|
1
|
<?xml version="1.0" encoding="UTF-8" ?>
|
|
2
|
|
|
3
|
<firewall name="modeles/2zones.xml" netbios="1" qos="0" version="2.3">
|
|
4
|
<zones>
|
|
5
|
<zone name="exterieur" level="10" ip="%%adresse_ip_eth0" network="%%adresse_network_eth0" netmask="%%adresse_netmask_eth0" interface="%%nom_zone_eth0"/>
|
|
6
|
<zone name="admin" level="50" ip="%%adresse_ip_eth1" network="%%adresse_network_eth1" netmask="%%adresse_netmask_eth1" interface="%%nom_zone_eth1"/>
|
|
7
|
<zone name="bastion" level="100" ip="127.0.0.1" network="0.0.0.0" netmask="255.255.255.255" interface="lo"/>
|
|
8
|
</zones>
|
|
9
|
<include></include>
|
|
10
|
<services>
|
|
11
|
<service name="8500" protocol="tcp" ports="8500" id="11" libelle="service 8500" tcpwrapper=""/>
|
|
12
|
<service name="agents_zephir" protocol="tcp" ports="8090" id="46" libelle="Acces web aux agents Zéphir" tcpwrapper=""/>
|
|
13
|
<service name="cntlm" protocol="tcp" ports="%%cntlm_port" id="67" libelle="Proxy Cntlm" tcpwrapper=""/>
|
|
14
|
<service name="cups" protocol="tcp" ports="631" id="76" libelle="Interface CUPS" tcpwrapper=""/>
|
|
15
|
<service name="dns-tcp" protocol="tcp" ports="53" id="6" libelle="serveur de noms" tcpwrapper=""/>
|
|
16
|
<service name="dns-udp" protocol="udp" ports="53" id="7" libelle="serveur de noms" tcpwrapper=""/>
|
|
17
|
<service name="ead" protocol="tcp" ports="4200" id="36" libelle="ead" tcpwrapper=""/>
|
|
18
|
<service name="ead-scribe" protocol="tcp" ports="%%revprox_ead_port" id="73" libelle="port EAD du Scribe avec reverse proxy" tcpwrapper=""/>
|
|
19
|
<service name="echo-reply" protocol="ICMP" ports="0" id="echo-reply" libelle="règle icmp echo-reply" tcpwrapper=""/>
|
|
20
|
<service name="echo-request" protocol="ICMP" ports="0" id="echo-request" libelle="règle icmp echo-request" tcpwrapper=""/>
|
|
21
|
<service name="eole-sso" protocol="tcp" ports="%%eolesso_port" id="45" libelle="Service Eole SSO" tcpwrapper=""/>
|
|
22
|
<service name="esp" protocol="esp" ports="0" id="51" libelle="protocole pour ipsec" tcpwrapper=""/>
|
|
23
|
<service name="ftp" protocol="tcp" ports="21" id="78" libelle="transfert de fichiers sur le port 21" tcpwrapper=""/>
|
|
24
|
<service name="ftp-tcp" protocol="tcp" ports="20-21" id="26" libelle="transfert de fichiers" tcpwrapper=""/>
|
|
25
|
<service name="ftps" protocol="tcp" ports="989-990" id="29" libelle="service ftps" tcpwrapper=""/>
|
|
26
|
<service name="gen_config" protocol="tcp" ports="7000" id="68" libelle="Accès à gen_config depuis l'extérieur en https" tcpwrapper=""/>
|
|
27
|
<service name="http" protocol="tcp" ports="80" id="3" libelle="serveur web" tcpwrapper=""/>
|
|
28
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="serveur web sécurisé" tcpwrapper=""/>
|
|
29
|
<service name="imap" protocol="tcp" ports="143" id="21" libelle="service imap" tcpwrapper=""/>
|
|
30
|
<service name="imap4-ssl" protocol="tcp" ports="993" id="23" libelle="service imap4-ssl" tcpwrapper=""/>
|
|
31
|
<service name="irc" protocol="tcp" ports="194" id="15" libelle="service irc" tcpwrapper=""/>
