louis.depres/gsb2023
1
0
Fork 0
Code Pull Requests Activity

modification

Browse Source
This commit is contained in:
Johan Largy
2023-04-03 11:04:13 +02:00
parent 33a9c5e8f6
commit 0624f3da72
3 changed files with 3 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
roles/fw-ferm/files/ferm-vp1.conf
View File

@@ -1,47 +0,0 @@
# -*- shell-script -*-
@def $DEV_VPN= wg0;
table filter {
chain INPUT {
policy DROP;
# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
# allow local connections
interface lo ACCEPT;
interface $DEV_VPN{
# respond to ping
proto icmp icmp-type echo-request ACCEPT;
# disallow ssh
saddr proto tcp dport ssh DROP;
}
}#FIN INPUT
# outgoing connections are not limited
chain OUTPUT {
policy ACCEPT;
interface $DEV_VPN{
# allow ssh
daddr proto tcp dport ssh ACCEPT;
# respond to ping
proto icmp icmp-type echo-request ACCEPT;
}
}#FIN OUTPUT
chain FORWARD {
policy ACCEPT;
# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
# connections from the internal net to the internet or to other
# internal nets are allowed
interface $DEV_VPN ACCEPT;
# the rest is dropped by the above policy
}#FIN FO
}

10
roles/fw-ferm/files/ferm.conf.r-vp1
View File

@@ -50,15 +50,7 @@ table filter {
chain FORWARD {
policy ACCEPT;
interface $DEV_VPN{
# respond to ping
proto icmp icmp-type echo-request ACCEPT;
# disallow ssh
saddr($DEV_VPN) proto tcp dport ssh DROP;
# allow ssh
daddr($DEV_VPN) proto tcp dport ssh ACCEPT;
proto icmp icmp-type echo-request ACCEPT;
}
# connection tracking
mod state state INVALID DROP;