From 8240fd27ab8b4a9448d40e1f5c1bf65236ab617e Mon Sep 17 00:00:00 2001 From: "yann.lereuille" Date: Thu, 10 Apr 2025 14:12:32 +0200 Subject: [PATCH] Ajoout des fichiers de sauvegarde des fichiers conf du firewall part2 et part3 --- sisr1/tp06-firewall/current_ruleset.nft | 42 +++++++++++++++++++++++++ sisr1/tp06-firewall/fw_part1.nft | 15 +++++++++ sisr1/tp06-firewall/fw_part2.nft | 26 +++++++++++++++ sisr1/tp06-firewall/fw_part3.nft | 42 +++++++++++++++++++++++++ sisr1/tp06-firewall/test_firewall.sh | 6 ++++ 5 files changed, 131 insertions(+) create mode 100644 sisr1/tp06-firewall/current_ruleset.nft create mode 100644 sisr1/tp06-firewall/fw_part1.nft create mode 100644 sisr1/tp06-firewall/fw_part2.nft create mode 100644 sisr1/tp06-firewall/fw_part3.nft create mode 100644 sisr1/tp06-firewall/test_firewall.sh diff --git a/sisr1/tp06-firewall/current_ruleset.nft b/sisr1/tp06-firewall/current_ruleset.nft new file mode 100644 index 0000000..e79bb83 --- /dev/null +++ b/sisr1/tp06-firewall/current_ruleset.nft @@ -0,0 +1,42 @@ +define netif = enp0s3 +define lanif = enp0s8 +define dmzif = enp0s9 + +define netip = 192.168.0.130 +define lanip = 172.16.0.254 +define dmzip = 172.17.0.254 + +define lan-ntw = 172.16.0.1-172.16.0.254 +define dmz-ntw = 172.17.0.1-172.17.0.254 + +table ip ipfilter{ + chain prerouting { + type filter hook prerouting priority filter; policy drop; + tcp dport 22 accept + icmp type echo-request iif $lanif accept + icmp type echo-reply iif {$lanif, $dmzif} accept + } + chain system_in { + type filter hook input priority filter; policy drop; + tcp dport 22 accept + icmp type echo-request iif $lanif accept + icmp type echo-reply accept + } + chain routing { + type filter hook forward priority filter; policy drop; + icmp type echo-request iif $lanif oif $dmzif accept + icmp type echo-reply iif $dmzif oif $lanif accept + } + chain system_out { + type filter hook output priority filter; policy drop; + tcp sport 22 accept + icmp type echo-request accept + icmp type echo-reply oif $lanif accept + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + tcp sport 22 accept + icmp type echo-request oif {$lanif, $dmzif} accept + icmp type echo-reply oif $lanif accept + } +} \ No newline at end of file diff --git a/sisr1/tp06-firewall/fw_part1.nft b/sisr1/tp06-firewall/fw_part1.nft new file mode 100644 index 0000000..7745ffd --- /dev/null +++ b/sisr1/tp06-firewall/fw_part1.nft @@ -0,0 +1,15 @@ +table ip ipfilter { + chain routing { + type filter hook forward priority filter; policy accept; + icmp type echo-request iif { "enp0s3", "enp0s9" } drop + icmp type echo-request iif { "enp0s3", "enp0s9" } drop + icmp type echo-request iif { "enp0s3", "enp0s9" } drop + icmp type { echo-reply, echo-request } accept + drop + } + + chain system_in { + type filter hook forward priority filter; policy accept; + icmp type echo-request iif { "enp0s3", "enp0s9" } drop + } +} diff --git a/sisr1/tp06-firewall/fw_part2.nft b/sisr1/tp06-firewall/fw_part2.nft new file mode 100644 index 0000000..fa76ac9 --- /dev/null +++ b/sisr1/tp06-firewall/fw_part2.nft @@ -0,0 +1,26 @@ +define netif = enp0s3 +define dmzif = enp0s8 +define lanif = enp0s9 + +table ip ipfilter{ + chain prerouting { + type filter hook prerouting priority filter; policy drop; + tcp dport 22 accept + } + chain system_in { + type filter hook input priority filter; policy drop; + tcp dport 22 accept + } + chain routing { + type filter hook forward priority filter; policy drop; + } + chain system_out { + type filter hook output priority filter; policy drop; + tcp sport 22 accept + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + tcp sport 22 accept + } +} + diff --git a/sisr1/tp06-firewall/fw_part3.nft b/sisr1/tp06-firewall/fw_part3.nft new file mode 100644 index 0000000..e79bb83 --- /dev/null +++ b/sisr1/tp06-firewall/fw_part3.nft @@ -0,0 +1,42 @@ +define netif = enp0s3 +define lanif = enp0s8 +define dmzif = enp0s9 + +define netip = 192.168.0.130 +define lanip = 172.16.0.254 +define dmzip = 172.17.0.254 + +define lan-ntw = 172.16.0.1-172.16.0.254 +define dmz-ntw = 172.17.0.1-172.17.0.254 + +table ip ipfilter{ + chain prerouting { + type filter hook prerouting priority filter; policy drop; + tcp dport 22 accept + icmp type echo-request iif $lanif accept + icmp type echo-reply iif {$lanif, $dmzif} accept + } + chain system_in { + type filter hook input priority filter; policy drop; + tcp dport 22 accept + icmp type echo-request iif $lanif accept + icmp type echo-reply accept + } + chain routing { + type filter hook forward priority filter; policy drop; + icmp type echo-request iif $lanif oif $dmzif accept + icmp type echo-reply iif $dmzif oif $lanif accept + } + chain system_out { + type filter hook output priority filter; policy drop; + tcp sport 22 accept + icmp type echo-request accept + icmp type echo-reply oif $lanif accept + } + chain postrouting { + type filter hook postrouting priority filter; policy drop; + tcp sport 22 accept + icmp type echo-request oif {$lanif, $dmzif} accept + icmp type echo-reply oif $lanif accept + } +} \ No newline at end of file diff --git a/sisr1/tp06-firewall/test_firewall.sh b/sisr1/tp06-firewall/test_firewall.sh new file mode 100644 index 0000000..297a3a5 --- /dev/null +++ b/sisr1/tp06-firewall/test_firewall.sh @@ -0,0 +1,6 @@ +#!/bin/bash +ipfirewall=192.168.0.130 +dir=/root/firewall +ruleset=current_ruleset.nft +scp $ruleset root@$ipfirewall:$dir/$ruleset +ssh root@$ipfirewall "bash $dir/refresh_firewall.sh" \ No newline at end of file