depot du TP6
This commit is contained in:
parent
2481e8eb05
commit
363e22a082
120
sisr1/Tp06-Firewall/current_ruleset.nft
Normal file
120
sisr1/Tp06-Firewall/current_ruleset.nft
Normal file
@ -0,0 +1,120 @@
|
||||
define netif = enp0s3
|
||||
define lanif = enp0s8
|
||||
define dmzif = enp0s9
|
||||
|
||||
define netip = 192.168.0.120
|
||||
define lanip = 172.16.0.254
|
||||
define dmzip = 172.17.0.254
|
||||
|
||||
define lan-ntw = 172.16.0.1-172.16.0.254
|
||||
define dmz-ntw = 172.17.0.1-172.17.0.254
|
||||
|
||||
define internal-dns-ip = 172.16.0.1
|
||||
define dns-forwarder-ip = 10.121.38.7
|
||||
|
||||
table ip ipfilter{
|
||||
|
||||
#Chaines de filtrage
|
||||
|
||||
chain prerouting {
|
||||
type filter hook prerouting priority filter; policy drop;
|
||||
#Communicationaccept déjà établies
|
||||
ct state established,related accept
|
||||
#SSH
|
||||
tcp dport 22 accept
|
||||
#Requêtes HTTP/HTTPS depuis LAN
|
||||
tcp dport {80,443} iif $lanif accept
|
||||
# Requêtes externe du serveur DNS
|
||||
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
|
||||
|
||||
# Requêtes DNS depuis la DMZ
|
||||
ip saddr $dmzip ip daddr $internal-dns-ip accept
|
||||
# Allow outgoing DNS requests from DMZ
|
||||
ip saddr $dmzip udp dport 53 accept
|
||||
|
||||
#Pings
|
||||
icmp type echo-request iif $lanif accept
|
||||
icmp type echo-reply iif {$lanif, $dmzif} accept
|
||||
}
|
||||
chain system_in {
|
||||
type filter hook input priority filter; policy drop;
|
||||
#Communication déjà établies
|
||||
ct state established,related accept
|
||||
#SSH
|
||||
tcp dport 22 accept
|
||||
#Pings
|
||||
icmp type echo-request iif $lanif accept
|
||||
icmp type echo-reply accept
|
||||
}
|
||||
chain routing {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
#Communication déjà établies
|
||||
ct state established,related accept
|
||||
#Requêtes HTTP/HTTPS depuis LAN
|
||||
tcp dport {80,443} iif $lanif accept
|
||||
#Requêtes externe du serveur DNS
|
||||
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
|
||||
# Requêtes DNS depuis la DMZ
|
||||
ip saddr $dmzip ip daddr $internal-dns-ip accept
|
||||
# Allow outgoing DNS requests from DMZ
|
||||
ip saddr $dmzip udp dport 53 accept
|
||||
#Pings
|
||||
icmp type echo-request iif $lanif oif $dmzif accept
|
||||
icmp type echo-reply iif $dmzif oif $lanif accept
|
||||
}
|
||||
chain system_out {
|
||||
type filter hook output priority filter; policy drop;
|
||||
#Communication déjà établies
|
||||
ct state established,related accept
|
||||
#SSH
|
||||
tcp sport 22 accept
|
||||
#Proxy lycée
|
||||
tcp dport 8080 accept
|
||||
#DNS
|
||||
udp dport 53 accept
|
||||
#HTTP/HTTPS
|
||||
tcp dport {80,443} accept
|
||||
#FTP
|
||||
tcp dport {20,21} accept
|
||||
#Pings
|
||||
icmp type echo-request accept
|
||||
icmp type echo-reply oif $lanif accept
|
||||
}
|
||||
chain postrouting {
|
||||
type filter hook postrouting priority filter; policy drop;
|
||||
#Communication déjà établies
|
||||
ct state established,related accept
|
||||
#SSH
|
||||
tcp sport 22 accept
|
||||
#Proxy lycée
|
||||
tcp dport 8080 accept
|
||||
#DNS
|
||||
udp dport 53 accept
|
||||
#Requêtes externe du serveur DNS
|
||||
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
