From 20100a19458a7b214a294ae9353b0d72fdbc159c Mon Sep 17 00:00:00 2001 From: "jeremy.thomas" Date: Thu, 10 Apr 2025 14:12:01 +0200 Subject: [PATCH] Ajout des parties 2 et 3 du tp6 --- sisr1/tp06-firewall/current_ruleset.nft | 43 +++++++++++++++++++------ sisr1/tp06-firewall/fw_part2.nft | 25 ++++++++++++++ sisr1/tp06-firewall/fw_part3.nft | 42 ++++++++++++++++++++++++ sisr1/tp06-firewall/test_firewall.sh | 2 +- 4 files changed, 102 insertions(+), 10 deletions(-) create mode 100644 sisr1/tp06-firewall/fw_part2.nft create mode 100644 sisr1/tp06-firewall/fw_part3.nft diff --git a/sisr1/tp06-firewall/current_ruleset.nft b/sisr1/tp06-firewall/current_ruleset.nft index dd75614..2c612d7 100644 --- a/sisr1/tp06-firewall/current_ruleset.nft +++ b/sisr1/tp06-firewall/current_ruleset.nft @@ -2,16 +2,41 @@ define netif = enp0s3 define lanif = enp0s8 define dmzif = enp0s9 +define netip = 192.168.0.140 +define iplan = 172.16.0.254 +define ipdmz = 172.17.0.254 + +define lan-ntw = 172.16.0.1-172.16.0.254 +define dmz-ntw = 172.17.0.1-172.17.0.254 + table ip ipfilter { - chain routing { - type filter hook forward priority filter; policy accept; - icmp type echo-request iif { $netif, $dmzif } drop - icmp type { echo-reply, echo-request } accept - drop + chain prerouting { + type filter hook prerouting priority filter; policy drop; + tcp dport 22 accept + icmp type echo-request iif $lanif accept + icmp type echo-reply iif {$lanif, $dmzif} accept } - - chain system_in { - type filter hook input priority filter; policy accept; - icmp type echo-request iif { $netif, $dmzif } drop + chain system_in { + type filter hook input priority filter; policy drop; + tcp dport 22 accept + icmp type echo-request iif $lanif accept + icmp type echo-reply accept + } + chain routing { + type filter hook forward priority filter; policy drop; + icmp type echo-request iif $lanif oif $dmzif accept + icmp type echo-request iif $dmzif oif $lanif accept + } + chain system_out { + type filter hook output priority filter; policy drop; + tcp sport 22 accept + icmp type echo-request accept + icmp type echo-reply oif $lanif accept + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + tcp sport 22 accept + icmp type echo-request oif {$lanif, $dmzif} accept + icmp type echo-reply oif $lanif accept } } diff --git a/sisr1/tp06-firewall/fw_part2.nft b/sisr1/tp06-firewall/fw_part2.nft new file mode 100644 index 0000000..f361f83 --- /dev/null +++ b/sisr1/tp06-firewall/fw_part2.nft @@ -0,0 +1,25 @@ +define netif = enp0s3 +define lanif = enp0s8 +define dmzif = enp0s9 + +table ip ipfilter { + chain prerouting { + type filter hook prerouting priority filter; policy drop; + tcp dport 22 accept + } + chain system_in { + type filter hook input priority filter; policy drop; + tcp dport 22 accept + } + chain routing { + type filter hook forward priority filter; policy drop; + } + chain system_out { + type filter hook output priority filter; policy drop; + tcp sport 22 accept + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + tcp sport 22 accept + } +} diff --git a/sisr1/tp06-firewall/fw_part3.nft b/sisr1/tp06-firewall/fw_part3.nft new file mode 100644 index 0000000..2c612d7 --- /dev/null +++ b/sisr1/tp06-firewall/fw_part3.nft @@ -0,0 +1,42 @@ +define netif = enp0s3 +define lanif = enp0s8 +define dmzif = enp0s9 + +define netip = 192.168.0.140 +define iplan = 172.16.0.254 +define ipdmz = 172.17.0.254 + +define lan-ntw = 172.16.0.1-172.16.0.254 +define dmz-ntw = 172.17.0.1-172.17.0.254 + +table ip ipfilter { + chain prerouting { + type filter hook prerouting priority filter; policy drop; + tcp dport 22 accept + icmp type echo-request iif $lanif accept + icmp type echo-reply iif {$lanif, $dmzif} accept + } + chain system_in { + type filter hook input priority filter; policy drop; + tcp dport 22 accept + icmp type echo-request iif $lanif accept + icmp type echo-reply accept + } + chain routing { + type filter hook forward priority filter; policy drop; + icmp type echo-request iif $lanif oif $dmzif accept + icmp type echo-request iif $dmzif oif $lanif accept + } + chain system_out { + type filter hook output priority filter; policy drop; + tcp sport 22 accept + icmp type echo-request accept + icmp type echo-reply oif $lanif accept + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + tcp sport 22 accept + icmp type echo-request oif {$lanif, $dmzif} accept + icmp type echo-reply oif $lanif accept + } +} diff --git a/sisr1/tp06-firewall/test_firewall.sh b/sisr1/tp06-firewall/test_firewall.sh index dbfb96c..ad66e04 100644 --- a/sisr1/tp06-firewall/test_firewall.sh +++ b/sisr1/tp06-firewall/test_firewall.sh @@ -3,5 +3,5 @@ ipfirewall=192.168.0.140 dir=/root/firewall ruleset=current_ruleset.nft -scp current_releset.nft root@$ipfirewall:$dir/$ruleset +scp $ruleset root@$ipfirewall:$dir/$ruleset ssh root@$ipfirewall "bash $dir/refresh_firewall.sh" \ No newline at end of file