diff --git a/sisr1/tp06-firewall/current_ruleset.nft b/sisr1/tp06-firewall/current_ruleset.nft
index e6390ff..bf91c3f 100644
--- a/sisr1/tp06-firewall/current_ruleset.nft
+++ b/sisr1/tp06-firewall/current_ruleset.nft
@@ -11,6 +11,7 @@ define dmz-ntw = 172.17.0.1-172.17.0.254
 
 define internal-dns-ip = 172.16.0.2
 define dns-forwarder-ip = 10.121.38.7
+define srv-web-ip = 172.17.0.1
 
 table ip ipfilter {
     chain prerouting {
@@ -92,7 +93,9 @@ table ip ipfilter {
     }
     chain nat_prerouting {
         type nat hook prerouting priority filter; policy accept;
-
+        
+        ip daddr $netif tcp dport {80,443} dnat to $srv-web-ip
+        ip daddr $netif tcp dport 2222 dnat to $srv-web-ip:22
     }
     chain nat_postrouting {
         type nat hook postrouting priority filter; policy accept;
diff --git a/sisr1/tp06-firewall/fw_part5.nft b/sisr1/tp06-firewall/fw_part5.nft
index 60cf4aa..e6390ff 100644
--- a/sisr1/tp06-firewall/fw_part5.nft
+++ b/sisr1/tp06-firewall/fw_part5.nft
@@ -9,6 +9,9 @@ define ipdmz = 172.17.0.254
 define lan-ntw = 172.16.0.1-172.16.0.254
 define dmz-ntw = 172.17.0.1-172.17.0.254
 
+define internal-dns-ip = 172.16.0.2
+define dns-forwarder-ip = 10.121.38.7
+
 table ip ipfilter {
     chain prerouting {
         type filter hook prerouting priority filter; policy drop;
@@ -18,6 +21,8 @@ table ip ipfilter {
         tcp dport 22 accept
             # requête HTTP et HTTPS depuis LAN
         tcp dport {80,443} iif $lanif accept
+            # requête externe du serveur DNS
+        ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
             # Pings
         icmp type echo-request iif $lanif accept
         icmp type echo-reply iif {$lanif, $dmzif} accept
@@ -36,14 +41,19 @@ table ip ipfilter {
         type filter hook forward priority filter; policy drop;
             # Communication déjà établies
         ct state established,related accept
+            # requête DNS (UDP et TCP)
+        udp dport 53 accept
             # requête HTTP et HTTPS depuis LAN
         tcp dport {80,443} iif $lanif accept
+            # requête externe du serveur DNS
+        ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
             # Pings
         icmp type echo-request iif $lanif oif $dmzif accept
         icmp type echo-reply iif $dmzif oif $lanif accept
     }
  	chain system_out {
-        type filter hook output priority filter; policy drop;   
+        type filter hook output priority filter; policy drop;
+            # Communication déjà établies   
         ct state established,related accept 
             # SSH
         tcp sport 22 accept
@@ -61,7 +71,8 @@ table ip ipfilter {
             
     }
 	chain postrouting {
-        type filter hook postrouting priority filter; policy drop;   
+        type filter hook postrouting priority filter; policy drop;
+            # Communication déjà établies   
         ct state established,related accept
             # SSH
         tcp sport 22 accept
@@ -73,6 +84,8 @@ table ip ipfilter {
         tcp dport {80,443} accept
             # requête FTP
         tcp dport {20,21} accept
+            # requête externe du serveur DNS
+        ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
             # Pings
         icmp type echo-request oif {$lanif, $dmzif} accept
         icmp type echo-reply oif $lanif accept
diff --git a/sisr1/tp06-firewall/fw_part6.nft b/sisr1/tp06-firewall/fw_part6.nft
index e6390ff..6830cf1 100644
--- a/sisr1/tp06-firewall/fw_part6.nft
+++ b/sisr1/tp06-firewall/fw_part6.nft
@@ -5,6 +5,7 @@ define dmzif = enp0s9
 define netip = 192.168.0.140
 define iplan = 172.16.0.254
 define ipdmz = 172.17.0.254
+define dnsip = 172.16.0.2
 