|
||||
#HTTP/HTTPS
|
||||
tcp dport {80,443} accept
|
||||
#FTP
|
||||
tcp dport {20,21} accept
|
||||
# Requêtes DNS depuis la DMZ
|
||||
ip saddr $dmzip ip daddr $internal-dns-ip accept
|
||||
# Allow outgoing DNS requests from DMZ
|
||||
ip saddr $dmzip udp dport 53 accept
|
||||
#Pings
|
||||
icmp type echo-request oif {$lanif, $dmzif} accept
|
||||
icmp type echo-reply oif $lanif accept
|
||||
}
|
||||
|
||||
#Chaines pour la NAT
|
||||
|
||||
chain nat_prerouting {
|
||||
type nat hook prerouting priority filter; policy accept;
|
||||
}
|
||||
|
||||
chain nat_postrouting {
|
||||
type nat hook postrouting priority filter; policy accept;
|
||||
#Masquage des IP de la LAN sortant sur Internet
|
||||
ip saddr $lan-ntw oif $netif snat $netip
|
||||
}
|
||||
|
||||
}
|
||||
13
sisr1/Tp06-Firewall/fw_part1.nft
Normal file
13
sisr1/Tp06-Firewall/fw_part1.nft
Normal file
@ -0,0 +1,13 @@
|
||||
table ip ipfilter {
|
||||
chain routing {
|
||||
type filter hook forward priority filter; policy accept;
|
||||
icmp type echo-request iif { "enp0s3", "enp0s9" } drop
|
||||
icmp type { echo-reply, echo-request } accept
|
||||
drop
|
||||
}
|
||||
|
||||
chain system_in {
|
||||
type filter hook input priority filter; policy accept;
|
||||
icmp type echo-request iif { "enp0s3", "enp0s9" } drop
|
||||
}
|
||||
}
|
||||
25
sisr1/Tp06-Firewall/fw_part2.nft
Normal file
25
sisr1/Tp06-Firewall/fw_part2.nft
Normal file
@ -0,0 +1,25 @@
|
||||
define netif = enp0s3
|
||||
define dmzif = enp0s9
|
||||
define lanif = enp0s8
|
||||
|
||||
table ip ipfilter{
|
||||
chain prerouting {
|
||||
type filter hook prerouting priority filter; policy drop;
|
||||
tcp dport 22 accept
|
||||
}
|
||||
chain system_in {
|
||||
type filter hook input priority filter; policy drop;
|
||||
tcp dport 22 accept
|
||||
}
|
||||
chain routing {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
}
|
||||
chain system_out {
|
||||
type filter hook output priority filter; policy drop;
|
||||
tcp sport 22 accept
|
||||
}
|
||||
chain postrouting {
|
||||
type filter hook postrouting priority filter; policy drop;
|
||||
tcp sport 22 accept
|
||||
}
|
||||
}
|
||||
42
sisr1/Tp06-Firewall/fw_part3.nft
Normal file
42
sisr1/Tp06-Firewall/fw_part3.nft
Normal file
@ -0,0 +1,42 @@
|
||||
define netif = enp0s3
|
||||
define lanif = enp0s8
|
||||
define dmzif = enp0s9
|
||||
|
||||
define netip = 192.168.0.140 (ou 120, ou 160)
|
||||
define lanip = 172.16.0.254
|
||||
define dmzip = 172.17.0.254
|
||||
|
||||
define lan-ntw = 172.16.0.1-172.16.0.254
|
||||
define dmz-ntw = 172.17.0.1-172.17.0.254
|
||||
|
||||
table ip ipfilter{
|
||||
chain prerouting {
|
||||
type filter hook prerouting priority filter; policy drop;
|
||||
tcp dport 22 accept
|
||||
icmp type echo-request iif $lanif accept
|
||||
icmp type echo-reply iif {$lanif, $dmzif} accept
|
||||
}
|
||||
chain system_in {
|
||||
type filter hook input priority filter; policy drop;
|
||||
tcp dport 22 accept
|
||||
icmp type echo-request iif $lanif accept
|
||||
icmp type echo-reply accept
|
||||
}
|
||||
chain routing {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
icmp type echo-request iif $lanif oif $dmzif accept
|
||||
icmp type echo-reply iif $dmzif oif $lanif accept
