From c1bf2198d4337805277d1daeb85219ebc14c9195 Mon Sep 17 00:00:00 2001 From: Guillaume Emorine Date: Thu, 4 Apr 2024 09:59:45 +0200 Subject: [PATCH] =?UTF-8?q?=09Modifi=C3=A9=C2=A0:=20=20=20=20=20=20=20=20?= =?UTF-8?q?=20sisr1/tp07/files=5Ffirewall/current=5Fruleset=5Fpartie=5F3.n?= =?UTF-8?q?ft?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../files_firewall/current_ruleset_partie_3.nft | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/sisr1/tp07/files_firewall/current_ruleset_partie_3.nft b/sisr1/tp07/files_firewall/current_ruleset_partie_3.nft index 0ffc2ba..a83f2d2 100644 --- a/sisr1/tp07/files_firewall/current_ruleset_partie_3.nft +++ b/sisr1/tp07/files_firewall/current_ruleset_partie_3.nft @@ -1,12 +1,16 @@ define netif = enp0s3 define dmzif = enp0s8 define lanif = enp0s9 +define firewall = 192.168.0.120 +define ipdmz = 172.16.0.254 +define iplan = 10.0.0.254 table ip ipfilter{ chain prerouting { type filter hook prerouting priority filter; policy drop; icmp type echo-reply accept - icmp type echo-request iif {$lanif} accept + icmp type echo-request iif {$lanif} oif {$dmzif} accept + icmp type echo-request iif {$lanif} ip daddr {$iplan} tcp dport 22 accept } chain system_in { @@ -17,8 +21,8 @@ table ip ipfilter{ } chain routing { type filter hook forward priority filter; policy drop; - icmp type echo-request iif {$lanif} accept - icmp type echo-reply oif {$lanif} accept + icmp type echo-request iif {$lanif} oif {$dmzif} accept + icmp type echo-reply iif {$dmzif} oif {$lanif} accept } chain system_out { type filter hook output priority filter; policy drop; @@ -28,9 +32,10 @@ table ip ipfilter{ } chain postrouting { type filter hook postrouting priority filter; policy drop; - icmp type echo-request ip saddr {192.168.0.120, 10.0.0.254, 172.16.0.254} accept - icmp type echo-reply oif {$lanif} accept - icmp type echo-request iif {$lanif} accept + icmp type echo-request ip saddr {$iplan, $ipdmz, $firewall} accept + icmp type echo-reply iif {$dmzif} oif {$lanif} accept + icmp type echo-request iif {$lanif} oif {$dmzif} accept + icmp type echo-request ip saddr $iplan oif $lanif accept tcp sport 22 accept } }