Premier commit

roles/old/firewall-vpn-l/files/ferm.conf

@@ -0,0 +1,68 @@
+# -*- shell-script -*-
+#
+#  Configuration file for ferm(1).
+#
+
+@def $DEV_ADM	= enp0s3;
+@def $DEV_AG	= enp0s8;
+@def $DEV_VPN	= enp0s9;
+
+@def $NET_ADM=192.168.99.102/24;
+@def $NET_AG=172.16.128.254/24;
+@def $NET_VPN=192.168.0.52/24;
+
+table filter {
+    chain INPUT {
+        policy DROP;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # allow local packet
+        interface lo ACCEPT;
+
+        # allow SSH connections
+	proto tcp dport ssh ACCEPT;
+
+        # allow DNS connections
+	proto udp sport domain ACCEPT;
+	proto udp dport domain ACCEPT;	
+
+        # allow IPsec
+        interface ($DEV_AG $DEV_VPN) {
+        proto udp sport 500 ACCEPT;
+        proto udp dport 500 ACCEPT;
+        proto esp ACCEPT;
+	}
+
+        # Autoriser nat-t-ike
+ #       interface ($DEV_AG) {
+        proto udp sport 4500 ACCEPT;
+        proto udp dport 5500 ACCEPT;
+#	}
+
+        # allow DNS connections
+        #interface ($DEV_INT) {
+	proto (udp tcp) dport domain ACCEPT;
+	#}
+
+	# autoriser NTP
+	proto udp sport 123 ACCEPT;
+
+    }
+    chain OUTPUT {
+        policy ACCEPT;
+
+        # connection tracking
+        # mod state state INVALID DROP;
+        # mod state state (ESTABLISHED RELATED) ACCEPT;
+    }
+    chain FORWARD {
+        policy ACCEPT;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+    }
+}

roles/old/firewall-vpn-l/files/iptables-vpn

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+#renommage des interfaces
+IFPUB=enp0s9
+IFINT=enp0s8
+
+iptables -F
+#iptables -F -t nat
+
+#bloquer tout
+iptables -P INPUT DROP
+iptables -P OUTPUT DROP
+iptables -P FORWARD ACCEPT
+
+iptables -A INPUT -i lo
+iptables -A OUTPUT -o lo
+
+#autorise l'acces SSH
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+#Autorise les requete DNS en tant que client
+iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+iptables -A INPUT -p udp --sport 53 -j ACCEPT
+iptables -A INPUT -p udp --dport 53 -j ACCEPT
+iptables -A OUTPUT -p udp --sport 53 -j ACCEPT
+
+#autorise isakmp
+iptables -A OUTPUT -p udp --dport 500 -j ACCEPT
+iptables -A INPUT -p udp --sport 500 -j ACCEPT
+iptables -A INPUT -p udp --dport 500 -j ACCEPT
+iptables -A OUTPUT  -p udp --sport 500 -j ACCEPT
+
+#autorise nat-t-ike
+iptables -A OUTPUT -p udp --dport 4500 -j ACCEPT
+iptables -A INPUT -p udp --sport 4500 -j ACCEPT
+iptables -A INPUT -p udp --dport 5500 -j ACCEPT
+iptables -A OUTPUT  -p udp --sport 4500 -j ACCEPT
+
+
+# allow IPsec IKE negotiations
+#iptables -I INPUT  -p udp --sport 500 --dport 500 -j ACCEPT
+#iptables -I OUTPUT -p udp --sport 500 --dport 500 -j ACCEPT
+# ESP encryption and authentication
+iptables -I INPUT  -p 50 -j ACCEPT
+iptables -I OUTPUT -p 50 -j ACCEPT
+
+#autorise la supervision ( SNMP )
+iptables -A OUTPUT -p udp --dport 161 -j ACCEPT
+iptables -A INPUT -p udp --sport 161 -j ACCEPT
+
+#autorise NTP
+iptables -A OUTPUT -p udp --dport 123 -j ACCEPT
+iptables -A INPUT -p udp --sport 123 -j ACCEPT
+
+#autoriser les ping sauf de l'exterieur
+iptables -A INPUT -p icmp -m limit --limit 30/minute -j ACCEPT
+iptables -A OUTPUT -p icmp -j ACCEPT