From 9e390644e75d1c5c0a160d07f5eed0a10f4f9109 Mon Sep 17 00:00:00 2001 From: "guillaume.emorine" Date: Thu, 4 Apr 2024 14:31:17 +0200 Subject: [PATCH] =?UTF-8?q?=09Modifi=C3=A9=C2=A0:=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20sisr1/tp07/files=5Ffirewall/current=5Fruleset=5Fpartie=5F4.n?= =?UTF-8?q?ft?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../current_ruleset_partie_4.nft | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/sisr1/tp07/files_firewall/current_ruleset_partie_4.nft b/sisr1/tp07/files_firewall/current_ruleset_partie_4.nft index f261dd5..30261d8 100644 --- a/sisr1/tp07/files_firewall/current_ruleset_partie_4.nft +++ b/sisr1/tp07/files_firewall/current_ruleset_partie_4.nft @@ -2,6 +2,11 @@ define netif = enp0s3 define dmzif = enp0s8 define lanif = enp0s9 +define proxy = 10.121.38.1 +defiine dns = {10.121.38.7 , 10.121.38.8} +define proxyport = 8080 +define dmznet = 172.16.0.1-172.16.0.254 + define firewall = 192.168.0.120 define ipdmz = 172.16.0.254 define iplan = 10.0.0.254 @@ -11,13 +16,13 @@ table ip ipfilter{ type filter hook prerouting priority filter; policy drop; icmp type echo-reply accept ct state established, related accept - icmp type echo-request iif {$lanif} ip daddr 172.16.0.1-172.16.0.254 accept + icmp type echo-request iif {$lanif} ip daddr $dmznet accept icmp type echo-request iif {$lanif} ip daddr {$iplan} accept tcp dport 20 accept tcp dport 21 accept tcp dport {80, 443} accept tcp dport 22 accept - ip saddr 10.121.38.1 tcp dport {80, 443} accept + ip saddr $proxy tcp dport {80, 443} accept } chain system_in { type filter hook input priority filter; policy drop; @@ -28,7 +33,7 @@ table ip ipfilter{ tcp dport 21 accept tcp dport {80, 443} accept tcp dport 22 accept - ip saddr 10.121.38.1 tcp dport {80, 443} accept + ip saddr $proxy tcp dport {80, 443} accept } chain routing { type filter hook forward priority filter; policy drop; @@ -37,8 +42,8 @@ table ip ipfilter{ } chain system_out { type filter hook output priority filter; policy drop; - ip daddr 10.121.38.7-10.121.38.8 accept - ip daddr 10.121.38.1 tcp dport 8080 accept + ip daddr $dns accept + ip daddr $proxy tcp dport $proxyport accept icmp type echo-reply oif {$lanif} accept icmp type echo-request accept tcp dport 20 accept @@ -51,8 +56,8 @@ table ip ipfilter{ } chain postrouting { type filter hook postrouting priority filter; policy drop; - ip daddr 10.121.38.7-10.121.38.8 accept - ip daddr 10.121.38.1 tcp dport 8080 accept + ip daddr $dns accept + ip daddr $proxy tcp dport $proxyport accept icmp type echo-request ip saddr {$iplan, $ipdmz, $firewall} accept icmp type echo-reply iif {$dmzif} oif {$lanif} accept icmp type echo-request iif {$lanif} oif {$dmzif} accept