diff --git a/sisr1/tp07/files_firewall/current_ruleset_v1.nft b/sisr1/tp07/files_firewall/current_ruleset_partie_1.nft similarity index 100% rename from sisr1/tp07/files_firewall/current_ruleset_v1.nft rename to sisr1/tp07/files_firewall/current_ruleset_partie_1.nft diff --git a/sisr1/tp07/files_firewall/current_ruleset_partie_2.nft b/sisr1/tp07/files_firewall/current_ruleset_partie_2.nft new file mode 100644 index 0000000..83875ea --- /dev/null +++ b/sisr1/tp07/files_firewall/current_ruleset_partie_2.nft @@ -0,0 +1,25 @@ +define netif = enp0s3 +define dmzif = enp0s8 +define lanif = enp0s9 + +table ip ipfilter{ + chain prerouting { + type filter hook prerouting priority filter; policy drop; + tcp dport 22 accept + } + chain system_in { + type filter hook input priority filter; policy drop; + tcp dport 22 accept + } + chain routing { + type filter hook forward priority filter; policy drop; + } + chain system_out { + type filter hook output priority filter; policy drop; + tcp sport 22 accept + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + tcp sport 22 accept + } +} diff --git a/sisr1/tp07/files_firewall/current_ruleset_partie_3.nft b/sisr1/tp07/files_firewall/current_ruleset_partie_3.nft new file mode 100644 index 0000000..0ffc2ba --- /dev/null +++ b/sisr1/tp07/files_firewall/current_ruleset_partie_3.nft @@ -0,0 +1,36 @@ +define netif = enp0s3 +define dmzif = enp0s8 +define lanif = enp0s9 + +table ip ipfilter{ + chain prerouting { + type filter hook prerouting priority filter; policy drop; + icmp type echo-reply accept + icmp type echo-request iif {$lanif} accept + tcp dport 22 accept + } + chain system_in { + type filter hook input priority filter; policy drop; + icmp type echo-reply accept + icmp type echo-request iif {$lanif} accept + tcp dport 22 accept + } + chain routing { + type filter hook forward priority filter; policy drop; + icmp type echo-request iif {$lanif} accept + icmp type echo-reply oif {$lanif} accept + } + chain system_out { + type filter hook output priority filter; policy drop; + icmp type echo-reply oif {$lanif} accept + icmp type echo-request accept + tcp sport 22 accept + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + icmp type echo-request ip saddr {192.168.0.120, 10.0.0.254, 172.16.0.254} accept + icmp type echo-reply oif {$lanif} accept + icmp type echo-request iif {$lanif} accept + tcp sport 22 accept + } +}