rezometz/firewall
9
0
Fork 0
Code Issues Pull requests 1 Releases Wiki Activity

Structure du filtrage dmz

Browse source
This commit is contained in:
Hugo LEVY-FALK 2019-01-10 00:04:58 +01:00
parent 5c8e1477d9
commit 230d583110
2 changed files with 33 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
zones/adherent.nft
View file

@ -20,7 +20,7 @@ table inet firewall {
elements = { elements = {
$if_admin, $if_admin,
$if_supelec, $if_supelec,
$if_adherent, # Utile ? $if_adherent,
} }
} }

36
zones/dmz.nft
View file

@ -10,17 +10,45 @@ table inet firewall {
flags interval flags interval
elements = { elements = {
# Si l'on souhaite ajouter des ranges d'ip c'est ici # Si l'on souhaite ajouter des ranges d'ip c'est ici
193.48.225.1-193.48.225.9, 193.48.225.224/27,
} }
} }
set dmz_allowed_tcp_in {
type ipv4_addr . inet_service
flags interval
elements = {
}
}
set dmz_allowed_tcp_out {
type ipv4_addr . inet_service
flags interval
elements = {
}
}
set dmz_allowed_udp_in {
type ipv4_addr . inet_service
flags interval
elements = {
}
}
set dmz_allowed_udp_out {
type ipv4_addr . inet_service
flags interval
elements = {
}
}
chain to_dmz { chain to_dmz {
# DMZ, tout le monde entre ip daddr . tcp dport @dmz_allowed_tcp_in accept;
accept; ip daddr . udp dport @dmz_allowed_udp_in accept;
drop;
} }
chain from_dmz { chain from_dmz {
# DMZ, tout le monde sort ip saddr . tcp dport @dmz_allowed_tcp_out accept;
ip saddr . udp dport @dmz_allowed_udp_out accept;
} }
} }