siotp/sisr1/tp06-firewall/current_ruleset.nft
2025-05-05 09:08:44 +02:00

89 lines
3.1 KiB
Plaintext

define netif = enp0s3
define lanif = enp0s8
define dmzif = enp0s9
define netip = 192.168.0.140
define dmzip = 172.17.0.254
define lanip = 172.16.0.254
define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254
define
define internal-dns-ip= 172.16.0.1
define dns-forwarder-ip= 10.121.38.7
table ip ipfilter{
chain prerouting {
type filter hook prerouting priority filter; policy drop;
ct state established,related accept
tcp dport 22 accept
tcp dport {80,443} iif $lanif accept
icmp type echo-request iif $lanif accept
icmp type echo-reply iif {$lanif, $dmzif} accept
tcp dport 53 accept
#requetes externe dns
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
}
chain system_in {
type filter hook input priority filter; policy drop;
ct state established,related accept
tcp dport 22 accept
icmp type echo-request iif $lanif accept
icmp type echo-reply accept
}
chain routing {
type filter hook forward priority filter; policy drop;
ct state established,related accept
icmp type echo-request iif $lanif oif $dmzif accept
icmp type echo-reply iif $dmzif oif $lanif accept
tcp dport {80,443} iif $lanif accept
tcp dport 53 accept
#requetes externe dns
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
}
chain system_out {
type filter hook output priority filter; policy drop;
ct state established,related accept
tcp sport 22 accept #ssh
#proxy lycée
tcp dport 8080 accept
udp dport 53 accept #dns
tcp dport {20,21} accept #ftp #tcp
tcp dport {80,443} accept #http,https
icmp type echo-request accept
icmp type echo-reply oif $lanif accept
}
chain postrouting {
type filter hook postrouting priority filter; policy drop;
ct state established,related accept
tcp sport 22 accept
tcp dport 8080 accept
udp dport 53 accept #dns
tcp dport {20,21} accept #ftp,tcp
tcp dport {80,443} accept #http,https
icmp type echo-request oif {$lanif, $dmzif} accept
icmp type echo-reply oif $lanif accept
tcp dport 53 accept
#requetes externe dns
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
}
chain nat_prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr $netip tcp dport {80,443}
dnat to $srv-web-ip
ip daddr $netip tcp dport 2222 dnat to $srv-web-ip:22
}
chain nat_postrouting {
type nat hook postrouting priority filter; policy accept;
ip saddr $lan-ntw oif $netif snat $netip
}
}