louis.depres/gsb2023
1
0
Fork 0
Code Pull Requests Activity

fw filtrage interne ok

Browse Source
This commit is contained in:
root
2023-04-05 10:44:58 +02:00
parent 99ed9d3b27
commit cf6f6096d6
3 changed files with 8 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
roles/fw-ferm/files/ferm.conf.r-vp2
View File

@@ -27,19 +27,15 @@ table filter {
# allow SSH connections from the private network and from some
# well-known internet hosts
saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT;
saddr ($NET_PRIVATE) proto tcp dport ssh ACCEPT;
# we provide DNS and SMTP services for the internal net
interface $DEV_PRIVATE saddr $NET_PRIVATE {
proto (udp tcp) dport domain ACCEPT;
proto udp dport bootps ACCEPT;
}
interface $DEV_VPN{
# respond to ping
proto icmp icmp-type echo-request ACCEPT;
# disallow ssh
saddr proto tcp dport ssh ACCEPT;
}
# interface réseau
interface $DEV_WORLD {
@@ -49,13 +45,8 @@ table filter {
}#FIN INPUT
# outgoing connections are not limited
chain OUTPUT {policy ACCEPT;
interface $DEV_VPN{
# allow ssh
daddr proto tcp dport ssh DROP;
# respond to ping
proto icmp icmp-type echo-request ACCEPT;
}
chain OUTPUT {
policy ACCEPT;
}
chain FORWARD {
policy ACCEPT;
@@ -68,6 +59,9 @@ table filter {
# internal nets are allowed
interface $DEV_PRIVATE ACCEPT;
interface $DEV_VPN daddr $NET_PRIVATE {
proto tcp dport ssh DROP;
}
# the rest is dropped by the above policy
}
}