From 715fcd3deddb5d2b190042a74a5d1c8543de1950 Mon Sep 17 00:00:00 2001 From: Jarod Pauchet Date: Mon, 8 Apr 2024 09:48:59 +0200 Subject: [PATCH] =?UTF-8?q?=09modifi=C3=A9=C2=A0:=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20siotp/sisr1/TP7/scriptsnft/current=5Fruleset.nft=20=09nouvea?= =?UTF-8?q?u=20fichier=C2=A0:=20siotp/sisr1/TP7/scriptsnft/fw=5Fpart5.nft?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../sisr1/TP7/scriptsnft/current_ruleset.nft | 40 ++++++-- siotp/sisr1/TP7/scriptsnft/fw_part5.nft | 94 +++++++++++++++++++ 2 files changed, 127 insertions(+), 7 deletions(-) create mode 100644 siotp/sisr1/TP7/scriptsnft/fw_part5.nft diff --git a/siotp/sisr1/TP7/scriptsnft/current_ruleset.nft b/siotp/sisr1/TP7/scriptsnft/current_ruleset.nft index f88dcdc..a2377ea 100644 --- a/siotp/sisr1/TP7/scriptsnft/current_ruleset.nft +++ b/siotp/sisr1/TP7/scriptsnft/current_ruleset.nft @@ -6,6 +6,13 @@ define firewall = 192.168.0.140 define ipdmz = 172.16.0.254 define iplan = 10.0.0.254 +define lan-ntw = 10.0.0.0/24 + +define dns-server = {10.121.38.7 , 10.121.38.8} + +define proxy-lyc = 10.121.38.1 +define proxy-port = 8080 + table ip ipfilter{ chain prerouting { type filter hook prerouting priority filter; policy drop; @@ -17,8 +24,12 @@ table ip ipfilter{ tcp dport 21 accept tcp dport {80, 443} accept tcp dport 22 accept - ip saddr 10.121.38.1 tcp dport {80, 443} accept + ip saddr $proxy-lyc tcp dport {80, 443} accept + ct state {established,related} accept + tcp sport {80,443} ip saddr $lan-ntw accept + tcp dport {80,443} ip saddr $lan-ntw accept } + chain system_in { type filter hook input priority filter; policy drop; icmp type echo-reply accept @@ -28,17 +39,21 @@ table ip ipfilter{ tcp dport 21 accept tcp dport {80, 443} accept tcp dport 22 accept - ip saddr 10.121.38.1 tcp dport {80, 443} accept + ip saddr $proxy-lyc tcp dport {80, 443} accept } chain routing { type filter hook forward priority filter; policy drop; icmp type echo-request iif {$lanif} oif {$dmzif} accept icmp type echo-reply iif {$dmzif} oif {$lanif} accept + ct state {established,related} accept + tcp sport {80,443} ip saddr $lan-ntw accept + tcp dport {80,443} ip saddr $lan-ntw accept } + chain system_out { type filter hook output priority filter; policy drop; - ip daddr 10.121.38.7-10.121.38.8 accept - ip daddr 10.121.38.1 tcp dport 8080 accept + ip daddr $dns-server accept + ip daddr $proxy-lyc tcp dport $proxy-port accept icmp type echo-reply oif {$lanif} accept icmp type echo-request accept tcp dport 20 accept @@ -51,8 +66,8 @@ table ip ipfilter{ } chain postrouting { type filter hook postrouting priority filter; policy drop; - ip daddr 10.121.38.7-10.121.38.8 accept - ip daddr 10.121.38.1 tcp dport 8080 accept + ip daddr $dns-server accept + ip daddr $proxy-lyc tcp dport $proxy-port accept icmp type echo-request ip saddr {$iplan, $ipdmz, $firewall} accept icmp type echo-reply iif {$dmzif} oif {$lanif} accept icmp type echo-request iif {$lanif} oif {$dmzif} accept @@ -64,5 +79,16 @@ table ip ipfilter{ tcp dport {80, 443} accept tcp sport {80, 443} accept tcp sport 22 accept - } + ct state {established,related} accept + } +} +table ip nat { + chain prerouting { + type