jeremy.thomas/siotp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Modif de la partie 5 qui était la 6 et Ajout de la partie 7

Browse Source
This commit is contained in:
jeremy.thomas 2025-04-17 14:54:57 +02:00
parent 366716ebf2
commit 8913ea1325
4 changed files with 131 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sisr1/tp06-firewall/current_ruleset.nft
View File

@ -11,6 +11,7 @@ define dmz-ntw = 172.17.0.1-172.17.0.254
define internal-dns-ip = 172.16.0.2 define internal-dns-ip = 172.16.0.2
define dns-forwarder-ip = 10.121.38.7 define dns-forwarder-ip = 10.121.38.7
define srv-web-ip = 172.17.0.1
table ip ipfilter { table ip ipfilter {
chain prerouting { chain prerouting {
@ -92,7 +93,9 @@ table ip ipfilter {
} }
chain nat_prerouting { chain nat_prerouting {
type nat hook prerouting priority filter; policy accept; type nat hook prerouting priority filter; policy accept;
ip daddr $netif tcp dport {80,443} dnat to $srv-web-ip
ip daddr $netif tcp dport 2222 dnat to $srv-web-ip:22
} }
chain nat_postrouting { chain nat_postrouting {
type nat hook postrouting priority filter; policy accept; type nat hook postrouting priority filter; policy accept;

17
sisr1/tp06-firewall/fw_part5.nft
View File

@ -9,6 +9,9 @@ define ipdmz = 172.17.0.254
define lan-ntw = 172.16.0.1-172.16.0.254 define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254 define dmz-ntw = 172.17.0.1-172.17.0.254
define internal-dns-ip = 172.16.0.2
define dns-forwarder-ip = 10.121.38.7
table ip ipfilter { table ip ipfilter {
chain prerouting { chain prerouting {
type filter hook prerouting priority filter; policy drop; type filter hook prerouting priority filter; policy drop;
@ -18,6 +21,8 @@ table ip ipfilter {
tcp dport 22 accept tcp dport 22 accept
# requête HTTP et HTTPS depuis LAN # requête HTTP et HTTPS depuis LAN
tcp dport {80,443} iif $lanif accept tcp dport {80,443} iif $lanif accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings # Pings
icmp type echo-request iif $lanif accept icmp type echo-request iif $lanif accept
icmp type echo-reply iif {$lanif, $dmzif} accept icmp type echo-reply iif {$lanif, $dmzif} accept
@ -36,14 +41,19 @@ table ip ipfilter {
type filter hook forward priority filter; policy drop; type filter hook forward priority filter; policy drop;
# Communication déjà établies # Communication déjà établies
ct state established,related accept ct state established,related accept
# requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP et HTTPS depuis LAN # requête HTTP et HTTPS depuis LAN
tcp dport {80,443} iif $lanif accept tcp dport {80,443} iif $lanif accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings # Pings
icmp type echo-request iif $lanif oif $dmzif accept icmp type echo-request iif $lanif oif $dmzif accept
icmp type echo-reply iif $dmzif oif $lanif accept icmp type echo-reply iif $dmzif oif $lanif accept
} }
chain system_out { chain system_out {
type filter hook output priority filter; policy drop; type filter hook output priority filter; policy drop;
# Communication déjà établies
ct state established,related accept ct state established,related accept
# SSH # SSH
tcp sport 22 accept tcp sport 22 accept
@ -61,7 +71,8 @@ table ip ipfilter {
} }
chain postrouting { chain postrouting {
type filter hook postrouting priority filter; policy drop; type filter hook postrouting priority filter; policy drop;
# Communication déjà établies
ct state established,related accept ct state established,related accept
# SSH # SSH
tcp sport 22 accept tcp sport 22 accept
@ -73,6 +84,8 @@ table ip ipfilter {
tcp dport {80,443} accept tcp dport {80,443} accept
# requête FTP # requête FTP
tcp dport {20,21} accept tcp dport {20,21} accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings # Pings
icmp type echo-request oif {$lanif, $dmzif} accept icmp type echo-request oif {$lanif, $dmzif} accept
icmp type echo-reply oif $lanif accept icmp type echo-reply oif $lanif accept

