jarod.pauchet/JPsiotp
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

modifié : siotp/sisr1/TP7/scriptsnft/current_ruleset.nft

Browse Source 
nouveau fichier : siotp/sisr1/TP7/scriptsnft/fw_part5.nft
This commit is contained in:
Jarod Pauchet 2024-04-08 09:48:59 +02:00
parent 522adcf07f
commit 715fcd3ded
2 changed files with 127 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
siotp/sisr1/TP7/scriptsnft/current_ruleset.nft
View File

@ -6,6 +6,13 @@ define firewall = 192.168.0.140
define ipdmz = 172.16.0.254 define ipdmz = 172.16.0.254
define iplan = 10.0.0.254 define iplan = 10.0.0.254
define lan-ntw = 10.0.0.0/24
define dns-server = {10.121.38.7 , 10.121.38.8}
define proxy-lyc = 10.121.38.1
define proxy-port = 8080
table ip ipfilter{ table ip ipfilter{
chain prerouting { chain prerouting {
type filter hook prerouting priority filter; policy drop; type filter hook prerouting priority filter; policy drop;
@ -17,8 +24,12 @@ table ip ipfilter{
tcp dport 21 accept tcp dport 21 accept
tcp dport {80, 443} accept tcp dport {80, 443} accept
tcp dport 22 accept tcp dport 22 accept
ip saddr 10.121.38.1 tcp dport {80, 443} accept ip saddr $proxy-lyc tcp dport {80, 443} accept
ct state {established,related} accept
tcp sport {80,443} ip saddr $lan-ntw accept
tcp dport {80,443} ip saddr $lan-ntw accept
} }
chain system_in { chain system_in {
type filter hook input priority filter; policy drop; type filter hook input priority filter; policy drop;
icmp type echo-reply accept icmp type echo-reply accept
@ -28,17 +39,21 @@ table ip ipfilter{
tcp dport 21 accept tcp dport 21 accept
tcp dport {80, 443} accept tcp dport {80, 443} accept
tcp dport 22 accept tcp dport 22 accept
ip saddr 10.121.38.1 tcp dport {80, 443} accept ip saddr $proxy-lyc tcp dport {80, 443} accept
} }
chain routing { chain routing {
type filter hook forward priority filter; policy drop; type filter hook forward priority filter; policy drop;
icmp type echo-request iif {$lanif} oif {$dmzif} accept icmp type echo-request iif {$lanif} oif {$dmzif} accept
icmp type echo-reply iif {$dmzif} oif {$lanif} accept icmp type echo-reply iif {$dmzif} oif {$lanif} accept
ct state {established,related} accept
tcp sport {80,443} ip saddr $lan-ntw accept
tcp dport {80,443} ip saddr $lan-ntw accept
} }
chain system_out { chain system_out {
type filter hook output priority filter; policy drop; type filter hook output priority filter; policy drop;
ip daddr 10.121.38.7-10.121.38.8 accept ip daddr $dns-server accept
ip daddr 10.121.38.1 tcp dport 8080 accept ip daddr $proxy-lyc tcp dport $proxy-port accept
icmp type echo-reply oif {$lanif} accept icmp type echo-reply oif {$lanif} accept
icmp type echo-request accept icmp type echo-request accept
tcp dport 20 accept tcp dport 20 accept
@ -51,8 +66,8 @@ table ip ipfilter{
} }
chain postrouting { chain postrouting {
type filter hook postrouting priority filter; policy drop; type filter hook postrouting priority filter; policy drop;
ip daddr 10.121.38.7-10.121.38.8 accept ip daddr $dns-server accept
ip daddr 10.121.38.1 tcp dport 8080 accept ip daddr $proxy-lyc tcp dport $proxy-port accept
icmp type echo-request ip saddr {$iplan, $ipdmz, $firewall} accept icmp type echo-request ip saddr {$iplan, $ipdmz, $firewall} accept
icmp type echo-reply iif {$dmzif} oif {$lanif} accept icmp type echo-reply iif {$dmzif} oif {$lanif} accept
icmp type echo-request iif {$lanif} oif {$dmzif} accept icmp type echo-request iif {$lanif} oif {$dmzif} accept
@ -64,5 +79,16 @@ table ip ipfilter{
tcp dport {80, 443} accept tcp dport {80, 443} accept
tcp sport {80, 443} accept tcp sport {80, 443} accept
tcp sport 22 accept tcp sport 22 accept
} ct state {established,related} accept
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority filter; policy accept;
}
chain postrouting {
type nat hook postrouting priority filter; policy accept;
ip saddr $lan-ntw oif $netif snat $firewall
}
} }

