123 lines
2.4 KiB
Bash
123 lines
2.4 KiB
Bash
# -*- shell-script -*-
|
|
#
|
|
# Configuration file for ferm(1).
|
|
#
|
|
|
|
@def $DEV_ADM = enp0s3;
|
|
@def $DEV_VPN = enp0s8;
|
|
@def $DEV_EXT = enp0s9;
|
|
|
|
@def $NET_ADM=192.168.99.102/24;
|
|
@def $NET_VPN=172.16.128.254/24;
|
|
@def $NET_EXT=192.168.0.52/30;
|
|
|
|
table filter {
|
|
chain INPUT {
|
|
policy DROP;
|
|
|
|
# connection tracking
|
|
mod state state INVALID DROP;
|
|
mod state state (ESTABLISHED RELATED) ACCEPT;
|
|
|
|
# allow local packet
|
|
interface lo ACCEPT;
|
|
|
|
# allow SSH connections
|
|
#interface ($DEV_ADM) {
|
|
proto tcp dport ssh ACCEPT;
|
|
#}
|
|
|
|
# allow DNS connections
|
|
#interface ($DEV_INT) {
|
|
proto udp sport domain ACCEPT;
|
|
proto udp dport domain ACCEPT;
|
|
#}
|
|
|
|
# DHCP
|
|
proto udp dport (67 68) ACCEPT;
|
|
|
|
# allow IPsec
|
|
interface ($DEV_VPN $DEV_EXT) {
|
|
proto udp sport 500 ACCEPT;
|
|
proto udp dport 500 ACCEPT;
|
|
proto esp ACCEPT;
|
|
}
|
|
|
|
# Autoriser nat-t-ike
|
|
# interface ($DEV_VPN) {
|
|
proto udp sport 4500 ACCEPT;
|
|
proto udp dport 5500 ACCEPT;
|
|
# }
|
|
|
|
# allow DNS connections
|
|
#interface ($DEV_INT) {
|
|
proto (udp tcp) dport domain ACCEPT;
|
|
#}
|
|
|
|
# autoriser supervision
|
|
proto udp sport 161 ACCEPT;
|
|
|
|
# autoriser NTP
|
|
proto udp sport 123 ACCEPT;
|
|
|
|
# respond to ping
|
|
proto icmp mod limit limit 30/minut ACCEPT;
|
|
|
|
}
|
|
chain OUTPUT {
|
|
policy DROP;
|
|
# interface ($DEV_PUB) {
|
|
|
|
# Autoriser SSH
|
|
proto tcp sport ssh ACCEPT;
|
|
|
|
# Autoriser DNS
|
|
proto udp dport domain ACCEPT;
|
|
proto udp sport domain ACCEPT;
|
|
|
|
# DHCP
|
|
proto udp sport (67 68) ACCEPT;
|
|
|
|
# Autoriser ipsec
|
|
proto udp dport 500 ACCEPT;
|
|
proto udp sport 500 ACCEPT;
|
|
|
|
# Autoriser nat-t-ike
|
|
proto udp dport 4500 ACCEPT;
|
|
proto udp sport 4500 ACCEPT;
|
|
|
|
# Autoriser supervision
|
|
proto udp dport 161 ACCEPT;
|
|
|
|
# Autoriser NTP
|
|
proto udp dport 123 ACCEPT;
|
|
|
|
# respond to ping
|
|
proto icmp ACCEPT;
|
|
|
|
# }
|
|
|
|
# connection tracking
|
|
#mod state state INVALID DROP;
|
|
mod state state (ESTABLISHED RELATED) ACCEPT;
|
|
}
|
|
chain FORWARD {
|
|
policy ACCEPT;
|
|
|
|
# connection tracking
|
|
mod state state INVALID DROP;
|
|
mod state state (ESTABLISHED RELATED) ACCEPT;
|
|
}
|
|
}
|
|
|
|
# IPv6:
|
|
#domain ip6 {
|
|
# table filter {
|
|
# chain INPUT {
|
|
# policy ACCEPT;
|
|
# # ...
|
|
# }
|
|
# # ...
|
|
# }
|
|
#}
|