 define lan-ntw = 172.16.0.1-172.16.0.254
 define dmz-ntw = 172.17.0.1-172.17.0.254
@@ -23,6 +24,8 @@ table ip ipfilter {
         tcp dport {80,443} iif $lanif accept
             # requête externe du serveur DNS
         ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
+            # requête DNS depuis la dmz
+        udp dport 53 iif $dmzif accept
             # Pings
         icmp type echo-request iif $lanif accept
         icmp type echo-reply iif {$lanif, $dmzif} accept
@@ -33,6 +36,8 @@ table ip ipfilter {
         ct state established,related accept
             # SSH
         tcp dport 22 accept
+            # requête DNS depuis la dmz
+        udp dport 53 accept
             # Pings
         icmp type echo-request iif $lanif accept
         icmp type echo-reply accept
@@ -86,6 +91,8 @@ table ip ipfilter {
         tcp dport {20,21} accept
             # requête externe du serveur DNS
         ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
+            # requête DNS depuis la dmz
+        udp dport 53 oif $dmzif accept
             # Pings
         icmp type echo-request oif {$lanif, $dmzif} accept
         icmp type echo-reply oif $lanif accept
@@ -99,3 +106,4 @@ table ip ipfilter {
         ip saddr $lan-ntw oif $netif snat $netip
     }
 }
+# pas fini
\ No newline at end of file
diff --git a/sisr1/tp06-firewall/fw_part7.nft b/sisr1/tp06-firewall/fw_part7.nft
new file mode 100644
index 0000000..bf91c3f
--- /dev/null
+++ b/sisr1/tp06-firewall/fw_part7.nft
@@ -0,0 +1,104 @@
+define netif = enp0s3
+define lanif = enp0s8
+define dmzif = enp0s9
+ 
+define netip = 192.168.0.140
+define iplan = 172.16.0.254
+define ipdmz = 172.17.0.254
+
+define lan-ntw = 172.16.0.1-172.16.0.254
+define dmz-ntw = 172.17.0.1-172.17.0.254
+
+define internal-dns-ip = 172.16.0.2
+define dns-forwarder-ip = 10.121.38.7
+define srv-web-ip = 172.17.0.1
+
+table ip ipfilter {
+    chain prerouting {
+        type filter hook prerouting priority filter; policy drop;
+            # Communication déjà établies
+        ct state established,related accept
+            # SSH
+        tcp dport 22 accept
+            # requête HTTP et HTTPS depuis LAN
+        tcp dport {80,443} iif $lanif accept
+            # requête externe du serveur DNS
+        ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
+            # Pings
+        icmp type echo-request iif $lanif accept
+        icmp type echo-reply iif {$lanif, $dmzif} accept
+    }
+	chain system_in {
+        type filter hook input priority filter; policy drop;
+            # Communication déjà établies
+        ct state established,related accept
+            # SSH
+        tcp dport 22 accept
+            # Pings
+        icmp type echo-request iif $lanif accept
+        icmp type echo-reply accept
+    }
+ 	chain routing {
+        type filter hook forward priority filter; policy drop;
+            # Communication déjà établies
+        ct state established,related accept
+            # requête DNS (UDP et TCP)
+        udp dport 53 accept
+            # requête HTTP et HTTPS depuis LAN
+        tcp dport {80,443} iif $lanif accept
+            # requête externe du serveur DNS
+        ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
+            # Pings
+        icmp type echo-request iif $lanif oif $dmzif accept
+        icmp type echo-reply iif $dmzif oif $lanif accept
+    }
+ 	chain system_out {
+        type filter hook output priority filter; policy drop;
+            # Communication déjà établies   
+        ct state established,related accept 
+            # SSH
+        tcp sport 22 accept
+            # Proxy
+        tcp dport 8080 accept
+            # requête DNS (UDP et TCP)
+        udp dport 53 accept
+            # requête HTTP, HTTPS
+        tcp dport {80,443} accept
+            # requête FTP
+        tcp dport {20,21} accept
+            # Pings
+        icmp type echo-request accept
+        icmp type echo-reply oif $lanif accept
+            
+    }
+	chain postrouting {
+        type filter hook postrouting priority filter; policy drop;
+            # Communication déjà établies   
+        ct state established,related accept
+            # SSH
+        tcp sport 22 accept
+            # Proxy
+        tcp dport 8080 accept
+            # requête DNS (UDP et TCP)
+        udp dport 53 accept
+            # requête HTTP, HTTPS
+        tcp dport {80,443} accept
+            # requête FTP
+        tcp dport {20,21} accept
+            # requête externe du serveur DNS
+        ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
+            # Pings
+        icmp type echo-request oif {$lanif, $dmzif} accept
+        icmp type echo-reply oif $lanif accept
+    }
+    chain nat_prerouting {
+        type nat hook prerouting priority filter; policy accept;
+        
+        ip daddr $netif tcp dport {80,443} dnat to $srv-web-ip
+        ip daddr $netif tcp dport 2222 dnat to $srv-web-ip:22
+    }
+    chain nat_postrouting {
+        type nat hook postrouting priority filter; policy accept;
+        ip saddr $lan-ntw oif $netif snat $netip
+    }
+}