94
siotp/sisr1/TP7/scriptsnft/fw_part5.nft Normal file
View File

@ -0,0 +1,94 @@
define netif = enp0s3
define dmzif = enp0s8
define lanif = enp0s9
define firewall = 192.168.0.140
define ipdmz = 172.16.0.254
define iplan = 10.0.0.254
define lan-ntw = 10.0.0.0/24
define dns-server = {10.121.38.7 , 10.121.38.8}
define proxy-lyc = 10.121.38.1
define proxy-port = 8080
table ip ipfilter{
chain prerouting {
type filter hook prerouting priority filter; policy drop;
icmp type echo-reply accept
ct state established, related accept
icmp type echo-request iif {$lanif} ip daddr 172.16.0.1-172.16.0.254 accept
icmp type echo-request iif {$lanif} ip daddr {$iplan} accept
tcp dport 20 accept
tcp dport 21 accept
tcp dport {80, 443} accept
tcp dport 22 accept
ip saddr $proxy-lyc tcp dport {80, 443} accept
ct state {established,related} accept
tcp sport {80,443} ip saddr $lan-ntw accept
tcp dport {80,443} ip saddr $lan-ntw accept
}
chain system_in {
type filter hook input priority filter; policy drop;
icmp type echo-reply accept
icmp type echo-request iif {$lanif} accept
ct state established, related accept
tcp dport 20 accept
tcp dport 21 accept
tcp dport {80, 443} accept
tcp dport 22 accept
ip saddr $proxy-lyc tcp dport {80, 443} accept
}
chain routing {
type filter hook forward priority filter; policy drop;
icmp type echo-request iif {$lanif} oif {$dmzif} accept
icmp type echo-reply iif {$dmzif} oif {$lanif} accept
ct state {established,related} accept
tcp sport {80,443} ip saddr $lan-ntw accept
tcp dport {80,443} ip saddr $lan-ntw accept
}
chain system_out {
type filter hook output priority filter; policy drop;
ip daddr $dns-server accept
ip daddr $proxy-lyc tcp dport $proxy-port accept
icmp type echo-reply oif {$lanif} accept
icmp type echo-request accept
tcp dport 20 accept
tcp sport 20 accept
tcp dport 21 accept
tcp sport 21 accept
tcp dport {80, 443} accept
tcp sport {80, 443} accept
tcp sport 22 accept
}
chain postrouting {
type filter hook postrouting priority filter; policy drop;
ip daddr $dns-server accept
ip daddr $proxy-lyc tcp dport $proxy-port accept
icmp type echo-request ip saddr {$iplan, $ipdmz, $firewall} accept
icmp type echo-reply iif {$dmzif} oif {$lanif} accept
icmp type echo-request iif {$lanif} oif {$dmzif} accept
icmp type echo-request ip saddr $iplan oif $lanif accept
tcp dport 20 accept
tcp sport 20 accept
tcp dport 21 accept
tcp sport 21 accept
tcp dport {80, 443} accept
tcp sport {80, 443} accept
tcp sport 22 accept
ct state {established,related} accept
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority filter; policy accept;
}
chain postrouting {
type nat hook postrouting priority filter; policy accept;
ip saddr $lan-ntw oif $netif snat $firewall
}
}