Compare commits

...

2 Commits

Author SHA1 Message Date
am
abd94f520c modifs main.yml 2021-03-31 11:23:24 +02:00
97e2d007d0 Mise à jour de 'roles/firewall-vpn-l/files/ferm.conf' 2021-03-31 11:08:07 +02:00
2 changed files with 34 additions and 81 deletions

View File

@@ -35,29 +35,6 @@
name: nginx name: nginx
state: present state: present
- name: Copie de /etc/nginx/site-availables/proxy
copy:
src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/proxy
dest: /etc/nginx/sites-available
- name: Suppression de /etc/nginx/sites-enabled/default
file:
path: /etc/nginx/sites-enabled/default
state: absent
- name: Creation de lien symbolique avec /etc/nginx/sites-available/proxy dans /etc/nginx/sites-enabled/proxy
file:
src: /etc/nginx/sites-available/proxy
dest: /etc/nginx/sites-enabled/proxy
owner: root
group: root
state: link
- name: Redemarage de Nginx
service:
name: nginx
state: restarted
- name: Copie de config.php dans /root/nextcloud/nextcloud/config - name: Copie de config.php dans /root/nextcloud/nextcloud/config
copy: copy:
src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/config.php src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/config.php
@@ -87,3 +64,26 @@
copy: copy:
src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/ssl-params.conf src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/ssl-params.conf
dest: /etc/nginx/snippets dest: /etc/nginx/snippets
- name: Copie de /etc/nginx/site-availables/proxy
copy:
src: /root/tools/ansible/gsb2021/roles/docker-nextcloud/files/proxy
dest: /etc/nginx/sites-available
- name: Suppression de /etc/nginx/sites-enabled/default
file:
path: /etc/nginx/sites-enabled/default
state: absent
- name: Creation de lien symbolique avec /etc/nginx/sites-available/proxy dans /etc/n$
file:
src: /etc/nginx/sites-available/proxy
dest: /etc/nginx/sites-enabled/proxy
owner: root
group: root
state: link
- name: Redemarage de Nginx
service:
name: nginx
state: restarted

View File

@@ -4,12 +4,12 @@
# #
@def $DEV_ADM = enp0s3; @def $DEV_ADM = enp0s3;
@def $DEV_VPN = enp0s8; @def $DEV_AG = enp0s8;
@def $DEV_EXT = enp0s9; @def $DEV_VPN = enp0s9;
@def $NET_ADM=192.168.99.102/24; @def $NET_ADM=192.168.99.102/24;
@def $NET_VPN=172.16.128.254/24; @def $NET_AG=172.16.128.254/24;
@def $NET_EXT=192.168.0.52/30; @def $NET_VPN=192.168.0.52/24;
table filter { table filter {
chain INPUT { chain INPUT {
@@ -23,7 +23,7 @@ table filter {
interface lo ACCEPT; interface lo ACCEPT;
# allow SSH connections # allow SSH connections
#interface ($DEV_ADM) { #interface ($DEV_VPN) {
proto tcp dport ssh ACCEPT; proto tcp dport ssh ACCEPT;
#} #}
@@ -37,14 +37,14 @@ table filter {
proto udp dport (67 68) ACCEPT; proto udp dport (67 68) ACCEPT;
# allow IPsec # allow IPsec
interface ($DEV_VPN $DEV_EXT) { interface ($DEV_AG $DEV_VPN) {
proto udp sport 500 ACCEPT; proto udp sport 500 ACCEPT;
proto udp dport 500 ACCEPT; proto udp dport 500 ACCEPT;
proto esp ACCEPT; proto esp ACCEPT;
} }
# Autoriser nat-t-ike # Autoriser nat-t-ike
# interface ($DEV_VPN) { # interface ($DEV_AG) {
proto udp sport 4500 ACCEPT; proto udp sport 4500 ACCEPT;
proto udp dport 5500 ACCEPT; proto udp dport 5500 ACCEPT;
# } # }
@@ -54,52 +54,16 @@ table filter {
proto (udp tcp) dport domain ACCEPT; proto (udp tcp) dport domain ACCEPT;
#} #}
# autoriser supervision
proto udp sport 161 ACCEPT;
# autoriser NTP # autoriser NTP
proto udp sport 123 ACCEPT; proto udp sport 123 ACCEPT;
# respond to ping
proto icmp mod limit limit 30/minut ACCEPT;
} }
chain OUTPUT { chain OUTPUT {
policy DROP; policy ACCEPT;
# interface ($DEV_PUB) {
# Autoriser SSH
proto tcp sport ssh ACCEPT;
# Autoriser DNS
proto udp dport domain ACCEPT;
proto udp sport domain ACCEPT;
# DHCP
proto udp sport (67 68) ACCEPT;
# Autoriser ipsec
proto udp dport 500 ACCEPT;
proto udp sport 500 ACCEPT;
# Autoriser nat-t-ike
proto udp dport 4500 ACCEPT;
proto udp sport 4500 ACCEPT;
# Autoriser supervision
proto udp dport 161 ACCEPT;
# Autoriser NTP
proto udp dport 123 ACCEPT;
# respond to ping
proto icmp ACCEPT;
# }
# connection tracking # connection tracking
# mod state state INVALID DROP; # mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT; # mod state state (ESTABLISHED RELATED) ACCEPT;
} }
chain FORWARD { chain FORWARD {
policy ACCEPT; policy ACCEPT;
@@ -109,14 +73,3 @@ table filter {
mod state state (ESTABLISHED RELATED) ACCEPT; mod state state (ESTABLISHED RELATED) ACCEPT;
} }
} }
# IPv6:
#domain ip6 {
# table filter {
# chain INPUT {
# policy ACCEPT;
# # ...
# }
# # ...
# }
#}