incrémentation des modif

README.md

@@ -105,5 +105,5 @@ cd tools/ansible/gsb2023
 bash agoss # lance le test portant le nom de la machine 
 ```
 
-`agoss -f tap` permet de lancer le test avec le détail d'exécution
+`bash agoss -f tap` permet de lancer le test avec le détail d'exécution
 

roles/fw-ferm/files/ferm-vp1.conf

@@ -0,0 +1,47 @@
+# -*- shell-script -*-
+
+@def $DEV_VPN= wg0;
+
+table filter {
+    chain INPUT {
+        policy DROP;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # allow local connections
+        interface lo ACCEPT;
+        interface $DEV_VPN{
+        # respond to ping
+        proto icmp icmp-type echo-request ACCEPT;
+        # disallow ssh
+        saddr proto tcp dport ssh DROP;
+        }
+    }#FIN INPUT
+
+    # outgoing connections are not limited
+    chain OUTPUT {
+        policy ACCEPT;
+        interface $DEV_VPN{
+        # allow ssh
+        daddr proto tcp dport ssh ACCEPT;
+        # respond to ping
+        proto icmp icmp-type echo-request ACCEPT;
+        }
+     }#FIN OUTPUT
+
+    chain FORWARD {
+        policy ACCEPT;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # connections from the internal net to the internet or to other
+        # internal nets are allowed
+        interface $DEV_VPN ACCEPT;
+
+        # the rest is dropped by the above policy
+    }#FIN FO
+}

roles/fw-ferm/files/ferm.conf.r-vp1

@@ -4,7 +4,7 @@
 
 @def $DEV_PRIVATE = enp0s8;
 @def $DEV_WORLD = enp0s9;
-
+@def $DEV_VPN= wg0;
 @def $NET_PRIVATE = 172.16.0.0/24;
 
 table filter {
@@ -33,8 +33,15 @@ table filter {
         # we provide DNS and SMTP services for the internal net
         interface $DEV_PRIVATE saddr $NET_PRIVATE {
             proto (udp tcp) dport domain ACCEPT;
-            proto udp dport bootps ACCEPT;            
+            proto udp dport bootps ACCEPT; 
         }
+        interface $DEV_VPN{
+        # respond to ping
+        proto icmp icmp-type echo-request ACCEPT;
+        # disallow ssh
+        saddr proto tcp dport ssh DROP;
+        }           
+        
 
         # interface réseau 
         interface $DEV_WORLD {
@@ -45,8 +52,14 @@ table filter {
     }#FIN INPUT
 
     # outgoing connections are not limited
-    chain OUTPUT policy ACCEPT;
+    chain OUTPUT {policy ACCEPT;
-
+        interface $DEV_VPN{
+        # allow ssh
+        daddr proto tcp dport ssh ACCEPT;
+        # respond to ping
+        proto icmp icmp-type echo-request ACCEPT;
+        }
+     }#FIN OUTPUT
     chain FORWARD {
         policy ACCEPT;
 

roles/fw-ferm/files/ferm.conf.r-vp2

@@ -4,7 +4,7 @@
 
 @def $DEV_PRIVATE = enp0s9;
 @def $DEV_WORLD = enp0s8;
-
+@def $DEV_VPN= wg0;
 @def $NET_PRIVATE = 172.16.0.0/24;
 
 table filter {
@@ -34,7 +34,12 @@ table filter {
             proto (udp tcp) dport domain ACCEPT;
             proto udp dport bootps ACCEPT;
         }
-
+        interface $DEV_VPN{
+        # respond to ping
+        proto icmp icmp-type echo-request ACCEPT;
+        # disallow ssh
+        saddr proto tcp dport ssh ACCEPT;
+        }
         # interface réseau
         interface $DEV_WORLD {
 
@@ -44,8 +49,14 @@ table filter {
     }#FIN INPUT
 
     # outgoing connections are not limited
-    chain OUTPUT policy ACCEPT;
+    chain OUTPUT {policy ACCEPT;
-
+        interface $DEV_VPN{
+        # allow ssh
+        daddr proto tcp dport ssh DROP;
+        # respond to ping
+        proto icmp icmp-type echo-request ACCEPT;
+        }
+}
     chain FORWARD {
         policy ACCEPT;