From 363e22a0827638107b05e484a87f48b723f3c23e Mon Sep 17 00:00:00 2001 From: "redouane.assani" Date: Mon, 5 May 2025 09:07:35 +0200 Subject: [PATCH] depot du TP6 --- sisr1/Tp06-Firewall/current_ruleset.nft | 120 ++++++++++++++++++++++++ sisr1/Tp06-Firewall/fw_part1.nft | 13 +++ sisr1/Tp06-Firewall/fw_part2.nft | 25 +++++ sisr1/Tp06-Firewall/fw_part3.nft | 42 +++++++++ sisr1/Tp06-Firewall/fw_part4.nft | 70 ++++++++++++++ sisr1/Tp06-Firewall/fw_part5.nft | 106 +++++++++++++++++++++ sisr1/Tp06-Firewall/test_firewall.sh | 7 ++ 7 files changed, 383 insertions(+) create mode 100644 sisr1/Tp06-Firewall/current_ruleset.nft create mode 100644 sisr1/Tp06-Firewall/fw_part1.nft create mode 100644 sisr1/Tp06-Firewall/fw_part2.nft create mode 100644 sisr1/Tp06-Firewall/fw_part3.nft create mode 100644 sisr1/Tp06-Firewall/fw_part4.nft create mode 100644 sisr1/Tp06-Firewall/fw_part5.nft create mode 100644 sisr1/Tp06-Firewall/test_firewall.sh diff --git a/sisr1/Tp06-Firewall/current_ruleset.nft b/sisr1/Tp06-Firewall/current_ruleset.nft new file mode 100644 index 0000000..3e8d281 --- /dev/null +++ b/sisr1/Tp06-Firewall/current_ruleset.nft @@ -0,0 +1,120 @@ +define netif = enp0s3 +define lanif = enp0s8 +define dmzif = enp0s9 + +define netip = 192.168.0.120 +define lanip = 172.16.0.254 +define dmzip = 172.17.0.254 + +define lan-ntw = 172.16.0.1-172.16.0.254 +define dmz-ntw = 172.17.0.1-172.17.0.254 + +define internal-dns-ip = 172.16.0.1 +define dns-forwarder-ip = 10.121.38.7 + +table ip ipfilter{ + + #Chaines de filtrage + + chain prerouting { + type filter hook prerouting priority filter; policy drop; + #Communicationaccept déjà établies + ct state established,related accept + #SSH + tcp dport 22 accept + #Requêtes HTTP/HTTPS depuis LAN + tcp dport {80,443} iif $lanif accept + # Requêtes externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + + # Requêtes DNS depuis la DMZ + ip saddr $dmzip ip daddr $internal-dns-ip accept + # Allow outgoing DNS requests from DMZ + ip saddr $dmzip udp dport 53 accept + + #Pings + icmp type echo-request iif $lanif accept + icmp type echo-reply iif {$lanif, $dmzif} accept + } + chain system_in { + type filter hook input priority filter; policy drop; + #Communication déjà établies + ct state established,related accept + #SSH + tcp dport 22 accept + #Pings + icmp type echo-request iif $lanif accept + icmp type echo-reply accept + } + chain routing { + type filter hook forward priority filter; policy drop; + #Communication déjà établies + ct state established,related accept + #Requêtes HTTP/HTTPS depuis LAN + tcp dport {80,443} iif $lanif accept + #Requêtes externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + # Requêtes DNS depuis la DMZ + ip saddr $dmzip ip daddr $internal-dns-ip accept + # Allow outgoing DNS requests from DMZ + ip saddr $dmzip udp dport 53 accept + #Pings + icmp type echo-request iif $lanif oif $dmzif accept + icmp type echo-reply iif $dmzif oif $lanif accept + } + chain system_out { + type filter hook output priority filter; policy drop; + #Communication déjà établies + ct state established,related accept + #SSH + tcp sport 22 accept + #Proxy lycée + tcp dport 8080 accept + #DNS + udp dport 53 accept + #HTTP/HTTPS + tcp dport {80,443} accept + #FTP + tcp dport {20,21} accept + #Pings + icmp type echo-request accept + icmp type echo-reply oif $lanif accept + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + #Communication déjà établies + ct state established,related accept + #SSH + tcp sport 22 accept + #Proxy lycée + tcp dport 8080 accept + #DNS + udp dport 53 accept + #Requêtes externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + #HTTP/HTTPS + tcp dport {80,443} accept + #FTP + tcp dport {20,21} accept + # Requêtes DNS depuis la DMZ + ip saddr $dmzip ip daddr $internal-dns-ip accept + # Allow outgoing DNS requests from DMZ + ip saddr $dmzip udp dport 53 accept + #Pings + icmp type echo-request oif {$lanif, $dmzif} accept + icmp type echo-reply oif $lanif accept + } + + #Chaines pour la NAT + + chain nat_prerouting { + type nat hook prerouting priority filter; policy accept; + } + + chain