slfhst/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ajout des règles pour le VLAN IoT (406)

Browse Source
This commit is contained in:
VC
2024-07-05 11:53:07 +02:00
parent 7b357070a2
commit 949c9bbb13
1 changed files with 70 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

70
roles/firewall/templates/firewall.j2
View File

@@ -440,6 +440,65 @@ config rule
option target 'ACCEPT'
option family 'ipv4'
### IoT Rules
## General Rules
# ICMP
config rule
option name 'Allow-ICMP'
option dest 'iot'
list proto 'icmp'
option target 'ACCEPT'
config rule
option name 'Allow-ICMP'
option src 'iot'
list proto 'icmp'
option target 'ACCEPT'
config rule
option name 'Allow-ICMP'
option src 'iot'
list proto 'icmp'
option dest '*'
option target 'ACCEPT'
# DHCP rules
config rule
option name 'Allow-DMZ-DHCP'
option dest 'iot'
list proto 'tcp'
list proto 'udp'
option dest_port '67-68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-DMZ-DHCP'
option src 'iot'
list proto 'tcp'
list proto 'udp'
option dest_port '67-68'
option target 'ACCEPT'
option family 'ipv4'
# DNS Resolution
config rule
option name 'Allow-INPUT-DNS'
option src 'iot'
list proto 'tcp'
list proto 'udp'
option dest_port '53'
option target 'ACCEPT'
option family 'ipv4'
# NTP
config rule
option name 'Allow-OUTPUT-NTP'
option src 'iot'
list proto 'udp'
option dest_port '123'
option target 'ACCEPT'
## Default configuration
config defaults
option syn_flood '1'
@@ -462,6 +521,13 @@ config zone
option forward 'REJECT'
option network 'dmz'
config zone
option name 'iot'
option input 'REJECT'
option output 'REJECT'
option forward 'REJECT'
option network 'iot'
config zone
option name 'wan'
option input 'REJECT'
@@ -488,6 +554,10 @@ config forwarding
option src 'lan'
option dest 'dmz'
config forwarding
option src 'lan'
option dest 'iot'
config forwarding
option src 'lan'
option dest 'orig'