|
|
32
|
<service name="ircs" protocol="tcp" ports="994" id="16" libelle="service ircs" tcpwrapper=""/>
|
|
33
|
<service name="ircu" protocol="tcp" ports="6665-6669" id="13" libelle="service ircu" tcpwrapper=""/>
|
|
34
|
<service name="isakmp_4500" protocol="udp" ports="4500" id="53" libelle="protocole pour ipsec" tcpwrapper=""/>
|
|
35
|
<service name="isakmp_500" protocol="udp" ports="500" id="52" libelle="protocol pour ipsec" tcpwrapper=""/>
|
|
36
|
<service name="ldap" protocol="tcp" ports="389" id="22" libelle="service d'annuaire" tcpwrapper="slapd"/>
|
|
37
|
<service name="ldaps" protocol="tcp" ports="636" id="24" libelle="service ldaps" tcpwrapper="slapd"/>
|
|
38
|
<service name="lightsquid" protocol="tcp" ports="%%lightsquid_port" id="54" libelle="port d'accès à l'application lightsquid" tcpwrapper=""/>
|
|
39
|
<service name="lockd" protocol="tcp" ports="4005" id="61" libelle="" tcpwrapper=""/>
|
|
40
|
<service name="ltspfsd" protocol="tcp" ports="9220" id="72" libelle="ltspfsd" tcpwrapper=""/>
|
|
41
|
<service name="mdqs" protocol="tcp" ports="666" id="15" libelle="service mdqs" tcpwrapper=""/>
|
|
42
|
<service name="mountd" protocol="tcp" ports="4003" id="62" libelle="" tcpwrapper=""/>
|
|
43
|
<service name="msnp" protocol="tcp" ports="1863" id="17" libelle="service msnp" tcpwrapper=""/>
|
|
44
|
<service name="nbd-client" protocol="tcp" ports="2000" id="71" libelle="nbd-client" tcpwrapper=""/>
|
|
45
|
<service name="news" protocol="tcp" ports="2009" id="32" libelle="nouvelles" tcpwrapper=""/>
|
|
46
|
<service name="nntp" protocol="tcp" ports="119" id="30" libelle="service nntp" tcpwrapper=""/>
|
|
47
|
<service name="nntps" protocol="tcp" ports="563" id="31" libelle="service nntps" tcpwrapper=""/>
|
|
48
|
<service name="ntp" protocol="udp" ports="123" id="56" libelle="serveur de temps" tcpwrapper=""/>
|
|
49
|
<service name="nuauth" protocol="tcp" ports="4129" id="43" libelle="Serveur d'authentification NuFw" tcpwrapper=""/>
|
|
50
|
<service name="pftp" protocol="tcp" ports="662" id="28" libelle="service pftp" tcpwrapper=""/>
|
|
51
|
<service name="pop" protocol="tcp" ports="110" id="20" libelle="service pop" tcpwrapper=""/>
|
|
52
|
<service name="pop3s" protocol="tcp" ports="995" id="25" libelle="service pop3s" tcpwrapper=""/>
|
|
53
|
<service name="portmap" protocol="tcp" ports="111" id="60" libelle="" tcpwrapper=""/>
|
|
54
|
<service name="posh-admin" protocol="tcp" ports="7070" id="48" libelle="administration posh" tcpwrapper=""/>
|
|
55
|
<service name="proxy" protocol="tcp" ports="3128" id="4" libelle="service proxy" tcpwrapper=""/>
|
|
56
|
<service name="proxy-8080" protocol="tcp" ports="8080" id="12" libelle="proxy" tcpwrapper=""/>
|
|
57
|
<service name="proxy2" protocol="tcp" ports="%%dansguardian_port3" id="55" libelle="port 2eme instance de squid" tcpwrapper=""/>
|
|
58
|
<service name="pulseaudio" protocol="tcp" ports="16001" id="70" libelle="pulseaudio" tcpwrapper=""/>
|
|
59
|
