louis.depres/gsb2023
1
0
Fork 0
Code Pull Requests Activity

incrémentation des modif

Browse Source
This commit is contained in:
Johan Largy 2023-02-03 09:37:13 +01:00
parent 851543db0a
commit 75126890b3
3 changed files with 40 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
roles/fw-ferm/files/ferm2.conf → roles/fw-ferm/files/ferm-vp1.conf
View File

@ -1,3 +1,5 @@
# -*- shell-script -*-
@def $DEV_VPN= wg0; @def $DEV_VPN= wg0;
table filter { table filter {
@ -10,22 +12,23 @@ table filter {
# allow local connections # allow local connections
interface lo ACCEPT; interface lo ACCEPT;
interface $DEV_VPN{
# respond to ping # respond to ping
proto icmp icmp-type echo-request ACCEPT; proto icmp icmp-type echo-request ACCEPT;
# disallow ssh # disallow ssh
proto tcp dport ssh ACCEPT; saddr proto tcp dport ssh DROP;
}
}#FIN INPUT }#FIN INPUT
# outgoing connections are not limited # outgoing connections are not limited
chain OUTPUT { chain OUTPUT {
policy ACCEPT; policy ACCEPT;
interface $DEV_VPN{
# allow ssh # allow ssh
proto tcp dport ssh DROP; daddr proto tcp dport ssh ACCEPT;
# respond to ping # respond to ping
proto icmp icmp-type echo-request ACCEPT; proto icmp icmp-type echo-request ACCEPT;
}
}#FIN OUTPUT }#FIN OUTPUT
chain FORWARD { chain FORWARD {

21
roles/fw-ferm/files/ferm.conf.r-vp1
View File

@ -4,7 +4,7 @@
@def $DEV_PRIVATE = enp0s8; @def $DEV_PRIVATE = enp0s8;
@def $DEV_WORLD = enp0s9; @def $DEV_WORLD = enp0s9;
@def $DEV_VPN= wg0;
@def $NET_PRIVATE = 172.16.0.0/24; @def $NET_PRIVATE = 172.16.0.0/24;
table filter { table filter {
@ -33,8 +33,15 @@ table filter {
# we provide DNS and SMTP services for the internal net # we provide DNS and SMTP services for the internal net
interface $DEV_PRIVATE saddr $NET_PRIVATE { interface $DEV_PRIVATE saddr $NET_PRIVATE {
proto (udp tcp) dport domain ACCEPT; proto (udp tcp) dport domain ACCEPT;
proto udp dport bootps ACCEPT; proto udp dport bootps ACCEPT;
} }
interface $DEV_VPN{
# respond to ping
proto icmp icmp-type echo-request ACCEPT;
# disallow ssh
saddr proto tcp dport ssh DROP;
}
# interface réseau # interface réseau
interface $DEV_WORLD { interface $DEV_WORLD {
@ -45,8 +52,14 @@ table filter {
}#FIN INPUT }#FIN INPUT
# outgoing connections are not limited # outgoing connections are not limited
chain OUTPUT policy ACCEPT; chain OUTPUT {policy ACCEPT;
interface $DEV_VPN{
# allow ssh
daddr proto tcp dport ssh ACCEPT;
# respond to ping
proto icmp icmp-type echo-request ACCEPT;
}
}#FIN OUTPUT
chain FORWARD { chain FORWARD {
policy ACCEPT; policy ACCEPT;

19
roles/fw-ferm/files/ferm.conf.r-vp2
View File

@ -4,7 +4,7 @@
@def $DEV_PRIVATE = enp0s9; @def $DEV_PRIVATE = enp0s9;
@def $DEV_WORLD = enp0s8; @def $DEV_WORLD = enp0s8;
@def $DEV_VPN= wg0;
@def $NET_PRIVATE = 172.16.0.0/24; @def $NET_PRIVATE = 172.16.0.0/24;
table filter { table filter {
@ -34,7 +34,12 @@ table filter {
proto (udp tcp) dport domain ACCEPT; proto (udp tcp) dport domain ACCEPT;
proto udp dport bootps ACCEPT; proto udp dport bootps ACCEPT;
} }
interface $DEV_VPN{
# respond to ping
proto icmp icmp-type echo-request ACCEPT;
# disallow ssh
saddr proto tcp dport ssh ACCEPT;
}
# interface réseau # interface réseau
interface $DEV_WORLD { interface $DEV_WORLD {
@ -44,8 +49,14 @@ table filter {
}#FIN INPUT }#FIN INPUT
# outgoing connections are not limited # outgoing connections are not limited
chain OUTPUT policy ACCEPT; chain OUTPUT {policy ACCEPT;
interface $DEV_VPN{
# allow ssh
daddr proto tcp dport ssh DROP;
# respond to ping
proto icmp icmp-type echo-request ACCEPT;
}
}
chain FORWARD { chain FORWARD {
policy ACCEPT; policy ACCEPT;