From 5dc7e43d565155101bc87cb7e7998ab52eaf5929 Mon Sep 17 00:00:00 2001 From: Guillaume Emorine Date: Thu, 4 Apr 2024 14:03:10 +0200 Subject: [PATCH] =?UTF-8?q?=09Modifi=C3=A9=C2=A0:=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20sisr1/tp07/files=5Ffirewall/current=5Fruleset=5Fpartie=5F4.n?= =?UTF-8?q?ft?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../current_ruleset_partie_4.nft | 24 ++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/sisr1/tp07/files_firewall/current_ruleset_partie_4.nft b/sisr1/tp07/files_firewall/current_ruleset_partie_4.nft index d64347f..f261dd5 100644 --- a/sisr1/tp07/files_firewall/current_ruleset_partie_4.nft +++ b/sisr1/tp07/files_firewall/current_ruleset_partie_4.nft @@ -13,14 +13,22 @@ table ip ipfilter{ ct state established, related accept icmp type echo-request iif {$lanif} ip daddr 172.16.0.1-172.16.0.254 accept icmp type echo-request iif {$lanif} ip daddr {$iplan} accept + tcp dport 20 accept + tcp dport 21 accept + tcp dport {80, 443} accept tcp dport 22 accept + ip saddr 10.121.38.1 tcp dport {80, 443} accept } chain system_in { type filter hook input priority filter; policy drop; icmp type echo-reply accept icmp type echo-request iif {$lanif} accept ct state established, related accept + tcp dport 20 accept + tcp dport 21 accept + tcp dport {80, 443} accept tcp dport 22 accept + ip saddr 10.121.38.1 tcp dport {80, 443} accept } chain routing { type filter hook forward priority filter; policy drop; @@ -29,18 +37,32 @@ table ip ipfilter{ } chain system_out { type filter hook output priority filter; policy drop; + ip daddr 10.121.38.7-10.121.38.8 accept + ip daddr 10.121.38.1 tcp dport 8080 accept icmp type echo-reply oif {$lanif} accept icmp type echo-request accept - ip daddr 10.121.38.7-10.121.38.8 accept + tcp dport 20 accept + tcp sport 20 accept + tcp dport 21 accept + tcp sport 21 accept + tcp dport {80, 443} accept + tcp sport {80, 443} accept tcp sport 22 accept } chain postrouting { type filter hook postrouting priority filter; policy drop; ip daddr 10.121.38.7-10.121.38.8 accept + ip daddr 10.121.38.1 tcp dport 8080 accept icmp type echo-request ip saddr {$iplan, $ipdmz, $firewall} accept icmp type echo-reply iif {$dmzif} oif {$lanif} accept icmp type echo-request iif {$lanif} oif {$dmzif} accept icmp type echo-request ip saddr $iplan oif $lanif accept + tcp dport 20 accept + tcp sport 20 accept + tcp dport 21 accept + tcp sport 21 accept + tcp dport {80, 443} accept + tcp sport {80, 443} accept tcp sport 22 accept } }