Premier commit

2021-01-04 22:49:46 +01:00
parent da1100578d
commit 65b2a3eaf3
538 changed files with 52570 additions and 0 deletions
--- a/roles/firewall-vpn-r/files/ferm.conf
+++ b/roles/firewall-vpn-r/files/ferm.conf
@@ -0,0 +1,116 @@
+# -*- shell-script -*-
+#
+#  Configuration file for ferm(1).
+#
+
+@def $DEV_ADM	= enp0s3;
+@def $DEV_VPN	= enp0s8;
+@def $DEV_EXT	= enp0s9;
+
+@def $NET_ADM=192.168.99.0/24;
+@def $NET_VPN=192.168.0.0/24;
+@def $NET_EXT=192.168.1.0/30;
+
+table filter {
+    chain INPUT {
+        policy DROP;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # allow local packet
+        interface lo ACCEPT;
+
+        # allow SSH connections
+        #interface ($DEV_ADM) {
+	proto tcp dport ssh ACCEPT;
+	#}
+
+        # allow DNS connections
+        #interface ($DEV_INT) {
+	proto udp sport domain ACCEPT;
+	proto udp dport domain ACCEPT;
+	#}	
+
+        # allow IPsec
+        interface ($DEV_VPN) {
+        proto udp sport 500 ACCEPT;
+        proto udp dport 500 ACCEPT;
+        proto esp ACCEPT;
+	}
+
+        # Autoriser nat-t-ike
+        interface ($DEV_VPN) {
+        proto udp sport 4500 ACCEPT;
+        proto udp dport 5500 ACCEPT;
+	}
+
+        # allow DNS connections
+        #interface ($DEV_INT) {
+#	proto (udp tcp) dport domain ACCEPT;
+	#}
+
+	# autoriser supervision
+	proto udp sport 161 ACCEPT;
+
+	# autoriser NTP
+	proto udp sport 123 ACCEPT;
+
+        # respond to ping
+        proto icmp mod limit limit 30/minut ACCEPT; 
+
+    }
+    chain OUTPUT {
+        policy DROP;
+#        interface ($DEV_PUB) {
+        
+	# Autoriser SSH
+        proto tcp sport ssh ACCEPT;
+
+	# Autoriser DNS
+        proto udp dport domain ACCEPT;
+        proto udp sport domain ACCEPT;
+	
+	# Autoriser ipsec
+        proto udp dport 500 ACCEPT;
+        proto udp sport 500 ACCEPT;
+	
+	# Autoriser nat-t-ike
+        proto udp dport 4500 ACCEPT;
+        proto udp sport 4500 ACCEPT;
+        
+	# Autoriser supervision
+        proto udp dport 161 ACCEPT;
+	
+	# Autoriser NTP
+        proto udp dport 123 ACCEPT;
+
+        # respond to ping
+        proto icmp ACCEPT; 
+
+#	}
+
+        # connection tracking
+        #mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+    }
+    chain FORWARD {
+        policy ACCEPT;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+    }
+}
+
+# IPv6:
+#domain ip6 {
+#    table filter {
+#        chain INPUT {
+#            policy ACCEPT;
+#            # ...
+#        }
+#        # ...
+#    }
+#}