Premier commit

roles/firewall-vpn-r/files/ferm.conf

@@ -0,0 +1,116 @@
+# -*- shell-script -*-
+#
+#  Configuration file for ferm(1).
+#
+
+@def $DEV_ADM	= enp0s3;
+@def $DEV_VPN	= enp0s8;
+@def $DEV_EXT	= enp0s9;
+
+@def $NET_ADM=192.168.99.0/24;
+@def $NET_VPN=192.168.0.0/24;
+@def $NET_EXT=192.168.1.0/30;
+
+table filter {
+    chain INPUT {
+        policy DROP;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # allow local packet
+        interface lo ACCEPT;
+
+        # allow SSH connections
+        #interface ($DEV_ADM) {
+	proto tcp dport ssh ACCEPT;
+	#}
+
+        # allow DNS connections
+        #interface ($DEV_INT) {
+	proto udp sport domain ACCEPT;
+	proto udp dport domain ACCEPT;
+	#}	
+
+        # allow IPsec
+        interface ($DEV_VPN) {
+        proto udp sport 500 ACCEPT;
+        proto udp dport 500 ACCEPT;
+        proto esp ACCEPT;
+	}
+
+        # Autoriser nat-t-ike
+        interface ($DEV_VPN) {
+        proto udp sport 4500 ACCEPT;
+        proto udp dport 5500 ACCEPT;
+	}
+
+        # allow DNS connections
+        #interface ($DEV_INT) {
+#	proto (udp tcp) dport domain ACCEPT;
+	#}
+
+	# autoriser supervision
+	proto udp sport 161 ACCEPT;
+
+	# autoriser NTP
+	proto udp sport 123 ACCEPT;
+
+        # respond to ping
+        proto icmp mod limit limit 30/minut ACCEPT; 
+
+    }
+    chain OUTPUT {
+        policy DROP;
+#        interface ($DEV_PUB) {
+        
+	# Autoriser SSH
+        proto tcp sport ssh ACCEPT;
+
+	# Autoriser DNS
+        proto udp dport domain ACCEPT;
+        proto udp sport domain ACCEPT;
+	
+	# Autoriser ipsec
+        proto udp dport 500 ACCEPT;
+        proto udp sport 500 ACCEPT;
+	
+	# Autoriser nat-t-ike
+        proto udp dport 4500 ACCEPT;
+        proto udp sport 4500 ACCEPT;
+        
+	# Autoriser supervision
+        proto udp dport 161 ACCEPT;
+	
+	# Autoriser NTP
+        proto udp dport 123 ACCEPT;
+
+        # respond to ping
+        proto icmp ACCEPT; 
+
+#	}
+
+        # connection tracking
+        #mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+    }
+    chain FORWARD {
+        policy ACCEPT;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+    }
+}
+
+# IPv6:
+#domain ip6 {
+#    table filter {
+#        chain INPUT {
+#            policy ACCEPT;
+#            # ...
+#        }
+#        # ...
+#    }
+#}

roles/firewall-vpn-r/files/iptables-vpn

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+#renommage des interfaces
+IFPUB=enp0s8
+IFINT=enp0s9
+
+iptables -F
+#iptables -F -t nat
+
+#bloquer tout
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD ACCEPT
+
+iptables -A INPUT -i lo
+iptables -A OUTPUT -o lo
+
+#autorise l'acces SSH
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+#Autorise les requete DNS en tant que client
+iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+iptables -A INPUT -p udp --sport 53 -j ACCEPT
+iptables -A INPUT -p udp --dport 53 -j ACCEPT
+iptables -A OUTPUT -p udp --sport 53 -j ACCEPT
+
+#autorise isakmp
+iptables -A OUTPUT -p udp --dport 500 -j ACCEPT
+iptables -A INPUT -p udp --sport 500 -j ACCEPT
+iptables -A INPUT -p udp --dport 500 -j ACCEPT
+iptables -A OUTPUT  -p udp --sport 500 -j ACCEPT
+
+#autorise nat-t-ike
+iptables -A OUTPUT -p udp --dport 4500 -j ACCEPT
+iptables -A INPUT -p udp --sport 4500 -j ACCEPT
+iptables -A INPUT -p udp --dport 5500 -j ACCEPT
+iptables -A OUTPUT  -p udp --sport 4500 -j ACCEPT
+
+
+# allow IPsec IKE negotiations
+#iptables -I INPUT  -p udp --sport 500 --dport 500 -j ACCEPT
+#iptables -I OUTPUT -p udp --sport 500 --dport 500 -j ACCEPT
+# ESP encryption and authentication
+iptables -I INPUT  -p 50 -j ACCEPT
+iptables -I OUTPUT -p 50 -j ACCEPT
+
+#autorise la supervision ( SNMP )
+iptables -A OUTPUT -p udp --dport 161 -j ACCEPT
+iptables -A INPUT -p udp --sport 161 -j ACCEPT
+
+#autorise NTP
+iptables -A OUTPUT -p udp --dport 123 -j ACCEPT
+iptables -A INPUT -p udp --sport 123 -j ACCEPT
+
+#autoriser les ping sauf de l'exterieur
+iptables -A INPUT -p icmp -m limit --limit 30/minute -j ACCEPT
+iptables -A OUTPUT -p icmp -j ACCEPT

roles/firewall-vpn-r/handlers/main.yml

@@ -0,0 +1,3 @@
+---
+  - name: Restart ferm
+    service: name=ferm state=restarted

roles/firewall-vpn-r/tasks/main.yml

@@ -0,0 +1,15 @@
+---
+  - name: redemarrer interfaces
+    command: ifdown enp0s8
+  - name: redemarrer interfaces
+    command: ifup enp0s8
+  - name: redemarrer interfaces
+    command: ifdown enp0s9
+  - name: redemarrer interfaces
+    command: ifup enp0s9
+  - name: redemarrer interfaces
+    apt: name=ferm state=present
+  - name: fichier parefeu pour VPN
+    copy: src=ferm.conf dest=/etc/ferm/ferm.conf
+    notify:
+      - Restart ferm