From 8913ea1325553c98e1e5845abf582f1251164967 Mon Sep 17 00:00:00 2001 From: "jeremy.thomas" Date: Thu, 17 Apr 2025 14:54:57 +0200 Subject: [PATCH] =?UTF-8?q?Modif=20de=20la=20partie=205=20qui=20=C3=A9tait?= =?UTF-8?q?=20la=206=20et=20Ajout=20de=20la=20partie=207?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- sisr1/tp06-firewall/current_ruleset.nft | 5 +- sisr1/tp06-firewall/fw_part5.nft | 17 +++- sisr1/tp06-firewall/fw_part6.nft | 8 ++ sisr1/tp06-firewall/fw_part7.nft | 104 ++++++++++++++++++++++++ 4 files changed, 131 insertions(+), 3 deletions(-) create mode 100644 sisr1/tp06-firewall/fw_part7.nft diff --git a/sisr1/tp06-firewall/current_ruleset.nft b/sisr1/tp06-firewall/current_ruleset.nft index e6390ff..bf91c3f 100644 --- a/sisr1/tp06-firewall/current_ruleset.nft +++ b/sisr1/tp06-firewall/current_ruleset.nft @@ -11,6 +11,7 @@ define dmz-ntw = 172.17.0.1-172.17.0.254 define internal-dns-ip = 172.16.0.2 define dns-forwarder-ip = 10.121.38.7 +define srv-web-ip = 172.17.0.1 table ip ipfilter { chain prerouting { @@ -92,7 +93,9 @@ table ip ipfilter { } chain nat_prerouting { type nat hook prerouting priority filter; policy accept; - + + ip daddr $netif tcp dport {80,443} dnat to $srv-web-ip + ip daddr $netif tcp dport 2222 dnat to $srv-web-ip:22 } chain nat_postrouting { type nat hook postrouting priority filter; policy accept; diff --git a/sisr1/tp06-firewall/fw_part5.nft b/sisr1/tp06-firewall/fw_part5.nft index 60cf4aa..e6390ff 100644 --- a/sisr1/tp06-firewall/fw_part5.nft +++ b/sisr1/tp06-firewall/fw_part5.nft @@ -9,6 +9,9 @@ define ipdmz = 172.17.0.254 define lan-ntw = 172.16.0.1-172.16.0.254 define dmz-ntw = 172.17.0.1-172.17.0.254 +define internal-dns-ip = 172.16.0.2 +define dns-forwarder-ip = 10.121.38.7 + table ip ipfilter { chain prerouting { type filter hook prerouting priority filter; policy drop; @@ -18,6 +21,8 @@ table ip ipfilter { tcp dport 22 accept # requête HTTP et HTTPS depuis LAN tcp dport {80,443} iif $lanif accept + # requête externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept # Pings icmp type echo-request iif $lanif accept icmp type echo-reply iif {$lanif, $dmzif} accept @@ -36,14 +41,19 @@ table ip ipfilter { type filter hook forward priority filter; policy drop; # Communication déjà établies ct state established,related accept + # requête DNS (UDP et TCP) + udp dport 53 accept # requête HTTP et HTTPS depuis LAN tcp dport {80,443} iif $lanif accept + # requête externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept # Pings icmp type echo-request iif $lanif oif $dmzif accept icmp type echo-reply iif $dmzif oif $lanif accept } chain system_out { - type filter hook output priority filter; policy drop; + type filter hook output priority filter; policy drop; + # Communication déjà établies ct state established,related accept # SSH tcp sport 22 accept @@ -61,7 +71,8 @@ table ip ipfilter { } chain postrouting { - type filter hook postrouting priority filter; policy drop; + type filter hook postrouting priority filter; policy drop; + # Communication déjà établies ct state established,related accept # SSH tcp sport 22 accept @@ -73,6 +84,8 @@ table ip ipfilter { tcp dport {80,443} accept # requête FTP tcp dport {20,21} accept + # requête externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept # Pings icmp type echo-request oif {$lanif, $dmzif} accept icmp type echo-reply oif $lanif accept diff --git a/sisr1/tp06-firewall/fw_part6.nft b/sisr1/tp06-firewall/fw_part6.nft index e6390ff..6830cf1 100644 --- a/sisr1/tp06-firewall/fw_part6.nft +++ b/sisr1/tp06-firewall/fw_part6.nft @@ -5,6 +5,7 @@ define dmzif = enp0s9 define netip = 192.168.0.140 define iplan = 172.16.0.254 define ipdmz = 172.17.0.254 +define dnsip = 172.16.0.2 define lan-ntw = 172.16.0.1-172.16.0.254 define dmz-ntw = 172.17.0.1-172.17.0.254 @@ -23,6 +24,8 @@ table ip ipfilter { tcp dport {80,443} iif $lanif accept # requête externe du serveur DNS ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + # requête DNS depuis la dmz + udp dport 53 iif $dmzif accept # Pings icmp type echo-request iif $lanif accept icmp type echo-reply iif {$lanif, $dmzif} accept @@ -33,6 +36,8 @@ table ip ipfilter { ct state established,related accept # SSH tcp dport 22 accept + # requête DNS depuis la dmz + udp dport 53 accept # Pings icmp type echo-request iif $lanif accept icmp type echo-reply accept @@ -86,6 +91,8 @@ table ip ipfilter { tcp dport {20,21} accept # requête externe du serveur DNS ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + # requête DNS depuis la dmz + udp dport 53 oif $dmzif accept # Pings icmp type echo-request oif {$lanif, $dmzif} accept icmp type echo-reply oif $lanif accept @@ -99,3 +106,4 @@ table ip ipfilter { ip saddr $lan-ntw oif $netif snat $netip } } +# pas fini \ No newline at end of file diff --git a/sisr1/tp06-firewall/fw_part7.nft b/sisr1/tp06-firewall/fw_part7.nft new file mode 100644 index 0000000..bf91c3f --- /dev/null +++ b/sisr1/tp06-firewall/fw_part7.nft @@ -0,0 +1,104 @@ +define netif = enp0s3 +define lanif = enp0s8 +define dmzif = enp0s9 + +define netip = 192.168.0.140 +define iplan = 172.16.0.254 +define ipdmz = 172.17.0.254 + +define lan-ntw = 172.16.0.1-172.16.0.254 +define dmz-ntw = 172.17.0.1-172.17.0.254 + +define internal-dns-ip = 172.16.0.2 +define dns-forwarder-ip = 10.121.38.7 +define srv-web-ip = 172.17.0.1 + +table ip ipfilter { + chain prerouting { + type filter hook prerouting priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp dport 22 accept + # requête HTTP et HTTPS depuis LAN + tcp dport {80,443} iif $lanif accept + # requête externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + # Pings + icmp type echo-request iif $lanif accept + icmp type echo-reply iif {$lanif, $dmzif} accept + } + chain system_in { + type filter hook input priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp dport 22 accept + # Pings + icmp type echo-request iif $lanif accept + icmp type echo-reply accept + } + chain routing { + type filter hook forward priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # requête DNS (UDP et TCP) + udp dport 53 accept + # requête HTTP et HTTPS depuis LAN + tcp dport {80,443} iif $lanif accept + # requête externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + # Pings + icmp type echo-request iif $lanif oif $dmzif accept + icmp type echo-reply iif $dmzif oif $lanif accept + } + chain system_out { + type filter hook output priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp sport 22 accept + # Proxy + tcp dport 8080 accept + # requête DNS (UDP et TCP) + udp dport 53 accept + # requête HTTP, HTTPS + tcp dport {80,443} accept + # requête FTP + tcp dport {20,21} accept + # Pings + icmp type echo-request accept + icmp type echo-reply oif $lanif accept + + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + # Communication déjà établies + ct state established,related accept + # SSH + tcp sport 22 accept + # Proxy + tcp dport 8080 accept + # requête DNS (UDP et TCP) + udp dport 53 accept + # requête HTTP, HTTPS + tcp dport {80,443} accept + # requête FTP + tcp dport {20,21} accept + # requête externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + # Pings + icmp type echo-request oif {$lanif, $dmzif} accept + icmp type echo-reply oif $lanif accept + } + chain nat_prerouting { + type nat hook prerouting priority filter; policy accept; + + ip daddr $netif tcp dport {80,443} dnat to $srv-web-ip + ip daddr $netif tcp dport 2222 dnat to $srv-web-ip:22 + } + chain nat_postrouting { + type nat hook postrouting priority filter; policy accept; + ip saddr $lan-ntw oif $netif snat $netip + } +}