nathan.genret/firewall
1
0
Fork 0
forked from guillaume.emorine/siotp
Code Pull Requests Activity

Modifié : sisr1/tp07/files_firewall/current_ruleset_partie_3.nft

Browse Source
This commit is contained in:
Guillaume Emorine 2024-04-04 09:59:45 +02:00
parent 10a3b3ccb8
commit c1bf2198d4
1 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
sisr1/tp07/files_firewall/current_ruleset_partie_3.nft
View File

@ -1,12 +1,16 @@
define netif = enp0s3 define netif = enp0s3
define dmzif = enp0s8 define dmzif = enp0s8
define lanif = enp0s9 define lanif = enp0s9
define firewall = 192.168.0.120
define ipdmz = 172.16.0.254
define iplan = 10.0.0.254
table ip ipfilter{ table ip ipfilter{
chain prerouting { chain prerouting {
type filter hook prerouting priority filter; policy drop; type filter hook prerouting priority filter; policy drop;
icmp type echo-reply accept icmp type echo-reply accept
icmp type echo-request iif {$lanif} accept icmp type echo-request iif {$lanif} oif {$dmzif} accept
icmp type echo-request iif {$lanif} ip daddr {$iplan}
tcp dport 22 accept tcp dport 22 accept
} }
chain system_in { chain system_in {
@ -17,8 +21,8 @@ table ip ipfilter{
} }
chain routing { chain routing {
type filter hook forward priority filter; policy drop; type filter hook forward priority filter; policy drop;
icmp type echo-request iif {$lanif} accept icmp type echo-request iif {$lanif} oif {$dmzif} accept
icmp type echo-reply oif {$lanif} accept icmp type echo-reply iif {$dmzif} oif {$lanif} accept
} }
chain system_out { chain system_out {
type filter hook output priority filter; policy drop; type filter hook output priority filter; policy drop;
@ -28,9 +32,10 @@ table ip ipfilter{
} }
chain postrouting { chain postrouting {
type filter hook postrouting priority filter; policy drop; type filter hook postrouting priority filter; policy drop;
icmp type echo-request ip saddr {192.168.0.120, 10.0.0.254, 172.16.0.254} accept icmp type echo-request ip saddr {$iplan, $ipdmz, $firewall} accept
icmp type echo-reply oif {$lanif} accept icmp type echo-reply iif {$dmzif} oif {$lanif} accept
icmp type echo-request iif {$lanif} accept icmp type echo-request iif {$lanif} oif {$dmzif} accept
icmp type echo-request ip saddr $iplan oif $lanif accept
tcp sport 22 accept tcp sport 22 accept
} }
} }