<service name="radius" protocol="udp" ports="1812" id="70" libelle="" tcpwrapper=""/>
|
|
60
|
<service name="radius-acct" protocol="udp" ports="1813" id="74" libelle="" tcpwrapper=""/>
|
|
61
|
<service name="revprox-sso" protocol="tcp" ports="8443" id="79" libelle="Redirection du service EoleSSO" tcpwrapper=""/>
|
|
62
|
<service name="rsyslog_RELP" protocol="tcp" ports="20514" id="64" libelle="protocole RELP pour rsyslog" tcpwrapper=""/>
|
|
63
|
<service name="rsyslog_TCP" protocol="tcp" ports="10514" id="65" libelle="protocole TCP pour rsyslog" tcpwrapper=""/>
|
|
64
|
<service name="rsyslog_UDP" protocol="udp" ports="514" id="66" libelle="protocole UDP pour rsyslog" tcpwrapper=""/>
|
|
65
|
<service name="samba-tcp" protocol="tcp" ports="137-139" id="38" libelle="samba tcp" tcpwrapper=""/>
|
|
66
|
<service name="samba-udp" protocol="udp" ports="137-139" id="37" libelle="samba" tcpwrapper=""/>
|
|
67
|
<service name="samba3" protocol="tcp" ports="445" id="39" libelle="samba3" tcpwrapper=""/>
|
|
68
|
<service name="scribe-controlevnc" protocol="tcp" ports="8789-8790" id="45" libelle="" tcpwrapper=""/>
|
|
69
|
<service name="scribe-service" protocol="tcp" ports="8788" id="36" libelle="service scribe sur les clients" tcpwrapper=""/>
|
|
70
|
<service name="scribe_vnc1" protocol="tcp" ports="5800" id="40" libelle="vnc 5800" tcpwrapper=""/>
|
|
71
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" tcpwrapper=""/>
|
|
72
|
<service name="serveur_nfs" protocol="tcp" ports="2049" id="59" libelle="Serveur NFS" tcpwrapper=""/>
|
|
73
|
<service name="sftp" protocol="tcp" ports="115" id="27" libelle="service sftp" tcpwrapper=""/>
|
|
74
|
<service name="smtp" protocol="tcp" ports="25" id="19" libelle="service mail" tcpwrapper=""/>
|
|
75
|
<service name="smtps" protocol="tcp" ports="465" id="77" libelle="Service SMTP SSL" tcpwrapper=""/>
|
|
76
|
<service name="ssh" protocol="tcp" ports="22" id="8" libelle="shell sécrurisé" tcpwrapper="sshd"/>
|
|
77
|
<service name="sympa-internet" protocol="tcp" ports="8787" id="58" libelle="serveur sympa internet" tcpwrapper=""/>
|
|
78
|
<service name="sympa-restreint" protocol="tcp" ports="8888" id="57" libelle="sympa domaine restreint" tcpwrapper=""/>
|
|
79
|
<service name="talk" protocol="tcp" ports="517-518" id="18" libelle="service talk" tcpwrapper=""/>
|
|
80
|
<service name="tcp" protocol="tcp" ports="0-65535" id="33" libelle="tous les ports en tcp" tcpwrapper=""/>
|
|
81
|
<service name="tftpd-hpa" protocol="udp" ports="69" id="75" libelle="Accès aux serveurs TFTP" tcpwrapper="in.tftpd"/>
|
|
82
|
<service name="totoserv" protocol="tcp" ports="8000" id="75" libelle="totoserv" tcpwrapper="blabla"/>
|
|
83
|
<service name="tous" protocol="TOUT" ports="0" id="tout" libelle="tous les services" tcpwrapper=""/>
|
|
84
|
<service name="udp" protocol="udp" ports="0-65535" id="34" libelle="tous les ports en udp" tcpwrapper=""/>
|
|
85
|
<service name="webmin" protocol="tcp" ports="10000" id="9" libelle="appliquation web d'administration" tcpwrapper=""/>
|
|
86
|
