jeremy.thomas/siotp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ajout des parties 4, 5 et 6

Browse Source
This commit is contained in:
jeremy.thomas 2025-04-14 11:55:44 +02:00
parent 6890f2d4e3
commit 366716ebf2
4 changed files with 345 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

109
sisr1/tp06-firewall/current_ruleset.nft
View File

@ -9,34 +9,93 @@ define ipdmz = 172.17.0.254
define lan-ntw = 172.16.0.1-172.16.0.254 define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254 define dmz-ntw = 172.17.0.1-172.17.0.254
define internal-dns-ip = 172.16.0.2
define dns-forwarder-ip = 10.121.38.7
table ip ipfilter { table ip ipfilter {
chain prerouting { chain prerouting {
type filter hook prerouting priority filter; policy drop; type filter hook prerouting priority filter; policy drop;
tcp dport 22 accept # Communication déjà établies
icmp type echo-request iif $lanif accept ct state established,related accept
icmp type echo-reply iif {$lanif, $dmzif} accept # SSH
} tcp dport 22 accept
# requête HTTP et HTTPS depuis LAN
tcp dport {80,443} iif $lanif accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings
icmp type echo-request iif $lanif accept
icmp type echo-reply iif {$lanif, $dmzif} accept
}
chain system_in { chain system_in {
type filter hook input priority filter; policy drop; type filter hook input priority filter; policy drop;
tcp dport 22 accept # Communication déjà établies
icmp type echo-request iif $lanif accept ct state established,related accept
icmp type echo-reply accept # SSH
} tcp dport 22 accept
# Pings
icmp type echo-request iif $lanif accept
icmp type echo-reply accept
}
chain routing { chain routing {
type filter hook forward priority filter; policy drop; type filter hook forward priority filter; policy drop;
icmp type echo-request iif $lanif oif $dmzif accept # Communication déjà établies
icmp type echo-reply iif $dmzif oif $lanif accept ct state established,related accept
} # requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP et HTTPS depuis LAN
tcp dport {80,443} iif $lanif accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings
icmp type echo-request iif $lanif oif $dmzif accept
icmp type echo-reply iif $dmzif oif $lanif accept
}
chain system_out { chain system_out {
type filter hook output priority filter; policy drop; type filter hook output priority filter; policy drop;
tcp sport 22 accept # Communication déjà établies
icmp type echo-request accept ct state established,related accept
icmp type echo-reply oif $lanif accept # SSH
} tcp sport 22 accept
# Proxy
tcp dport 8080 accept
# requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP, HTTPS
tcp dport {80,443} accept
# requête FTP
tcp dport {20,21} accept
# Pings
icmp type echo-request accept
icmp type echo-reply oif $lanif accept
}
chain postrouting { chain postrouting {
type filter hook postrouting priority filter; policy drop; type filter hook postrouting priority filter; policy drop;
tcp sport 22 accept # Communication déjà établies
icmp type echo-request oif {$lanif, $dmzif} accept ct state established,related accept
icmp type echo-reply oif $lanif accept # SSH
} tcp sport 22 accept
# Proxy
tcp dport 8080 accept
# requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP, HTTPS
tcp dport {80,443} accept
# requête FTP
tcp dport {20,21} accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings
icmp type echo-request oif {$lanif, $dmzif} accept
icmp type echo-reply oif $lanif accept
}
chain nat_prerouting {
type nat hook prerouting priority filter; policy accept;
}
chain nat_postrouting {
type nat hook postrouting priority filter; policy accept;
ip saddr $lan-ntw oif $netif snat $netip
}
} }

72
sisr1/tp06-firewall/fw_part4.nft Normal file
View File

@ -0,0 +1,72 @@
define netif = enp0s3
define lanif = enp0s8
define dmzif = enp0s9
define netip = 192.168.0.140
define iplan = 172.16.0.254
define ipdmz = 172.17.0.254
define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254
table ip ipfilter {
chain prerouting {
type filter hook prerouting priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# SSH
tcp dport 22 accept
# Pings
icmp type echo-request iif $lanif accept
icmp type echo-reply iif {$lanif, $dmzif} accept
}
chain system_in {
type filter hook input priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# SSH
tcp dport 22 accept
# Pings
icmp type echo-request iif $lanif accept
icmp type echo-reply accept
}
chain routing {
type filter hook forward priority filter; policy drop;
icmp type echo-request iif $lanif oif $dmzif accept
icmp type echo-reply iif $dmzif oif $lanif accept
udp sport 53 accept
}
chain system_out {
type filter hook output priority filter; policy drop;
# SSH
tcp sport 22 accept
# Proxy
tcp dport 8080 accept
# requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP, HTTPS
tcp dport {80,443} accept
# requête FTP
tcp dport {20,21} accept
# Pings
icmp type echo-request accept
icmp type echo-reply oif $lanif accept
}
chain postrouting {
type filter hook postrouting priority filter; policy drop;
# SSH
tcp sport 22 accept
# Proxy
tcp dport 8080 accept
# requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP, HTTPS
tcp dport {80,443} accept
# requête FTP
tcp dport {20,21} accept
# Pings
icmp type echo-request oif {$lanif, $dmzif} accept
icmp type echo-reply oif $lanif accept
}
}