nat_postrouting { + type nat hook postrouting priority filter; policy accept; + #Masquage des IP de la LAN sortant sur Internet + ip saddr $lan-ntw oif $netif snat $netip + } + +} \ No newline at end of file diff --git a/sisr1/Tp06-Firewall/fw_part1.nft b/sisr1/Tp06-Firewall/fw_part1.nft new file mode 100644 index 0000000..ab34969 --- /dev/null +++ b/sisr1/Tp06-Firewall/fw_part1.nft @@ -0,0 +1,13 @@ +table ip ipfilter { + chain routing { + type filter hook forward priority filter; policy accept; + icmp type echo-request iif { "enp0s3", "enp0s9" } drop + icmp type { echo-reply, echo-request } accept + drop + } + + chain system_in { + type filter hook input priority filter; policy accept; + icmp type echo-request iif { "enp0s3", "enp0s9" } drop + } +} diff --git a/sisr1/Tp06-Firewall/fw_part2.nft b/sisr1/Tp06-Firewall/fw_part2.nft new file mode 100644 index 0000000..58b243d --- /dev/null +++ b/sisr1/Tp06-Firewall/fw_part2.nft @@ -0,0 +1,25 @@ +define netif = enp0s3 +define dmzif = enp0s9 +define lanif = enp0s8 + +table ip ipfilter{ + chain prerouting { + type filter hook prerouting priority filter; policy drop; + tcp dport 22 accept + } + chain system_in { + type filter hook input priority filter; policy drop; + tcp dport 22 accept + } + chain routing { + type filter hook forward priority filter; policy drop; + } + chain system_out { + type filter hook output priority filter; policy drop; + tcp sport 22 accept + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + tcp sport 22 accept + } +} \ No newline at end of file diff --git a/sisr1/Tp06-Firewall/fw_part3.nft b/sisr1/Tp06-Firewall/fw_part3.nft new file mode 100644 index 0000000..4d632bb --- /dev/null +++ b/sisr1/Tp06-Firewall/fw_part3.nft @@ -0,0 +1,42 @@ +define netif = enp0s3 +define lanif = enp0s8 +define dmzif = enp0s9 + +define netip = 192.168.0.140 (ou 120, ou 160) +define lanip = 172.16.0.254 +define dmzip = 172.17.0.254 + +define lan-ntw = 172.16.0.1-172.16.0.254 +define dmz-ntw = 172.17.0.1-172.17.0.254 + +table ip ipfilter{ + chain prerouting { + type filter hook prerouting priority filter; policy drop; + tcp dport 22 accept + icmp type echo-request iif $lanif accept + icmp type echo-reply iif {$lanif, $dmzif} accept + } + chain system_in { + type filter hook input priority filter; policy drop; + tcp dport 22 accept + icmp type echo-request iif $lanif accept + icmp type echo-reply accept + } + chain routing { + type filter hook forward priority filter; policy drop; + icmp type echo-request iif $lanif oif $dmzif accept + icmp type echo-reply iif $dmzif oif $lanif accept + } + chain system_out { + type filter hook output priority filter; policy drop; + tcp sport 22 accept + icmp type echo-request accept + icmp type echo-reply oif $lanif accept + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + tcp sport 22 accept + icmp type echo-request oif {$lanif, $dmzif} accept + icmp type echo-reply oif $lanif accept + } +} \ No newline at end of file diff --git a/sisr1/Tp06-Firewall/fw_part4.nft b/sisr1/Tp06-Firewall/fw_part4.nft new file mode 100644 index 0000000..6acf64d --- /dev/null +++ b/sisr1/Tp06-Firewall/fw_part4.nft @@ -0,0 +1,70 @@ +define netif = enp0s3 +define lanif = enp0s8 +define dmzif = enp0s9 + +define netip = 192.168.0.120 +define lanip = 172.16.0.254 +define dmzip = 172.17.0.254 + +define lan-ntw = 172.16.0.1-172.16.0.254 +define dmz-ntw = 172.17.0.1-172.17.0.254 + +table ip ipfilter{ + chain prerouting { + type filter hook prerouting priority filter; policy drop; + tcp dport 22 accept + icmp type echo-request iif $lanif accept + icmp type echo-reply iif {$lanif, $dmzif} accept + ct state established,related accept + } + chain system_in { + type filter hook input priority filter; policy drop; + tcp dport 22 accept + icmp type echo-request iif $lanif accept + icmp type echo-reply accept + ct state established,related accept + } + chain routing { + type filter hook forward priority filter; policy drop; + icmp type echo-request iif $lanif oif $dmzif accept + icmp type echo-reply iif $dmzif oif $lanif accept + } + chain system_out { + type filter hook output priority filter; policy