From 366716ebf246bfe347954efedd1c6c3e26a3080c Mon Sep 17 00:00:00 2001 From: "jeremy.thomas" Date: Mon, 14 Apr 2025 11:55:44 +0200 Subject: [PATCH] Ajout des parties 4, 5 et 6 --- sisr1/tp06-firewall/current_ruleset.nft | 109 ++++++++++++++++++------ sisr1/tp06-firewall/fw_part4.nft | 72 ++++++++++++++++ sisr1/tp06-firewall/fw_part5.nft | 88 +++++++++++++++++++ sisr1/tp06-firewall/fw_part6.nft | 101 ++++++++++++++++++++++ 4 files changed, 345 insertions(+), 25 deletions(-) create mode 100644 sisr1/tp06-firewall/fw_part4.nft create mode 100644 sisr1/tp06-firewall/fw_part5.nft create mode 100644 sisr1/tp06-firewall/fw_part6.nft diff --git a/sisr1/tp06-firewall/current_ruleset.nft b/sisr1/tp06-firewall/current_ruleset.nft index 5bf849f..e6390ff 100644 --- a/sisr1/tp06-firewall/current_ruleset.nft +++ b/sisr1/tp06-firewall/current_ruleset.nft @@ -9,34 +9,93 @@ define ipdmz = 172.17.0.254 define lan-ntw = 172.16.0.1-172.16.0.254 define dmz-ntw = 172.17.0.1-172.17.0.254 +define internal-dns-ip = 172.16.0.2 +define dns-forwarder-ip = 10.121.38.7 + table ip ipfilter { - chain prerouting { - type filter hook prerouting priority filter; policy drop; - tcp dport 22 accept - icmp type echo-request iif $lanif accept - icmp type echo-reply iif {$lanif, $dmzif} accept - } + chain prerouting { + type filter hook prerouting priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp dport 22 accept + # requête HTTP et HTTPS depuis LAN + tcp dport {80,443} iif $lanif accept + # requête externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + # Pings + icmp type echo-request iif $lanif accept + icmp type echo-reply iif {$lanif, $dmzif} accept + } chain system_in { - type filter hook input priority filter; policy drop; - tcp dport 22 accept - icmp type echo-request iif $lanif accept - icmp type echo-reply accept - } + type filter hook input priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp dport 22 accept + # Pings + icmp type echo-request iif $lanif accept + icmp type echo-reply accept + } chain routing { - type filter hook forward priority filter; policy drop; - icmp type echo-request iif $lanif oif $dmzif accept - icmp type echo-reply iif $dmzif oif $lanif accept - } + type filter hook forward priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # requête DNS (UDP et TCP) + udp dport 53 accept + # requête HTTP et HTTPS depuis LAN + tcp dport {80,443} iif $lanif accept + # requête externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + # Pings + icmp type echo-request iif $lanif oif $dmzif accept + icmp type echo-reply iif $dmzif oif $lanif accept + } chain system_out { - type filter hook output priority filter; policy drop; - tcp sport 22 accept - icmp type echo-request accept - icmp type echo-reply oif $lanif accept - } + type filter hook output priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp sport 22 accept + # Proxy + tcp dport 8080 accept + # requête DNS (UDP et TCP) + udp dport 53 accept + # requête HTTP, HTTPS + tcp dport {80,443} accept + # requête FTP + tcp dport {20,21} accept + # Pings + icmp type echo-request accept + icmp type echo-reply oif $lanif accept + + } chain postrouting { - type filter hook postrouting priority filter; policy drop; - tcp sport 22 accept - icmp type echo-request oif {$lanif, $dmzif} accept - icmp type echo-reply oif $lanif accept - } + type filter hook postrouting priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp sport 22 accept + # Proxy + tcp dport 8080 accept + # requête DNS (UDP et TCP) + udp dport 53 accept + # requête HTTP, HTTPS + tcp dport {80,443} accept + # requête FTP + tcp dport {20,21} accept + # requête externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + # Pings + icmp type echo-request oif {$lanif, $dmzif} accept + icmp type echo-reply oif $lanif accept + } + chain nat_prerouting { + type nat hook prerouting priority filter; policy accept; + + } + chain nat_postrouting { + type nat hook postrouting priority filter; policy accept; + ip saddr $lan-ntw oif $netif snat $netip + } } diff --git a/sisr1/tp06-firewall/fw_part4.nft b/sisr1/tp06-firewall/fw_part4.nft new file mode 100644 index 0000000..a447667 --- /dev/null +++ b/sisr1/tp06-firewall/fw_part4.nft @@ -0,0 +1,72 @@ +define netif = enp0s3 +define lanif = enp0s8 +define dmzif = enp0s9 + +define netip = 192.168.0.140 +define iplan = 172.16.0.254 +define ipdmz = 172.17.0.254 + +define lan-ntw = 172.16.0.1-172.16.0.254 +define dmz-ntw = 172.17.0.1-172.17.0.254 + +table ip ipfilter { + chain prerouting { + type filter hook prerouting priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp dport 22 accept + # Pings + icmp type echo-request iif $lanif accept + icmp type echo-reply iif {$lanif, $dmzif} accept + } + chain system_in { + type filter hook input priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp dport 22 accept + # Pings + icmp type echo-request iif $lanif accept + icmp type echo-reply accept + } + chain routing { + type filter hook forward priority filter; policy drop; + icmp type echo-request iif $lanif oif $dmzif accept + icmp type echo-reply iif $dmzif oif $lanif accept + udp sport 53 accept + } + chain system_out { + type filter hook output priority filter; policy drop; + # SSH + tcp sport 22 accept + # Proxy + tcp dport 8080 accept + # requête DNS (UDP et TCP) + udp dport 53 accept + # requête HTTP, HTTPS + tcp dport {80,443} accept + # requête