp sport 22 accept
+                tcp dport 8080 accept 
+                udp dport 53 accept #dns
+                tcp dport {20,21} accept #ftp,tcp 
+                tcp dport {80,443} accept #http,https
+                icmp type echo-request oif {$lanif, $dmzif} accept
+		icmp type echo-reply oif $lanif accept
+                tcp dport 53 accept 
+                #requetes externe dns 
+                ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept 
+        }
+        chain nat_prerouting {
+                type nat hook prerouting priority filter; policy accept;
+                ip daddr $netip tcp dport {80,443}
+                dnat to $srv-web-ip 
+                ip daddr $netip tcp dport 2222 dnat to $srv-web-ip:22
+
+        }
+        chain nat_postrouting {
+               type nat hook postrouting priority filter; policy accept;
+                ip saddr $lan-ntw oif $netif snat $netip
+        }
+}
+
+
diff --git a/sisr1/tp06-firewall/fw_part1.nft b/sisr1/tp06-firewall/fw_part1.nft
new file mode 100644
index 0000000..ab34969
--- /dev/null
+++ b/sisr1/tp06-firewall/fw_part1.nft
@@ -0,0 +1,13 @@
+table ip ipfilter {
+        chain routing {
+                type filter hook forward priority filter; policy accept;
+                icmp type echo-request iif { "enp0s3", "enp0s9" } drop
+                icmp type { echo-reply, echo-request } accept
+                drop
+        }
+ 
+        chain system_in {
+                type filter hook input priority filter; policy accept;
+                icmp type echo-request iif { "enp0s3", "enp0s9" } drop
+        }
+}
diff --git a/sisr1/tp06-firewall/test_firewall.sh b/sisr1/tp06-firewall/test_firewall.sh
new file mode 100644
index 0000000..188bc89
--- /dev/null
+++ b/sisr1/tp06-firewall/test_firewall.sh
@@ -0,0 +1,7 @@
+#!/bin/bash 
+ipfirewall=192.168.0.140
+dir=/root/firewall
+ruleset=current_ruleset.nft
+
+scp $ruleset root@$ipfirewall:$dir/$ruselet 
+ssh root@$ipfirewall "bash $dir/refresh_firewall.sh"
\ No newline at end of file