supprimé : siotp/README.md
supprimé : siotp/automate.sh renommé : siotp/sisr1/README.md -> sisr1/README.md supprimé : sisr1/srv-dhcp/dhcpd.conf supprimé : sisr1/srv-dhcp/interfaces supprimé : sisr1/srv-dhcp/isc-dhcp-server supprimé : sisr1/srv-dhcp/nat.sh supprimé : sisr1/srv-dns1/db.sio1lab.lan supprimé : sisr1/srv-dns1/db.sio1lab.lan.rev supprimé : sisr1/srv-dns1/interfaces supprimé : sisr1/srv-dns1/named.conf.local supprimé : sisr1/srv-dns1/named.conf.options supprimé : sisr1/srv-dns1/resolv.conf supprimé : sisr1/srv-dns1/sshd_config supprimé : sisr1/srv-dns2/db.sio1lab.lan supprimé : sisr1/srv-dns2/db.sio1lab.lan.rev supprimé : sisr1/srv-dns2/interfaces supprimé : sisr1/srv-dns2/named.conf.local supprimé : sisr1/srv-dns2/named.conf.options supprimé : sisr1/srv-dns2/resolv.conf renommé : siotp/sisr1/tp01-02/README.md -> sisr1/tp01-02/README.md renommé : siotp/sisr1/tp01-02/files_dhcp/README.md -> sisr1/tp01-02/files_dhcp/README.md renommé : siotp/sisr1/tp01-02/files_dhcp/dhcpd.conf -> sisr1/tp01-02/files_dhcp/dhcpd.conf renommé : siotp/sisr1/tp01-02/files_dhcp/hosts -> sisr1/tp01-02/files_dhcp/hosts renommé : siotp/sisr1/tp01-02/files_dhcp/interfaces -> sisr1/tp01-02/files_dhcp/interfaces renommé : siotp/sisr1/tp01-02/files_dhcp/isc-dhcp-server -> sisr1/tp01-02/files_dhcp/isc-dhcp-server renommé : siotp/sisr1/tp01-02/files_dhcp/nat.sh -> sisr1/tp01-02/files_dhcp/nat.sh renommé : siotp/sisr1/tp01-02/files_dns1/README.md -> sisr1/tp01-02/files_dns1/README.md renommé : siotp/sisr1/tp01-02/files_dns1/db.sio1lab.lan -> sisr1/tp01-02/files_dns1/db.sio1lab.lan renommé : siotp/sisr1/tp01-02/files_dns1/db.sio1lab.lan.rev -> sisr1/tp01-02/files_dns1/db.sio1lab.lan.rev renommé : siotp/sisr1/tp01-02/files_dns1/hosts -> sisr1/tp01-02/files_dns1/hosts renommé : siotp/sisr1/tp01-02/files_dns1/interfaces -> sisr1/tp01-02/files_dns1/interfaces renommé : siotp/sisr1/tp01-02/files_dns1/named.conf.local -> sisr1/tp01-02/files_dns1/named.conf.local renommé : siotp/sisr1/tp01-02/files_dns1/named.conf.options -> sisr1/tp01-02/files_dns1/named.conf.options renommé : siotp/sisr1/tp01-02/files_dns1/resolv.conf -> sisr1/tp01-02/files_dns1/resolv.conf renommé : siotp/sisr1/tp01-02/files_dns2/README.md -> sisr1/tp01-02/files_dns2/README.md renommé : siotp/sisr1/tp01-02/files_dns2/db.sio1lab.lan -> sisr1/tp01-02/files_dns2/db.sio1lab.lan renommé : siotp/sisr1/tp01-02/files_dns2/db.sio1lab.lan.rev -> sisr1/tp01-02/files_dns2/db.sio1lab.lan.rev renommé : siotp/sisr1/tp01-02/files_dns2/hosts -> sisr1/tp01-02/files_dns2/hosts renommé : siotp/sisr1/tp01-02/files_dns2/interfaces -> sisr1/tp01-02/files_dns2/interfaces renommé : siotp/sisr1/tp01-02/files_dns2/named.conf.local -> sisr1/tp01-02/files_dns2/named.conf.local renommé : siotp/sisr1/tp01-02/files_dns2/named.conf.options -> sisr1/tp01-02/files_dns2/named.conf.options renommé : siotp/sisr1/tp01-02/files_dns2/resolv.conf -> sisr1/tp01-02/files_dns2/resolv.conf renommé : siotp/sisr1/tp03/README.md -> sisr1/tp03/README.md renommé : siotp/sisr1/tp03/files_admin/README.md -> sisr1/tp03/files_admin/README.md renommé : siotp/sisr1/tp03/files_admin/hostname -> sisr1/tp03/files_admin/hostname renommé : siotp/sisr1/tp03/files_admin/hosts -> sisr1/tp03/files_admin/hosts renommé : siotp/sisr1/tp03/files_admin/interfaces -> sisr1/tp03/files_admin/interfaces renommé : siotp/sisr1/tp03/files_admin/nat.sh -> sisr1/tp03/files_admin/nat.sh renommé : siotp/sisr1/tp03/files_admin/resolv.conf -> sisr1/tp03/files_admin/resolv.conf renommé : siotp/sisr1/tp03/files_dns2/README.md -> sisr1/tp03/files_dns2/README.md renommé : siotp/sisr1/tp03/files_dns2/db.monlabo.lan -> sisr1/tp03/files_dns2/db.monlabo.lan renommé : siotp/sisr1/tp03/files_dns2/db.monlabo.lan.rev -> sisr1/tp03/files_dns2/db.monlabo.lan.rev renommé : siotp/sisr1/tp03/files_dns2/hostname -> sisr1/tp03/files_dns2/hostname renommé : siotp/sisr1/tp03/files_dns2/hosts -> sisr1/tp03/files_dns2/hosts renommé : siotp/sisr1/tp03/files_dns2/named.conf -> sisr1/tp03/files_dns2/named.conf renommé : siotp/sisr1/tp03/files_dns2/named.conf.local -> sisr1/tp03/files_dns2/named.conf.local renommé : siotp/sisr1/tp03/files_dns2/named.conf.options -> sisr1/tp03/files_dns2/named.conf.options renommé : siotp/sisr1/tp03/files_dns2/resolv.conf -> sisr1/tp03/files_dns2/resolv.conf renommé : siotp/sisr1/tp03/files_service/README.md -> sisr1/tp03/files_service/README.md renommé : siotp/sisr1/tp03/files_service/db.monlabo.lan -> sisr1/tp03/files_service/db.monlabo.lan renommé : siotp/sisr1/tp03/files_service/db.monlabo.lan.rev -> sisr1/tp03/files_service/db.monlabo.lan.rev renommé : siotp/sisr1/tp03/files_service/dhclient.conf -> sisr1/tp03/files_service/dhclient.conf renommé : siotp/sisr1/tp03/files_service/dhcpd.conf -> sisr1/tp03/files_service/dhcpd.conf renommé : siotp/sisr1/tp03/files_service/hostname -> sisr1/tp03/files_service/hostname renommé : siotp/sisr1/tp03/files_service/hosts -> sisr1/tp03/files_service/hosts renommé : siotp/sisr1/tp03/files_service/interfaces -> sisr1/tp03/files_service/interfaces renommé : siotp/sisr1/tp03/files_service/isc-dhcp-server -> sisr1/tp03/files_service/isc-dhcp-server renommé : siotp/sisr1/tp03/files_service/named.conf -> sisr1/tp03/files_service/named.conf renommé : siotp/sisr1/tp03/files_service/named.conf.local -> sisr1/tp03/files_service/named.conf.local renommé : siotp/sisr1/tp03/files_service/named.conf.options -> sisr1/tp03/files_service/named.conf.options renommé : siotp/sisr1/tp03/files_service/resolv.conf -> sisr1/tp03/files_service/resolv.conf renommé : siotp/sisr1/tp04/README.md -> sisr1/tp04/README.md renommé : siotp/sisr1/tp04/auto_nat/README.md -> sisr1/tp04/auto_nat/README.md renommé : siotp/sisr1/tp04/auto_nat/nat.service -> sisr1/tp04/auto_nat/nat.service renommé : siotp/sisr1/tp04/scripts_and_files/README.md -> sisr1/tp04/scripts_and_files/README.md renommé : siotp/sisr1/tp04/scripts_and_files/Users.csv -> sisr1/tp04/scripts_and_files/Users.csv renommé : siotp/sisr1/tp04/scripts_and_files/createLogins.sh -> sisr1/tp04/scripts_and_files/createLogins.sh renommé : siotp/sisr1/tp04/scripts_and_files/createUsers.sh -> sisr1/tp04/scripts_and_files/createUsers.sh renommé : siotp/sisr1/tp04/scripts_and_files/logins.csv -> sisr1/tp04/scripts_and_files/logins.csv renommé : siotp/sisr1/tp04/scripts_and_files/remoteCreation.sh -> sisr1/tp04/scripts_and_files/remoteCreation.sh renommé : siotp/sisr1/tp05/README.md -> sisr1/tp05/README.md renommé : siotp/sisr1/tp05/deployment_samba.sh -> sisr1/tp05/deployment_samba.sh renommé : siotp/sisr1/tp05/smb.conf -> sisr1/tp05/smb.conf renommé : siotp/sisr1/tp06/README.md -> sisr1/tp06/README.md renommé : siotp/sisr1/tp06/files_admin/README.md -> sisr1/tp06/files_admin/README.md renommé : siotp/sisr1/tp06/files_admin/dnsfwd.service -> sisr1/tp06/files_admin/dnsfwd.service renommé : siotp/sisr1/tp06/files_admin/dnsfwd.sh -> sisr1/tp06/files_admin/dnsfwd.sh renommé : siotp/sisr1/tp06/files_admin/squid_v1.conf -> sisr1/tp06/files_admin/squid_v1.conf renommé : siotp/sisr1/tp06/files_admin/squid_v2.conf -> sisr1/tp06/files_admin/squid_v2.conf renommé : siotp/sisr1/tp06/files_admin/squid_v3.conf -> sisr1/tp06/files_admin/squid_v3.conf renommé : siotp/sisr1/tp06/files_admin/squid_v4.conf -> sisr1/tp06/files_admin/squid_v4.conf renommé : siotp/sisr1/tp06/files_admin/squid_v5_auth.conf -> sisr1/tp06/files_admin/squid_v5_auth.conf renommé : siotp/sisr1/tp07/files_firewall/current_ruleset_partie_1.nft -> sisr1/tp07/files_firewall/current_ruleset_partie_1.nft renommé : siotp/sisr1/tp07/files_firewall/current_ruleset_partie_2.nft -> sisr1/tp07/files_firewall/current_ruleset_partie_2.nft renommé : siotp/sisr1/tp07/files_firewall/current_ruleset_partie_3.nft -> sisr1/tp07/files_firewall/current_ruleset_partie_3.nft renommé : siotp/sisr1/tp07/files_firewall/current_ruleset_partie_4.nft -> sisr1/tp07/files_firewall/current_ruleset_partie_4.nft renommé : siotp/sisr1/tp07/files_firewall/interfaces -> sisr1/tp07/files_firewall/interfaces renommé : siotp/sisr1/tp07/files_firewall/proxy.conf -> sisr1/tp07/files_firewall/proxy.conf renommé : siotp/sisr1/tp07/files_firewall/refresh_firewall.sh -> sisr1/tp07/files_firewall/refresh_firewall.sh renommé : siotp/sisr1/tp07/files_firewall/resolv.conf -> sisr1/tp07/files_firewall/resolv.conf renommé : siotp/sisr1/tp07/files_pclan/interfaces -> sisr1/tp07/files_pclan/interfaces renommé : siotp/sisr1/tp07/files_pclan/resolv.conf -> sisr1/tp07/files_pclan/resolv.conf renommé : siotp/sisr1/tp07/files_pcnet/interfaces -> sisr1/tp07/files_pcnet/interfaces renommé : siotp/sisr1/tp07/files_pcnet/resolv.conf -> sisr1/tp07/files_pcnet/resolv.conf renommé : siotp/sisr1/tp07/files_srvweb/interfaces -> sisr1/tp07/files_srvweb/interfaces renommé : siotp/sisr1/tp07/files_srvweb/resolv.conf -> sisr1/tp07/files_srvweb/resolv.conf
This commit is contained in:
Jibril Bouhbas
17
sisr1/tp07/files_firewall/current_ruleset_partie_1.nft
Normal file
17
sisr1/tp07/files_firewall/current_ruleset_partie_1.nft
Normal file
@@ -0,0 +1,17 @@
|
||||
define netif = enp0s3
|
||||
define dmzif = enp0s8
|
||||
define lanif = enp0s9
|
||||
|
||||
table ip ipfilter {
|
||||
chain routing {
|
||||
type filter hook forward priority filter; policy accept;
|
||||
icmp type echo-request iif { $netif, $dmzif } drop
|
||||
icmp type { echo-reply, echo-request } accept
|
||||
drop
|
||||
}
|
||||
|
||||
chain system_in {
|
||||
type filter hook input priority filter; policy accept;
|
||||
icmp type echo-request iif { $netif, $dmzif } drop
|
||||
}
|
||||
}
|
||||
25
sisr1/tp07/files_firewall/current_ruleset_partie_2.nft
Normal file
25
sisr1/tp07/files_firewall/current_ruleset_partie_2.nft
Normal file
@@ -0,0 +1,25 @@
|
||||
define netif = enp0s3
|
||||
define dmzif = enp0s8
|
||||
define lanif = enp0s9
|
||||
|
||||
table ip ipfilter{
|
||||
chain prerouting {
|
||||
type filter hook prerouting priority filter; policy drop;
|
||||
tcp dport 22 accept
|
||||
}
|
||||
chain system_in {
|
||||
type filter hook input priority filter; policy drop;