<service name="xmpp" protocol="tcp" ports="5222" id="63" libelle="Serveur jabber (XMPP)" tcpwrapper=""/>
|
|
87
|
<groupe id="admin_amon" libelle="Port autorise pour l'administration distante d'Amon (ssh, ead, agents zephir)">
|
|
88
|
<service name="agents_zephir" protocol="tcp" ports="8090" id="46" libelle="Acces web aux agents Zéphir" tcpwrapper=""/>
|
|
89
|
<service name="ead" protocol="tcp" ports="4200" id="36" libelle="ead" tcpwrapper=""/>
|
|
90
|
<service name="echo-request" protocol="ICMP" ports="0" id="echo-request" libelle="règle icmp echo-request" tcpwrapper=""/>
|
|
91
|
</groupe>
|
|
92
|
<groupe id="dns" libelle="dns tcp et udp">
|
|
93
|
<service name="dns-udp" protocol="udp" ports="53" id="7" libelle="serveur de noms" tcpwrapper=""/>
|
|
94
|
<service name="dns-tcp" protocol="tcp" ports="53" id="6" libelle="serveur de noms" tcpwrapper=""/>
|
|
95
|
</groupe>
|
|
96
|
<groupe id="eclair-dmz" libelle="Eclair en DMZ">
|
|
97
|
<service name="ltspfsd" protocol="tcp" ports="9220" id="72" libelle="ltspfsd" tcpwrapper=""/>
|
|
98
|
<service name="nbd-client" protocol="tcp" ports="2000" id="71" libelle="nbd-client" tcpwrapper=""/>
|
|
99
|
<service name="pulseaudio" protocol="tcp" ports="16001" id="70" libelle="pulseaudio" tcpwrapper=""/>
|
|
100
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" tcpwrapper=""/>
|
|
101
|
</groupe>
|
|
102
|
<groupe id="gr_ead" libelle="eole admin">
|
|
103
|
<service name="ead" protocol="tcp" ports="8501" id="10" libelle="Eole Admin" tcpwrapper=""/>
|
|
104
|
<service name="8500" protocol="tcp" ports="8500" id="11" libelle="service 8500" tcpwrapper=""/>
|
|
105
|
</groupe>
|
|
106
|
<groupe id="gr_forum" libelle="interdire l'utilisation des forums">
|
|
107
|
<service name="nntp" protocol="tcp" ports="119" id="30" libelle="service nntp" tcpwrapper=""/>
|
|
108
|
<service name="nntps" protocol="tcp" ports="563" id="31" libelle="service nntps" tcpwrapper=""/>
|
|
109
|
<service name="news" protocol="tcp" ports="2009" id="32" libelle="nouvelles" tcpwrapper=""/>
|
|
110
|
</groupe>
|
|
111
|
<groupe id="gr_ftp" libelle="">
|
|
112
|
<service name="ftp-tcp" protocol="tcp" ports="20-21" id="26" libelle="transfert de fichiers" tcpwrapper=""/>
|
|
113
|
<service name="ftps" protocol="tcp" ports="989-990" id="29" libelle="service ftps" tcpwrapper=""/>
|
|
114
|
<service name="pftp" protocol="tcp" ports="662" id="28" libelle="service pftp" tcpwrapper=""/>
|
|
115
|
<service name="sftp" protocol="tcp" ports="115" id="27" libelle="service sftp" tcpwrapper=""/>
|
|
116
|
</groupe>
|
|
117
|
<groupe id="gr_imap" libelle="imap et imap-ssl">
|
|
118
|
<service name="imap" protocol="tcp" ports="143" id="21" libelle="service imap" tcpwrapper=""/>
|
|
119
|
<service name="imap4-ssl" protocol="tcp" ports="993" id="23" libelle="service imap4-ssl" tcpwrapper=""/>
|
|
120
|
</groupe>
|
|
121
|
<groupe id="gr_irc" libelle="interdire l'utilisation des dialogues en direct (icq)">
|
|
122
|
<service name="talk" protocol="tcp" ports="517-518" id="18" libelle="service talk" tcpwrapper=""/>
