aboulai.bayo/siotp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tp6_firewall

Browse Source
This commit is contained in:
aboulai.bayo
2025-05-05 09:08:44 +02:00
parent ef6152e080
commit 93a00bc152
3 changed files with 108 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

88
sisr1/tp06-firewall/current_ruleset.nft Normal file
View File

@@ -0,0 +1,88 @@
define netif = enp0s3
define lanif = enp0s8
define dmzif = enp0s9
define netip = 192.168.0.140
define dmzip = 172.17.0.254
define lanip = 172.16.0.254
define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254
define
define internal-dns-ip= 172.16.0.1
define dns-forwarder-ip= 10.121.38.7
table ip ipfilter{
chain prerouting {
type filter hook prerouting priority filter; policy drop;
ct state established,related accept
tcp dport 22 accept
tcp dport {80,443} iif $lanif accept
icmp type echo-request iif $lanif accept
icmp type echo-reply iif {$lanif, $dmzif} accept
tcp dport 53 accept
#requetes externe dns
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
}
chain system_in {
type filter hook input priority filter; policy drop;
ct state established,related accept
tcp dport 22 accept
icmp type echo-request iif $lanif accept
icmp type echo-reply accept
}
chain routing {
type filter hook forward priority filter; policy drop;
ct state established,related accept
icmp type echo-request iif $lanif oif $dmzif accept
icmp type echo-reply iif $dmzif oif $lanif accept
tcp dport {80,443} iif $lanif accept
tcp dport 53 accept
#requetes externe dns
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
}
chain system_out {
type filter hook output priority filter; policy drop;
ct state established,related accept
tcp sport 22 accept #ssh
#proxy lycée
tcp dport 8080 accept
udp dport 53 accept #dns
tcp dport {20,21} accept #ftp #tcp
tcp dport {80,443} accept #http,https
icmp type echo-request accept
icmp type echo-reply oif $lanif accept
}
chain postrouting {
type filter hook postrouting priority filter; policy drop;
ct state established,related accept
tcp sport 22 accept
tcp dport 8080 accept
udp dport 53 accept #dns
tcp dport {20,21} accept #ftp,tcp
tcp dport {80,443} accept #http,https
icmp type echo-request oif {$lanif, $dmzif} accept
icmp type echo-reply oif $lanif accept
tcp dport 53 accept
#requetes externe dns
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
}
chain nat_prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr $netip tcp dport {80,443}
dnat to $srv-web-ip
ip daddr $netip tcp dport 2222 dnat to $srv-web-ip:22
}
chain nat_postrouting {
type nat hook postrouting priority filter; policy accept;
ip saddr $lan-ntw oif $netif snat $netip
}
}

13
sisr1/tp06-firewall/fw_part1.nft Normal file
View File

@@ -0,0 +1,13 @@
table ip ipfilter {
chain routing {
type filter hook forward priority filter; policy accept;
icmp type echo-request iif { "enp0s3", "enp0s9" } drop
icmp type { echo-reply, echo-request } accept
drop
}
chain system_in {
type filter hook input priority filter; policy accept;
icmp type echo-request iif { "enp0s3", "enp0s9" } drop
}
}

7
sisr1/tp06-firewall/test_firewall.sh Normal file
View File

@@ -0,0 +1,7 @@
#!/bin/bash
ipfirewall=192.168.0.140
dir=/root/firewall
ruleset=current_ruleset.nft
scp $ruleset root@$ipfirewall:$dir/$ruselet
ssh root@$ipfirewall "bash $dir/refresh_firewall.sh"