|
||||
tcp dport 22 accept
|
||||
}
|
||||
chain routing {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
}
|
||||
chain system_out {
|
||||
type filter hook output priority filter; policy drop;
|
||||
tcp sport 22 accept
|
||||
}
|
||||
chain postrouting {
|
||||
type filter hook postrouting priority filter; policy drop;
|
||||
tcp sport 22 accept
|
||||
}
|
||||
}
|
||||
42
sisr1/tp07/files_firewall/current_ruleset_partie_3.nft
Normal file
42
sisr1/tp07/files_firewall/current_ruleset_partie_3.nft
Normal file
@@ -0,0 +1,42 @@
|
||||
define netif = enp0s3
|
||||
define dmzif = enp0s8
|
||||
define lanif = enp0s9
|
||||
|
||||
define firewall = 192.168.0.120
|
||||
define ipdmz = 172.16.0.254
|
||||
define iplan = 10.0.0.254
|
||||
|
||||
table ip ipfilter{
|
||||
chain prerouting {
|
||||
type filter hook prerouting priority filter; policy drop;
|
||||
icmp type echo-reply accept
|
||||
icmp type echo-request iif {$lanif} ip daddr 172.16.0.1-172.16.0.254 accept
|
||||
icmp type echo-request iif {$lanif} ip daddr {$iplan} accept
|
||||
tcp dport 22 accept
|
||||
}
|
||||
chain system_in {
|
||||
type filter hook input priority filter; policy drop;
|
||||
icmp type echo-reply accept
|
||||
icmp type echo-request iif {$lanif} accept
|
||||
tcp dport 22 accept
|
||||
}
|
||||
chain routing {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
icmp type echo-request iif {$lanif} oif {$dmzif} accept
|
||||
icmp type echo-reply iif {$dmzif} oif {$lanif} accept
|
||||
}
|
||||
chain system_out {
|
||||
type filter hook output priority filter; policy drop;
|
||||
icmp type echo-reply oif {$lanif} accept
|
||||
icmp type echo-request accept
|
||||
tcp sport 22 accept
|
||||
}
|
||||
chain postrouting {
|
||||
type filter hook postrouting priority filter; policy drop;
|
||||
icmp type echo-request ip saddr {$iplan, $ipdmz, $firewall} accept
|
||||
icmp type echo-reply iif {$dmzif} oif {$lanif} accept
|
||||
icmp type echo-request iif {$lanif} oif {$dmzif} accept
|
||||
icmp type echo-request ip saddr $iplan oif $lanif accept
|
||||
tcp sport 22 accept
|
||||
}
|
||||
}
|
||||
68
sisr1/tp07/files_firewall/current_ruleset_partie_4.nft
Normal file
68
sisr1/tp07/files_firewall/current_ruleset_partie_4.nft
Normal file
@@ -0,0 +1,68 @@
|
||||
define netif = enp0s3
|
||||
define dmzif = enp0s8
|
||||
define lanif = enp0s9
|
||||
|
||||
define firewall = 192.168.0.120
|
||||
define ipdmz = 172.16.0.254
|
||||
define iplan = 10.0.0.254
|
||||
|
||||
table ip ipfilter{
|
||||
chain prerouting {
|
||||
type filter hook prerouting priority filter; policy drop;
|
||||
icmp type echo-reply accept
|
||||
ct state established, related accept
|
||||
icmp type echo-request iif {$lanif} ip daddr 172.16.0.1-172.16.0.254 accept
|
||||
icmp type echo-request iif {$lanif} ip daddr {$iplan} accept
|
||||
tcp dport 20 accept
|
||||
tcp dport 21 accept
|
||||
tcp dport {80, 443} accept
|
||||
tcp dport 22 accept
|
||||
ip saddr 10.121.38.1 tcp dport {80, 443} accept
|
||||
}
|
||||
chain system_in {
|
||||
type filter hook input priority filter; policy drop;
|
||||
icmp type echo-reply accept
|
||||
icmp type echo-request iif {$lanif} accept
|
||||
ct state established, related accept
|
||||
tcp dport 20 accept
|
||||
tcp dport 21 accept
|
||||
tcp dport {80, 443} accept
|
||||
