From a796151db6035a10329c90318cb899fff9b7cd7f Mon Sep 17 00:00:00 2001
From: "guillaume.emorine" <guillaume.emorine@debian>
Date: Mon, 8 Apr 2024 10:26:49 +0200
Subject: [PATCH] =?UTF-8?q?=09Modifi=C3=A9=C2=A0:=20=20=20=20=20=20=20=20?=
 =?UTF-8?q?=20sisr1/tp07/files=5Ffirewall/current=5Fruleset=5Fpartie=5F5.n?=
 =?UTF-8?q?ft?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../current_ruleset_partie_5.nft               | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/sisr1/tp07/files_firewall/current_ruleset_partie_5.nft b/sisr1/tp07/files_firewall/current_ruleset_partie_5.nft
index d3c7f21..d781693 100644
--- a/sisr1/tp07/files_firewall/current_ruleset_partie_5.nft
+++ b/sisr1/tp07/files_firewall/current_ruleset_partie_5.nft
@@ -14,6 +14,7 @@ define ipdmz = 172.16.0.254
 define iplan = 10.0.0.254
 
 table ip ipfilter{
+
 	chain prerouting {
                 type filter hook prerouting priority filter; policy drop;
 		ct state established, related accept
@@ -25,8 +26,12 @@ table ip ipfilter{
                 tcp dport {80, 443} ip saddr $lan-ntw accept
 		tcp sport {80, 443} ip saddr $lan-ntw accept
 		tcp dport 22 accept
+		udp sport 53 iif {$dmzif, $lanif} accept
+		udp dport 53 accept
 		ip saddr $proxy tcp dport {80, 443} accept
+		ip daddr $dns accept
         }
+
 	chain system_in {
                 type filter hook input priority filter; policy drop;
 		ct state established, related accept
@@ -36,8 +41,11 @@ table ip ipfilter{
                 tcp dport 21 accept
                 tcp dport {80, 443} accept
                 tcp dport 22 accept
+		udp sport 53 accept
+                udp dport 53 accept
 		ip saddr $proxy tcp dport {80, 443} accept
         }
+
  	chain routing {
                 type filter hook forward priority filter; policy drop;
 		ct state established, related accept
@@ -45,7 +53,11 @@ table ip ipfilter{
 		icmp type echo-reply iif {$dmzif} oif {$lanif} accept
                 tcp dport {80, 443} ip saddr $lan-ntw accept
 		tcp sport {80, 443} ip saddr $lan-ntw accept
+		udp sport 53 iif {$lanif, $dmzif} accept
+		udp dport 53 accept
+		ip daddr $dns accept
 	}
+
  	chain system_out {
                 type filter hook output priority filter; policy drop;
                 ip daddr $dns accept
@@ -59,7 +71,10 @@ table ip ipfilter{
                 tcp dport {80, 443} accept
 		tcp sport {80, 443} accept
 		tcp sport 22 accept
+                udp sport 53 accept
+                udp dport 53 accept
         }
+
 	chain postrouting {
                 type filter hook postrouting priority filter; policy drop;
 		ct state established, related accept
@@ -76,6 +91,9 @@ table ip ipfilter{
                 tcp dport {80, 443} accept
 		tcp sport {80, 443} accept
 		tcp sport 22 accept
+                udp sport 53 accept
+                udp dport 53 accept
+		ip daddr $dns accept
 	}
 
 	chain pre_nat {