FTP + tcp dport {20,21} accept + # Pings + icmp type echo-request accept + icmp type echo-reply oif $lanif accept + + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + # SSH + tcp sport 22 accept + # Proxy + tcp dport 8080 accept + # requête DNS (UDP et TCP) + udp dport 53 accept + # requête HTTP, HTTPS + tcp dport {80,443} accept + # requête FTP + tcp dport {20,21} accept + # Pings + icmp type echo-request oif {$lanif, $dmzif} accept + icmp type echo-reply oif $lanif accept + } +} diff --git a/sisr1/tp06-firewall/fw_part5.nft b/sisr1/tp06-firewall/fw_part5.nft new file mode 100644 index 0000000..60cf4aa --- /dev/null +++ b/sisr1/tp06-firewall/fw_part5.nft @@ -0,0 +1,88 @@ +define netif = enp0s3 +define lanif = enp0s8 +define dmzif = enp0s9 + +define netip = 192.168.0.140 +define iplan = 172.16.0.254 +define ipdmz = 172.17.0.254 + +define lan-ntw = 172.16.0.1-172.16.0.254 +define dmz-ntw = 172.17.0.1-172.17.0.254 + +table ip ipfilter { + chain prerouting { + type filter hook prerouting priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp dport 22 accept + # requête HTTP et HTTPS depuis LAN + tcp dport {80,443} iif $lanif accept + # Pings + icmp type echo-request iif $lanif accept + icmp type echo-reply iif {$lanif, $dmzif} accept + } + chain system_in { + type filter hook input priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp dport 22 accept + # Pings + icmp type echo-request iif $lanif accept + icmp type echo-reply accept + } + chain routing { + type filter hook forward priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # requête HTTP et HTTPS depuis LAN + tcp dport {80,443} iif $lanif accept + # Pings + icmp type echo-request iif $lanif oif $dmzif accept + icmp type echo-reply iif $dmzif oif $lanif accept + } + chain system_out { + type filter hook output priority filter; policy drop; + ct state established,related accept + # SSH + tcp sport 22 accept + # Proxy + tcp dport 8080 accept + # requête DNS (UDP et TCP) + udp dport 53 accept + # requête HTTP, HTTPS + tcp dport {80,443} accept + # requête FTP + tcp dport {20,21} accept + # Pings + icmp type echo-request accept + icmp type echo-reply oif $lanif accept + + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + ct state established,related accept + # SSH + tcp sport 22 accept + # Proxy + tcp dport 8080 accept + # requête DNS (UDP et TCP) + udp dport 53 accept + # requête HTTP, HTTPS + tcp dport {80,443} accept + # requête FTP + tcp dport {20,21} accept + # Pings + icmp type echo-request oif {$lanif, $dmzif} accept + icmp type echo-reply oif $lanif accept + } + chain nat_prerouting { + type nat hook prerouting priority filter; policy accept; + + } + chain nat_postrouting { + type nat hook postrouting priority filter; policy accept; + ip saddr $lan-ntw oif $netif snat $netip + } +} diff --git a/sisr1/tp06-firewall/fw_part6.nft b/sisr1/tp06-firewall/fw_part6.nft new file mode 100644 index 0000000..e6390ff --- /dev/null +++ b/sisr1/tp06-firewall/fw_part6.nft @@ -0,0 +1,101 @@ +define netif = enp0s3 +define lanif = enp0s8 +define dmzif = enp0s9 + +define netip = 192.168.0.140 +define iplan = 172.16.0.254 +define ipdmz = 172.17.0.254 + +define lan-ntw = 172.16.0.1-172.16.0.254 +define dmz-ntw = 172.17.0.1-172.17.0.254 + +define internal-dns-ip = 172.16.0.2 +define dns-forwarder-ip = 10.121.38.7 + +table ip ipfilter { + chain prerouting { + type filter hook prerouting priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp dport 22 accept + # requête HTTP et HTTPS depuis LAN + tcp dport {80,443} iif $lanif accept + # requête externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + # Pings + icmp type echo-request iif $lanif accept + icmp type echo-reply iif {$lanif, $dmzif} accept + } + chain system_in { + type filter hook input priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp dport 22 accept + # Pings + icmp type echo-request iif $lanif accept + icmp type echo-reply accept + } + chain routing { + type filter hook forward priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # requête DNS (UDP et TCP) + udp dport 53 accept + # requête HTTP et HTTPS depuis LAN + tcp dport {80,443} iif $lanif accept + # requête externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + # Pings + icmp type echo-request iif $lanif oif $dmzif accept + icmp type echo-reply iif $dmzif oif $lanif accept + } + chain system_out { + type filter hook output priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp sport 22 accept + # Proxy + tcp dport 8080 accept + # requête DNS (UDP et TCP) + udp dport 53 accept + # requête HTTP, HTTPS + tcp dport {80,443} accept + # requête FTP + tcp dport {20,21} accept + # Pings + icmp type echo-request accept + icmp type echo-reply oif $lanif accept + + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp sport 22 accept + # Proxy + tcp dport 8080 accept + # requête DNS (UDP et TCP) + udp dport 53 accept + # requête HTTP, HTTPS + tcp dport {80,443} accept + # requête FTP + tcp dport {20,21} accept + # requête externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + # Pings + icmp type echo-request oif {$lanif, $dmzif} accept + icmp type echo-reply oif $lanif accept + } + chain nat_prerouting { + type nat hook prerouting priority filter; policy accept; + + } + chain nat_postrouting { + type nat hook postrouting priority filter; policy accept; + ip saddr $lan-ntw oif $netif snat $netip + } +}