nat hook prerouting priority filter; policy accept; + } + + chain postrouting { + type nat hook postrouting priority filter; policy accept; + ip saddr $lan-ntw oif $netif snat $firewall + } } diff --git a/siotp/sisr1/TP7/scriptsnft/fw_part5.nft b/siotp/sisr1/TP7/scriptsnft/fw_part5.nft new file mode 100644 index 0000000..a2377ea --- /dev/null +++ b/siotp/sisr1/TP7/scriptsnft/fw_part5.nft @@ -0,0 +1,94 @@ +define netif = enp0s3 +define dmzif = enp0s8 +define lanif = enp0s9 + +define firewall = 192.168.0.140 +define ipdmz = 172.16.0.254 +define iplan = 10.0.0.254 + +define lan-ntw = 10.0.0.0/24 + +define dns-server = {10.121.38.7 , 10.121.38.8} + +define proxy-lyc = 10.121.38.1 +define proxy-port = 8080 + +table ip ipfilter{ + chain prerouting { + type filter hook prerouting priority filter; policy drop; + icmp type echo-reply accept + ct state established, related accept + icmp type echo-request iif {$lanif} ip daddr 172.16.0.1-172.16.0.254 accept + icmp type echo-request iif {$lanif} ip daddr {$iplan} accept + tcp dport 20 accept + tcp dport 21 accept + tcp dport {80, 443} accept + tcp dport 22 accept + ip saddr $proxy-lyc tcp dport {80, 443} accept + ct state {established,related} accept + tcp sport {80,443} ip saddr $lan-ntw accept + tcp dport {80,443} ip saddr $lan-ntw accept + } + + chain system_in { + type filter hook input priority filter; policy drop; + icmp type echo-reply accept + icmp type echo-request iif {$lanif} accept + ct state established, related accept + tcp dport 20 accept + tcp dport 21 accept + tcp dport {80, 443} accept + tcp dport 22 accept + ip saddr $proxy-lyc tcp dport {80, 443} accept + } + chain routing { + type filter hook forward priority filter; policy drop; + icmp type echo-request iif {$lanif} oif {$dmzif} accept + icmp type echo-reply iif {$dmzif} oif {$lanif} accept + ct state {established,related} accept + tcp sport {80,443} ip saddr $lan-ntw accept + tcp dport {80,443} ip saddr $lan-ntw accept + } + + chain system_out { + type filter hook output priority filter; policy drop; + ip daddr $dns-server accept + ip daddr $proxy-lyc tcp dport $proxy-port accept + icmp type echo-reply oif {$lanif} accept + icmp type echo-request accept + tcp dport 20 accept + tcp sport 20 accept + tcp dport 21 accept + tcp sport 21 accept + tcp dport {80, 443} accept + tcp sport {80, 443} accept + tcp sport 22 accept + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + ip daddr $dns-server accept + ip daddr $proxy-lyc tcp dport $proxy-port accept + icmp type echo-request ip saddr {$iplan, $ipdmz, $firewall} accept + icmp type echo-reply iif {$dmzif} oif {$lanif} accept + icmp type echo-request iif {$lanif} oif {$dmzif} accept + icmp type echo-request ip saddr $iplan oif $lanif accept + tcp dport 20 accept + tcp sport 20 accept + tcp dport 21 accept + tcp sport 21 accept + tcp dport {80, 443} accept + tcp sport {80, 443} accept + tcp sport 22 accept + ct state {established,related} accept + } +} +table ip nat { + chain prerouting { + type nat hook prerouting priority filter; policy accept; + } + + chain postrouting { + type nat hook postrouting priority filter; policy accept; + ip saddr $lan-ntw oif $netif snat $firewall + } +}