88
sisr1/tp06-firewall/fw_part5.nft Normal file
View File

@ -0,0 +1,88 @@
define netif = enp0s3
define lanif = enp0s8
define dmzif = enp0s9
define netip = 192.168.0.140
define iplan = 172.16.0.254
define ipdmz = 172.17.0.254
define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254
table ip ipfilter {
chain prerouting {
type filter hook prerouting priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# SSH
tcp dport 22 accept
# requête HTTP et HTTPS depuis LAN
tcp dport {80,443} iif $lanif accept
# Pings
icmp type echo-request iif $lanif accept
icmp type echo-reply iif {$lanif, $dmzif} accept
}
chain system_in {
type filter hook input priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# SSH
tcp dport 22 accept
# Pings
icmp type echo-request iif $lanif accept
icmp type echo-reply accept
}
chain routing {
type filter hook forward priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# requête HTTP et HTTPS depuis LAN
tcp dport {80,443} iif $lanif accept
# Pings
icmp type echo-request iif $lanif oif $dmzif accept
icmp type echo-reply iif $dmzif oif $lanif accept
}
chain system_out {
type filter hook output priority filter; policy drop;
ct state established,related accept
# SSH
tcp sport 22 accept
# Proxy
tcp dport 8080 accept
# requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP, HTTPS
tcp dport {80,443} accept
# requête FTP
tcp dport {20,21} accept
# Pings
icmp type echo-request accept
icmp type echo-reply oif $lanif accept
}
chain postrouting {
type filter hook postrouting priority filter; policy drop;
ct state established,related accept
# SSH
tcp sport 22 accept
# Proxy
tcp dport 8080 accept
# requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP, HTTPS
tcp dport {80,443} accept
# requête FTP
tcp dport {20,21} accept
# Pings
icmp type echo-request oif {$lanif, $dmzif} accept
icmp type echo-reply oif $lanif accept
}
chain nat_prerouting {
type nat hook prerouting priority filter; policy accept;
}
chain nat_postrouting {
type nat hook postrouting priority filter; policy accept;
ip saddr $lan-ntw oif $netif snat $netip
}
}

101
sisr1/tp06-firewall/fw_part6.nft Normal file
View File

@ -0,0 +1,101 @@
define netif = enp0s3
define lanif = enp0s8
define dmzif = enp0s9
define netip = 192.168.0.140
define iplan = 172.16.0.254
define ipdmz = 172.17.0.254
define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254
define internal-dns-ip = 172.16.0.2
define dns-forwarder-ip = 10.121.38.7
table ip ipfilter {
chain prerouting {
type filter hook prerouting priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# SSH
tcp dport 22 accept
# requête HTTP et HTTPS depuis LAN
tcp dport {80,443} iif $lanif accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings
icmp type echo-request iif $lanif accept
icmp type echo-reply iif {$lanif, $dmzif} accept
}
chain system_in {
type filter hook input priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# SSH
tcp dport 22 accept
# Pings
icmp type echo-request iif $lanif accept
icmp type echo-reply accept
}
chain routing {
type filter hook forward priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP et HTTPS depuis LAN
tcp dport {80,443} iif $lanif accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings
icmp type echo-request iif $lanif oif $dmzif accept
icmp type echo-reply iif $dmzif oif $lanif accept
}
chain system_out {
type filter hook output priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# SSH
tcp sport 22 accept
# Proxy
tcp dport 8080 accept
# requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP, HTTPS
tcp dport {80,443} accept
# requête FTP
tcp dport {20,21} accept
# Pings
icmp type echo-request accept
icmp type echo-reply oif $lanif accept
}
chain postrouting {
type filter hook postrouting priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# SSH
tcp sport 22 accept
# Proxy
tcp dport 8080 accept
# requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP, HTTPS
tcp dport {80,443} accept
# requête FTP
tcp dport {20,21} accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings
icmp type echo-request oif {$lanif, $dmzif} accept
icmp type echo-reply oif $lanif accept
}
chain nat_prerouting {
type nat hook prerouting priority filter; policy accept;
}
chain nat_postrouting {
type nat hook postrouting priority filter; policy accept;
ip saddr $lan-ntw oif $netif snat $netip
}
}