jeremy.thomas/siotp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ajout des parties 2 et 3 du tp6

Browse Source
This commit is contained in:
jeremy.thomas 2025-04-10 14:12:01 +02:00
parent a116ae4538
commit 20100a1945
4 changed files with 102 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
sisr1/tp06-firewall/current_ruleset.nft
View File

@ -2,16 +2,41 @@ define netif = enp0s3
define lanif = enp0s8 define lanif = enp0s8
define dmzif = enp0s9 define dmzif = enp0s9
table ip ipfilter { define netip = 192.168.0.140
chain routing { define iplan = 172.16.0.254
type filter hook forward priority filter; policy accept; define ipdmz = 172.17.0.254
icmp type echo-request iif { $netif, $dmzif } drop
icmp type { echo-reply, echo-request } accept
drop
}
define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254
table ip ipfilter {
chain prerouting {
type filter hook prerouting priority filter; policy drop;
tcp dport 22 accept
icmp type echo-request iif $lanif accept
icmp type echo-reply iif {$lanif, $dmzif} accept
}
chain system_in { chain system_in {
type filter hook input priority filter; policy accept; type filter hook input priority filter; policy drop;
icmp type echo-request iif { $netif, $dmzif } drop tcp dport 22 accept
icmp type echo-request iif $lanif accept
icmp type echo-reply accept
}
chain routing {
type filter hook forward priority filter; policy drop;
icmp type echo-request iif $lanif oif $dmzif accept
icmp type echo-request iif $dmzif oif $lanif accept
}
chain system_out {
type filter hook output priority filter; policy drop;
tcp sport 22 accept
icmp type echo-request accept
icmp type echo-reply oif $lanif accept
}
chain postrouting {
type filter hook postrouting priority filter; policy drop;
tcp sport 22 accept
icmp type echo-request oif {$lanif, $dmzif} accept
icmp type echo-reply oif $lanif accept
} }
} }

25
sisr1/tp06-firewall/fw_part2.nft Normal file
View File

@ -0,0 +1,25 @@
define netif = enp0s3
define lanif = enp0s8
define dmzif = enp0s9
table ip ipfilter {
chain prerouting {
type filter hook prerouting priority filter; policy drop;
tcp dport 22 accept
}
chain system_in {
type filter hook input priority filter; policy drop;
tcp dport 22 accept
}
chain routing {
type filter hook forward priority filter; policy drop;
}
chain system_out {
type filter hook output priority filter; policy drop;
tcp sport 22 accept
}
chain postrouting {
type filter hook postrouting priority filter; policy drop;
tcp sport 22 accept
}
}

42
sisr1/tp06-firewall/fw_part3.nft Normal file
View File

@ -0,0 +1,42 @@
define netif = enp0s3
define lanif = enp0s8
define dmzif = enp0s9
define netip = 192.168.0.140
define iplan = 172.16.0.254
define ipdmz = 172.17.0.254
define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254
table ip ipfilter {
chain prerouting {
type filter hook prerouting priority filter; policy drop;
tcp dport 22 accept
icmp type echo-request iif $lanif accept
icmp type echo-reply iif {$lanif, $dmzif} accept
}
chain system_in {
type filter hook input priority filter; policy drop;
tcp dport 22 accept
icmp type echo-request iif $lanif accept
icmp type echo-reply accept
}
chain routing {
type filter hook forward priority filter; policy drop;
icmp type echo-request iif $lanif oif $dmzif accept
icmp type echo-request iif $dmzif oif $lanif accept
}
chain system_out {
type filter hook output priority filter; policy drop;
tcp sport 22 accept
icmp type echo-request accept
icmp type echo-reply oif $lanif accept
}
chain postrouting {
type filter hook postrouting priority filter; policy drop;
tcp sport 22 accept
icmp type echo-request oif {$lanif, $dmzif} accept
icmp type echo-reply oif $lanif accept
}
}

2
sisr1/tp06-firewall/test_firewall.sh
View File

@ -3,5 +3,5 @@ ipfirewall=192.168.0.140
dir=/root/firewall dir=/root/firewall
ruleset=current_ruleset.nft ruleset=current_ruleset.nft
scp current_releset.nft root@$ipfirewall:$dir/$ruleset scp $ruleset root@$ipfirewall:$dir/$ruleset
ssh root@$ipfirewall "bash $dir/refresh_firewall.sh" ssh root@$ipfirewall "bash $dir/refresh_firewall.sh"