drop; + ct state established,related accept + # SSH + tcp sport 22 accept + + icmp type echo-request accept + icmp type echo-reply oif $lanif accept + + #Proxy lycée + + tcp dport 8080 accept + + # Requêtes DNS sortantes (UDP et TCP) + udp dport 53 accept + tcp dport 53 accept + + # Requêtes HTTP/HTTPS/FTP sortantes + tcp dport {80, 443, 20, 21} accept + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + ct state established,related accept + # SSH + tcp sport 22 accept + + tcp dport 8080 accept + + icmp type echo-request oif {$lanif, $dmzif} accept + icmp type echo-reply oif $lanif accept + + # Requêtes DNS sortantes (UDP et TCP) + udp dport 53 accept + tcp dport 53 accept + + # Requêtes HTTP/HTTPS/FTP sortantes + tcp dport {80, 443, 20, 21} accept + } +} \ No newline at end of file diff --git a/sisr1/Tp06-Firewall/fw_part5.nft b/sisr1/Tp06-Firewall/fw_part5.nft new file mode 100644 index 0000000..abdcb2a --- /dev/null +++ b/sisr1/Tp06-Firewall/fw_part5.nft @@ -0,0 +1,106 @@ +define netif = enp0s3 +define lanif = enp0s8 +define dmzif = enp0s9 + +define netip = 192.168.0.120 +define lanip = 172.16.0.254 +define dmzip = 172.17.0.254 + +define lan-ntw = 172.16.0.1-172.16.0.254 +define dmz-ntw = 172.17.0.1-172.17.0.254 + +define internal-dns-ip = 172.16.0.1 +define dns-forwarder-ip = 10.121.38.7 + +table ip ipfilter{ + + #Chaines de filtrage + + chain prerouting { + type filter hook prerouting priority filter; policy drop; + #Communicationaccept déjà établies + ct state established,related accept + #SSH + tcp dport 22 accept + #Requêtes HTTP/HTTPS depuis LAN + tcp dport {80,443} iif $lanif accept + #Requêtes externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + #Pings + icmp type echo-request iif $lanif accept + icmp type echo-reply iif {$lanif, $dmzif} accept + } + chain system_in { + type filter hook input priority filter; policy drop; + #Communication déjà établies + ct state established,related accept + #SSH + tcp dport 22 accept + #Pings + icmp type echo-request iif $lanif accept + icmp type echo-reply accept + } + chain routing { + type filter hook forward priority filter; policy drop; + #Communication déjà établies + ct state established,related accept + #Requêtes HTTP/HTTPS depuis LAN + tcp dport {80,443} iif $lanif accept + #Requêtes externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + #Pings + icmp type echo-request iif $lanif oif $dmzif accept + icmp type echo-reply iif $dmzif oif $lanif accept + } + chain system_out { + type filter hook output priority filter; policy drop; + #Communication déjà établies + ct state established,related accept + #SSH + tcp sport 22 accept + #Proxy lycée + tcp dport 8080 accept + #DNS + udp dport 53 accept + #HTTP/HTTPS + tcp dport {80,443} accept + #FTP + tcp dport {20,21} accept + #Pings + icmp type echo-request accept + icmp type echo-reply oif $lanif accept + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + #Communication déjà établies + ct state established,related accept + #SSH + tcp sport 22 accept + #Proxy lycée + tcp dport 8080 accept + #DNS + udp dport 53 accept + #Requêtes externe du serveur DNS + ip saddr $internal-dns-ip ip daddr $dns-forwarder-ip accept + #HTTP/HTTPS + tcp dport {80,443} accept + #FTP + tcp dport {20,21} accept + #Pings + icmp type echo-request oif {$lanif, $dmzif} accept + icmp type echo-reply oif $lanif accept + } + + #Chaines pour la NAT + + chain nat_prerouting { + type nat hook prerouting priority filter; policy accept; + } + + chain nat_postrouting { + type nat hook postrouting priority filter; policy accept; + #Masquage des IP de la LAN sortant sur Internet + ip saddr $lan-ntw oif $netif snat $netip + } + +} \ No newline at end of file diff --git a/sisr1/Tp06-Firewall/test_firewall.sh b/sisr1/Tp06-Firewall/test_firewall.sh new file mode 100644 index 0000000..ebec5b1 --- /dev/null +++ b/sisr1/Tp06-Firewall/test_firewall.sh @@ -0,0 +1,7 @@ +#!/bin/bash +ipfirewall=192.168.0.120 +dir=/root/firewall +ruleset=current_ruleset.nft + +scp $ruleset root@$ipfirewall:$dir/$ruleset +ssh root@$ipfirewall "bash $dir/refresh_firewall.sh" \ No newline at end of file