jeremy.thomas/siotp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Modif de la partie 5 qui était la 6 et Ajout de la partie 7

Browse Source
This commit is contained in:
jeremy.thomas
2025-04-17 14:54:57 +02:00
parent 366716ebf2
commit 8913ea1325
4 changed files with 131 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
sisr1/tp06-firewall/fw_part5.nft
View File

@@ -9,6 +9,9 @@ define ipdmz = 172.17.0.254
define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254
define internal-dns-ip = 172.16.0.2
define dns-forwarder-ip = 10.121.38.7
table ip ipfilter {
chain prerouting {
type filter hook prerouting priority filter; policy drop;
@@ -18,6 +21,8 @@ table ip ipfilter {
tcp dport 22 accept
# requête HTTP et HTTPS depuis LAN
tcp dport {80,443} iif $lanif accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings
icmp type echo-request iif $lanif accept
icmp type echo-reply iif {$lanif, $dmzif} accept
@@ -36,14 +41,19 @@ table ip ipfilter {
type filter hook forward priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP et HTTPS depuis LAN
tcp dport {80,443} iif $lanif accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings
icmp type echo-request iif $lanif oif $dmzif accept
icmp type echo-reply iif $dmzif oif $lanif accept
}
chain system_out {
type filter hook output priority filter; policy drop;
type filter hook output priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# SSH
tcp sport 22 accept
@@ -61,7 +71,8 @@ table ip ipfilter {
}
chain postrouting {
type filter hook postrouting priority filter; policy drop;
type filter hook postrouting priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# SSH
tcp sport 22 accept
@@ -73,6 +84,8 @@ table ip ipfilter {
tcp dport {80,443} accept
# requête FTP
tcp dport {20,21} accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings
icmp type echo-request oif {$lanif, $dmzif} accept
icmp type echo-reply oif $lanif accept