rezometz/firewall
9
0
Fork 0
Code Issues Pull requests 1 Releases Wiki Activity

Structure du filtrage dmz

Browse source
This commit is contained in:
Hugo LEVY-FALK 2019-01-10 00:04:58 +01:00
parent 5c8e1477d9
commit 230d583110
2 changed files with 33 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
zones/adherent.nft
View file

@ -20,7 +20,7 @@ table inet firewall {
elements = {
$if_admin,
$if_supelec,
$if_adherent, # Utile ?
$if_adherent,
}
}

36
zones/dmz.nft
View file

@ -10,17 +10,45 @@ table inet firewall {
flags interval
elements = {
# Si l'on souhaite ajouter des ranges d'ip c'est ici
193.48.225.1-193.48.225.9,
193.48.225.224/27,
}
}
set dmz_allowed_tcp_in {
type ipv4_addr . inet_service
flags interval
elements = {
}
}
set dmz_allowed_tcp_out {
type ipv4_addr . inet_service
flags interval
elements = {
}
}
set dmz_allowed_udp_in {
type ipv4_addr . inet_service
flags interval
elements = {
}
}
set dmz_allowed_udp_out {
type ipv4_addr . inet_service
flags interval
elements = {
}
}
chain to_dmz {
# DMZ, tout le monde entre
accept;
ip daddr . tcp dport @dmz_allowed_tcp_in accept;
ip daddr . udp dport @dmz_allowed_udp_in accept;
drop;
}
chain from_dmz {
# DMZ, tout le monde sort
ip saddr . tcp dport @dmz_allowed_tcp_out accept;
ip saddr . udp dport @dmz_allowed_udp_out accept;
}
}