louis.depres/gsb2023
1
0
Fork 0
Code Pull Requests Activity

fw filtrage int ok

Browse Source
This commit is contained in:
root 2023-04-05 10:49:31 +02:00
parent cf6f6096d6
commit dd6d34986b
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
roles/fw-ferm/files/ferm.conf.r-vp1
View File

@ -4,10 +4,12 @@
@def $DEV_PRIVATE = enp0s8; @def $DEV_PRIVATE = enp0s8;
@def $DEV_WORLD = enp0s9; @def $DEV_WORLD = enp0s9;
@def $DEV_WORLD = enp0s9;
@def $DEV_VPN= wg0; @def $DEV_VPN= wg0;
@def $NET_PRIVATE = 172.16.0.0/24; @def $NET_PRIVATE = 172.16.0.0/24;
table filter { table filter {
chain (INPUT OUTPUT){ chain (INPUT OUTPUT){
# allow VPN # allow VPN
proto udp dport 51820 ACCEPT; proto udp dport 51820 ACCEPT;
@ -28,22 +30,22 @@ table filter {
# allow SSH connections from the private network and from some # allow SSH connections from the private network and from some
# well-known internet hosts # well-known internet hosts
saddr ($NET_PRIVATE 81.209.165.42) proto tcp dport ssh ACCEPT; saddr ($NET_PRIVATE) proto tcp dport ssh ACCEPT;
# we provide DNS and SMTP services for the internal net # we provide DNS and SMTP services for the internal net
interface $DEV_PRIVATE saddr $NET_PRIVATE { interface $DEV_PRIVATE saddr $NET_PRIVATE {
proto (udp tcp) dport domain ACCEPT; proto (udp tcp) dport domain ACCEPT;
proto udp dport bootps ACCEPT; proto udp dport bootps ACCEPT;
} }
# interface réseau
# the rest is dropped by the above policy # the rest is dropped by the above policy
}#FIN INPUT }#FIN INPUT
# outgoing connections are not limited # outgoing connections are not limited
chain OUTPUT { chain OUTPUT {
policy ACCEPT; policy ACCEPT;
# interface $DEV_VPN proto ssh dport 22 ACCEPT;
}#FIN OUTPUT }#FIN OUTPUT
@ -59,6 +61,9 @@ table filter {
# internal nets are allowed # internal nets are allowed
interface $DEV_PRIVATE ACCEPT; interface $DEV_PRIVATE ACCEPT;
interface $DEV_VPN daddr $NET_PRIVATE {
proto tcp dport ssh DROP;
}
# the rest is dropped by the above policy # the rest is dropped by the above policy
} }
} }