tcp dport 22 accept
|
||||
ip saddr 10.121.38.1 tcp dport {80, 443} accept
|
||||
}
|
||||
chain routing {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
icmp type echo-request iif {$lanif} oif {$dmzif} accept
|
||||
icmp type echo-reply iif {$dmzif} oif {$lanif} accept
|
||||
}
|
||||
chain system_out {
|
||||
type filter hook output priority filter; policy drop;
|
||||
ip daddr 10.121.38.7-10.121.38.8 accept
|
||||
ip daddr 10.121.38.1 tcp dport 8080 accept
|
||||
icmp type echo-reply oif {$lanif} accept
|
||||
icmp type echo-request accept
|
||||
tcp dport 20 accept
|
||||
tcp sport 20 accept
|
||||
tcp dport 21 accept
|
||||
tcp sport 21 accept
|
||||
tcp dport {80, 443} accept
|
||||
tcp sport {80, 443} accept
|
||||
tcp sport 22 accept
|
||||
}
|
||||
chain postrouting {
|
||||
type filter hook postrouting priority filter; policy drop;
|
||||
ip daddr 10.121.38.7-10.121.38.8 accept
|
||||
ip daddr 10.121.38.1 tcp dport 8080 accept
|
||||
icmp type echo-request ip saddr {$iplan, $ipdmz, $firewall} accept
|
||||
icmp type echo-reply iif {$dmzif} oif {$lanif} accept
|
||||
icmp type echo-request iif {$lanif} oif {$dmzif} accept
|
||||
icmp type echo-request ip saddr $iplan oif $lanif accept
|
||||
tcp dport 20 accept
|
||||
tcp sport 20 accept
|
||||
tcp dport 21 accept
|
||||
tcp sport 21 accept
|
||||
tcp dport {80, 443} accept
|
||||
tcp sport {80, 443} accept
|
||||
tcp sport 22 accept
|
||||
}
|
||||
}
|
||||
25
sisr1/tp07/files_firewall/interfaces
Normal file
25
sisr1/tp07/files_firewall/interfaces
Normal file
@@ -0,0 +1,25 @@
|
||||
# This file describes the network interfaces available on your system
|
||||
# and how to activate them. For more information, see interfaces(5).
|
||||
|
||||
source /etc/network/interfaces.d/*
|
||||
|
||||
# The loopback network interface
|
||||
auto lo
|
||||
iface lo inet loopback
|
||||
|
||||
# The primary network interface
|
||||
allow-hotplug enp0s3
|
||||
iface enp0s3 inet static
|
||||
address 192.168.0.120
|
||||
gateway 192.168.0.1
|
||||
pre-up bash /root/scriptsnft/refresh_firewall.sh
|
||||
|
||||
# Second network interface : DMZ
|
||||
allow-hotplug enp0s8
|
||||
iface enp0s8 inet static
|
||||
address 172.16.0.254/24
|
||||
|
||||
# Third network interface : LAN
|
||||
allow-hotplug enp0s9
|
||||
iface enp0s9 inet static
|
||||
address 10.0.0.254/24
|
||||
3
sisr1/tp07/files_firewall/proxy.conf
Normal file
3
sisr1/tp07/files_firewall/proxy.conf
Normal file
@@ -0,0 +1,3 @@
|
||||
Acquire::http::Proxy "http://10.121.38.1:8080/";
|
||||
Acquire::https::Proxy "http://10.121.38.1:8080/";
|
||||
|
||||
7
sisr1/tp07/files_firewall/refresh_firewall.sh
Normal file
7
sisr1/tp07/files_firewall/refresh_firewall.sh
Normal file
@@ -0,0 +1,7 @@
|
||||
#!/bin/bash
|
||||
# active le routage entre les interfaces réseau du firewall
|
||||
echo "1" > /proc/sys/net/ipv4/ip_forward
|
||||
#vide les règles actuelles du pare-feu
|
||||
nft flush ruleset
|
||||
#charge les règles du pare-feu présentes dans le fichier
|
||||
nft -f /root/scriptsnft/current_ruleset.nft
|
||||
4
sisr1/tp07/files_firewall/resolv.conf
Normal file
4
sisr1/tp07/files_firewall/resolv.conf
Normal file
@@ -0,0 +1,4 @@
|
||||
domain sio.lan
|
||||
search sio.lan
|
||||
nameserver 10.121.38.7
|
||||
nameserver 10.121.38.8
|
||||
Reference in New Issue
Block a user