|
||||
}
|
||||
chain system_out {
|
||||
type filter hook output priority filter; policy drop;
|
||||
tcp sport 22 accept
|
||||
icmp type echo-request accept
|
||||
icmp type echo-reply oif $lanif accept
|
||||
}
|
||||
chain postrouting {
|
||||
type filter hook postrouting priority filter; policy drop;
|
||||
tcp sport 22 accept
|
||||
icmp type echo-request oif {$lanif, $dmzif} accept
|
||||
icmp type echo-reply oif $lanif accept
|
||||
}
|
||||
}
|
||||
70
sisr1/Tp06-Firewall/fw_part4.nft
Normal file
70
sisr1/Tp06-Firewall/fw_part4.nft
Normal file
@ -0,0 +1,70 @@
|
||||
define netif = enp0s3
|
||||
define lanif = enp0s8
|
||||
define dmzif = enp0s9
|
||||
|
||||
define netip = 192.168.0.120
|
||||
define lanip = 172.16.0.254
|
||||
define dmzip = 172.17.0.254
|
||||
|
||||
define lan-ntw = 172.16.0.1-172.16.0.254
|
||||
define dmz-ntw = 172.17.0.1-172.17.0.254
|
||||
|
||||
table ip ipfilter{
|
||||
chain prerouting {
|
||||
type filter hook prerouting priority filter; policy drop;
|
||||
tcp dport 22 accept
|
||||
icmp type echo-request iif $lanif accept
|
||||
icmp type echo-reply iif {$lanif, $dmzif} accept
|
||||
ct state established,related accept
|
||||
}
|
||||
chain system_in {
|
||||
type filter hook input priority filter; policy drop;
|
||||
tcp dport 22 accept
|
||||
icmp type echo-request iif $lanif accept
|
||||
icmp type echo-reply accept
|
||||
ct state established,related accept
|
||||
}
|
||||
chain routing {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
icmp type echo-request iif $lanif oif $dmzif accept
|
||||
icmp type echo-reply iif $dmzif oif $lanif accept
|
||||
}
|
||||
chain system_out {
|
||||
type filter hook output priority filter; policy drop;
|
||||
ct state established,related accept
|
||||
# SSH
|
||||
tcp sport 22 accept
|
||||
|
||||
icmp type echo-request accept
|
||||
icmp type echo-reply oif $lanif accept
|
||||
|
||||
#Proxy lycée
|
||||
|
||||
tcp dport 8080 accept
|
||||
|
||||
# Requêtes DNS sortantes (UDP et TCP)
|
||||
udp dport 53 accept
|
||||
tcp dport 53 accept
|
||||
|
||||
# Requêtes HTTP/HTTPS/FTP sortantes
|
||||
tcp dport {80, 443, 20, 21} accept
|
||||
}
|
||||
chain postrouting {
|
||||
type filter hook postrouting priority filter; policy drop;
|
||||
ct state established,related accept
|
||||
# SSH
|
||||
tcp sport 22 accept
|
||||
|
||||
tcp dport 8080 accept
|
||||
|
||||
icmp type echo-request oif {$lanif, $dmzif} accept
|
||||
icmp type echo-reply oif $lanif accept
|
||||
|
||||
# Requêtes DNS sortantes (UDP et TCP)
|
||||
udp dport 53 accept
|
||||
tcp dport 53 accept
|
||||
|
||||
# Requêtes HTTP/HTTPS/FTP sortantes
|
||||
tcp dport {80, 443, 20, 21} accept
|
||||
}
|
||||
}
|
||||
106
sisr1/Tp06-Firewall/fw_part5.nft
Normal file
106
sisr1/Tp06-Firewall/fw_part5.nft
Normal file
@ -0,0 +1,106 @@
|
||||
define netif = enp0s3
|
||||
define lanif = enp0s8
|
||||
define dmzif = enp0s9
|
||||
|
||||
define netip = 192.168.0.120
|
||||
define lanip = 172.16.0.254
|
||||
define dmzip = 172.17.0.254
|
||||
|
||||
define lan-ntw = 172.16.0.1-172.16.0.254
|
||||
define dmz-ntw = 172.17.0.1-172.17.0.254
|
||||
|
||||
define internal-dns-ip = 172.16.0.1
|
||||
define dns-forwarder-ip = 10.121.38.7
|
||||
|
||||
table ip ipfilter{
|