8
sisr1/tp06-firewall/fw_part6.nft
View File

@ -5,6 +5,7 @@ define dmzif = enp0s9
define netip = 192.168.0.140 define netip = 192.168.0.140
define iplan = 172.16.0.254 define iplan = 172.16.0.254
define ipdmz = 172.17.0.254 define ipdmz = 172.17.0.254
define dnsip = 172.16.0.2
define lan-ntw = 172.16.0.1-172.16.0.254 define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254 define dmz-ntw = 172.17.0.1-172.17.0.254
@ -23,6 +24,8 @@ table ip ipfilter {
tcp dport {80,443} iif $lanif accept tcp dport {80,443} iif $lanif accept
# requête externe du serveur DNS # requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# requête DNS depuis la dmz
udp dport 53 iif $dmzif accept
# Pings # Pings
icmp type echo-request iif $lanif accept icmp type echo-request iif $lanif accept
icmp type echo-reply iif {$lanif, $dmzif} accept icmp type echo-reply iif {$lanif, $dmzif} accept
@ -33,6 +36,8 @@ table ip ipfilter {
ct state established,related accept ct state established,related accept
# SSH # SSH
tcp dport 22 accept tcp dport 22 accept
# requête DNS depuis la dmz
udp dport 53 accept
# Pings # Pings
icmp type echo-request iif $lanif accept icmp type echo-request iif $lanif accept
icmp type echo-reply accept icmp type echo-reply accept
@ -86,6 +91,8 @@ table ip ipfilter {
tcp dport {20,21} accept tcp dport {20,21} accept
# requête externe du serveur DNS # requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# requête DNS depuis la dmz
udp dport 53 oif $dmzif accept
# Pings # Pings
icmp type echo-request oif {$lanif, $dmzif} accept icmp type echo-request oif {$lanif, $dmzif} accept
icmp type echo-reply oif $lanif accept icmp type echo-reply oif $lanif accept
@ -99,3 +106,4 @@ table ip ipfilter {
ip saddr $lan-ntw oif $netif snat $netip ip saddr $lan-ntw oif $netif snat $netip
} }
} }
# pas fini

104
sisr1/tp06-firewall/fw_part7.nft Normal file
View File

@ -0,0 +1,104 @@
define netif = enp0s3
define lanif = enp0s8
define dmzif = enp0s9
define netip = 192.168.0.140
define iplan = 172.16.0.254
define ipdmz = 172.17.0.254
define lan-ntw = 172.16.0.1-172.16.0.254
define dmz-ntw = 172.17.0.1-172.17.0.254
define internal-dns-ip = 172.16.0.2
define dns-forwarder-ip = 10.121.38.7
define srv-web-ip = 172.17.0.1
table ip ipfilter {
chain prerouting {
type filter hook prerouting priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# SSH
tcp dport 22 accept
# requête HTTP et HTTPS depuis LAN
tcp dport {80,443} iif $lanif accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings
icmp type echo-request iif $lanif accept
icmp type echo-reply iif {$lanif, $dmzif} accept
}
chain system_in {
type filter hook input priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# SSH
tcp dport 22 accept
# Pings
icmp type echo-request iif $lanif accept
icmp type echo-reply accept
}
chain routing {
type filter hook forward priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP et HTTPS depuis LAN
tcp dport {80,443} iif $lanif accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings
icmp type echo-request iif $lanif oif $dmzif accept
icmp type echo-reply iif $dmzif oif $lanif accept
}
chain system_out {
type filter hook output priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# SSH
tcp sport 22 accept
# Proxy
tcp dport 8080 accept
# requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP, HTTPS
tcp dport {80,443} accept
# requête FTP
tcp dport {20,21} accept
# Pings
icmp type echo-request accept
icmp type echo-reply oif $lanif accept
}
chain postrouting {
type filter hook postrouting priority filter; policy drop;
# Communication déjà établies
ct state established,related accept
# SSH
tcp sport 22 accept
# Proxy
tcp dport 8080 accept
# requête DNS (UDP et TCP)
udp dport 53 accept
# requête HTTP, HTTPS
tcp dport {80,443} accept
# requête FTP
tcp dport {20,21} accept
# requête externe du serveur DNS
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
# Pings
icmp type echo-request oif {$lanif, $dmzif} accept
icmp type echo-reply oif $lanif accept
}
chain nat_prerouting {
type nat hook prerouting priority filter; policy accept;
ip daddr $netif tcp dport {80,443} dnat to $srv-web-ip
ip daddr $netif tcp dport 2222 dnat to $srv-web-ip:22
}
chain nat_postrouting {
type nat hook postrouting priority filter; policy accept;
ip saddr $lan-ntw oif $netif snat $netip
}
}