gadmin/gsb2021
1
0
Fork 0
Code Issues 1 Pull Requests Projects Releases Wiki Activity

Mise à jour de 'roles/firewall-vpn-l/files/ferm.conf'

Browse Source
This commit is contained in:
gadmin 2021-03-31 11:08:07 +02:00
parent c0cebf0b90
commit 97e2d007d0
1 changed files with 11 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
roles/firewall-vpn-l/files/ferm.conf
View File

@ -4,12 +4,12 @@
# #
@def $DEV_ADM = enp0s3; @def $DEV_ADM = enp0s3;
@def $DEV_VPN = enp0s8; @def $DEV_AG = enp0s8;
@def $DEV_EXT = enp0s9; @def $DEV_VPN = enp0s9;
@def $NET_ADM=192.168.99.102/24; @def $NET_ADM=192.168.99.102/24;
@def $NET_VPN=172.16.128.254/24; @def $NET_AG=172.16.128.254/24;
@def $NET_EXT=192.168.0.52/30; @def $NET_VPN=192.168.0.52/24;
table filter { table filter {
chain INPUT { chain INPUT {
@ -23,7 +23,7 @@ table filter {
interface lo ACCEPT; interface lo ACCEPT;
# allow SSH connections # allow SSH connections
#interface ($DEV_ADM) { #interface ($DEV_VPN) {
proto tcp dport ssh ACCEPT; proto tcp dport ssh ACCEPT;
#} #}
@ -37,14 +37,14 @@ table filter {
proto udp dport (67 68) ACCEPT; proto udp dport (67 68) ACCEPT;
# allow IPsec # allow IPsec
interface ($DEV_VPN $DEV_EXT) { interface ($DEV_AG $DEV_VPN) {
proto udp sport 500 ACCEPT; proto udp sport 500 ACCEPT;
proto udp dport 500 ACCEPT; proto udp dport 500 ACCEPT;
proto esp ACCEPT; proto esp ACCEPT;
} }
# Autoriser nat-t-ike # Autoriser nat-t-ike
# interface ($DEV_VPN) { # interface ($DEV_AG) {
proto udp sport 4500 ACCEPT; proto udp sport 4500 ACCEPT;
proto udp dport 5500 ACCEPT; proto udp dport 5500 ACCEPT;
# } # }
@ -54,52 +54,16 @@ table filter {
proto (udp tcp) dport domain ACCEPT; proto (udp tcp) dport domain ACCEPT;
#} #}
# autoriser supervision
proto udp sport 161 ACCEPT;
# autoriser NTP # autoriser NTP
proto udp sport 123 ACCEPT; proto udp sport 123 ACCEPT;
# respond to ping
proto icmp mod limit limit 30/minut ACCEPT;
} }
chain OUTPUT { chain OUTPUT {
policy DROP; policy ACCEPT;
# interface ($DEV_PUB) {
# Autoriser SSH
proto tcp sport ssh ACCEPT;
# Autoriser DNS
proto udp dport domain ACCEPT;
proto udp sport domain ACCEPT;
# DHCP
proto udp sport (67 68) ACCEPT;
# Autoriser ipsec
proto udp dport 500 ACCEPT;
proto udp sport 500 ACCEPT;
# Autoriser nat-t-ike
proto udp dport 4500 ACCEPT;
proto udp sport 4500 ACCEPT;
# Autoriser supervision
proto udp dport 161 ACCEPT;
# Autoriser NTP
proto udp dport 123 ACCEPT;
# respond to ping
proto icmp ACCEPT;
# }
# connection tracking # connection tracking
#mod state state INVALID DROP; # mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT; # mod state state (ESTABLISHED RELATED) ACCEPT;
} }
chain FORWARD { chain FORWARD {
policy ACCEPT; policy ACCEPT;
@ -109,14 +73,3 @@ table filter {
mod state state (ESTABLISHED RELATED) ACCEPT; mod state state (ESTABLISHED RELATED) ACCEPT;
} }
} }
# IPv6:
#domain ip6 {
# table filter {
# chain INPUT {
# policy ACCEPT;
# # ...
# }
# # ...
# }
#}