||||
|
||||
#Chaines de filtrage
|
||||
|
||||
chain prerouting {
|
||||
type filter hook prerouting priority filter; policy drop;
|
||||
#Communicationaccept déjà établies
|
||||
ct state established,related accept
|
||||
#SSH
|
||||
tcp dport 22 accept
|
||||
#Requêtes HTTP/HTTPS depuis LAN
|
||||
tcp dport {80,443} iif $lanif accept
|
||||
#Requêtes externe du serveur DNS
|
||||
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
|
||||
#Pings
|
||||
icmp type echo-request iif $lanif accept
|
||||
icmp type echo-reply iif {$lanif, $dmzif} accept
|
||||
}
|
||||
chain system_in {
|
||||
type filter hook input priority filter; policy drop;
|
||||
#Communication déjà établies
|
||||
ct state established,related accept
|
||||
#SSH
|
||||
tcp dport 22 accept
|
||||
#Pings
|
||||
icmp type echo-request iif $lanif accept
|
||||
icmp type echo-reply accept
|
||||
}
|
||||
chain routing {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
#Communication déjà établies
|
||||
ct state established,related accept
|
||||
#Requêtes HTTP/HTTPS depuis LAN
|
||||
tcp dport {80,443} iif $lanif accept
|
||||
#Requêtes externe du serveur DNS
|
||||
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
|
||||
#Pings
|
||||
icmp type echo-request iif $lanif oif $dmzif accept
|
||||
icmp type echo-reply iif $dmzif oif $lanif accept
|
||||
}
|
||||
chain system_out {
|
||||
type filter hook output priority filter; policy drop;
|
||||
#Communication déjà établies
|
||||
ct state established,related accept
|
||||
#SSH
|
||||
tcp sport 22 accept
|
||||
#Proxy lycée
|
||||
tcp dport 8080 accept
|
||||
#DNS
|
||||
udp dport 53 accept
|
||||
#HTTP/HTTPS
|
||||
tcp dport {80,443} accept
|
||||
#FTP
|
||||
tcp dport {20,21} accept
|
||||
#Pings
|
||||
icmp type echo-request accept
|
||||
icmp type echo-reply oif $lanif accept
|
||||
}
|
||||
chain postrouting {
|
||||
type filter hook postrouting priority filter; policy drop;
|
||||
#Communication déjà établies
|
||||
ct state established,related accept
|
||||
#SSH
|
||||
tcp sport 22 accept
|
||||
#Proxy lycée
|
||||
tcp dport 8080 accept
|
||||
#DNS
|
||||
udp dport 53 accept
|
||||
#Requêtes externe du serveur DNS
|
||||
ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept
|
||||
#HTTP/HTTPS
|
||||
tcp dport {80,443} accept
|
||||
#FTP
|
||||
tcp dport {20,21} accept
|
||||
#Pings
|
||||
icmp type echo-request oif {$lanif, $dmzif} accept
|
||||
icmp type echo-reply oif $lanif accept
|
||||
}
|
||||
|
||||
#Chaines pour la NAT
|
||||
|
||||
chain nat_prerouting {
|
||||
type nat hook prerouting priority filter; policy accept;
|
||||
}
|
||||
|
||||
chain nat_postrouting {
|
||||
type nat hook postrouting priority filter; policy accept;
|
||||
#Masquage des IP de la LAN sortant sur Internet
|
||||
ip saddr $lan-ntw oif $netif snat $netip
|
||||
}
|
||||
|
||||
}
|
||||
7
sisr1/Tp06-Firewall/test_firewall.sh
Normal file
7
sisr1/Tp06-Firewall/test_firewall.sh
Normal file
@ -0,0 +1,7 @@
|
||||
#!/bin/bash
|
||||
ipfirewall=192.168.0.120
|
||||
dir=/root/firewall
|
||||
ruleset=current_ruleset.nft
|
||||
|
||||
scp $ruleset root@$ipfirewall:$dir/$ruleset
|
||||
ssh root@$ipfirewall "bash $dir/refresh_firewall.sh"
|
||||
Loading…
x
Reference in New Issue
Block a user