|
|
123
|
<service name="msnp" protocol="tcp" ports="1863" id="17" libelle="service msnp" tcpwrapper=""/>
|
|
124
|
<service name="mdqs" protocol="tcp" ports="666" id="15" libelle="service mdqs" tcpwrapper=""/>
|
|
125
|
<service name="ircs" protocol="tcp" ports="994" id="16" libelle="service ircs" tcpwrapper=""/>
|
|
126
|
<service name="irc" protocol="tcp" ports="194" id="15" libelle="service irc" tcpwrapper=""/>
|
|
127
|
<service name="ircu" protocol="tcp" ports="6665-6669" id="13" libelle="service ircu" tcpwrapper=""/>
|
|
128
|
</groupe>
|
|
129
|
<groupe id="gr_messagerie" libelle="interdire l'utilisation des dialogues en direct (icq)">
|
|
130
|
<service name="imap" protocol="tcp" ports="143" id="21" libelle="service imap" tcpwrapper=""/>
|
|
131
|
<service name="imap4-ssl" protocol="tcp" ports="993" id="23" libelle="service imap4-ssl" tcpwrapper=""/>
|
|
132
|
<service name="ldap" protocol="tcp" ports="389" id="22" libelle="service d'annuaire" tcpwrapper="slapd"/>
|
|
133
|
<service name="ldaps" protocol="tcp" ports="636" id="24" libelle="service ldaps" tcpwrapper="slapd"/>
|
|
134
|
<service name="pop" protocol="tcp" ports="110" id="20" libelle="service pop" tcpwrapper=""/>
|
|
135
|
<service name="pop3s" protocol="tcp" ports="995" id="25" libelle="service pop3s" tcpwrapper=""/>
|
|
136
|
<service name="smtp" protocol="tcp" ports="25" id="19" libelle="service mail" tcpwrapper=""/>
|
|
137
|
<service name="smtps" protocol="tcp" ports="465" id="77" libelle="Service SMTP SSL" tcpwrapper=""/>
|
|
138
|
</groupe>
|
|
139
|
<groupe id="gr_pop" libelle="pop3 et pop3s">
|
|
140
|
<service name="pop" protocol="tcp" ports="110" id="20" libelle="service pop" tcpwrapper=""/>
|
|
141
|
<service name="pop3s" protocol="tcp" ports="995" id="25" libelle="service pop3s" tcpwrapper=""/>
|
|
142
|
</groupe>
|
|
143
|
<groupe id="gr_radius" libelle="Serveur radius (UDP)">
|
|
144
|
<service name="radius" protocol="udp" ports="1812" id="70" libelle="" tcpwrapper=""/>
|
|
145
|
<service name="radius-acct" protocol="udp" ports="1813" id="74" libelle="" tcpwrapper=""/>
|
|
146
|
</groupe>
|
|
147
|
<groupe id="gr_redirection" libelle="Protocoles a rediriger vers le proxy">
|
|
148
|
<service name="http" protocol="tcp" ports="80" id="3" libelle="serveur web" tcpwrapper=""/>
|
|
149
|
<service name="proxy" protocol="tcp" ports="3128" id="4" libelle="service proxy" tcpwrapper=""/>
|
|
150
|
<service name="proxy-8080" protocol="tcp" ports="8080" id="12" libelle="proxy" tcpwrapper=""/>
|
|
151
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="serveur web sécurisé" tcpwrapper=""/>
|
|
152
|
</groupe>
|
|
153
|
<groupe id="gr_redirection_http" libelle="Protocoles http a rediriger vers le proxy">
|
|
154
|
<service name="http" protocol="tcp" ports="80" id="3" libelle="serveur web" tcpwrapper=""/>
|
|
155
|
<service name="proxy" protocol="tcp" ports="3128" id="4" libelle="service proxy" tcpwrapper=""/>
|
|
156
|
<service name="proxy-8080" protocol="tcp" ports="8080" id="12" libelle="proxy" tcpwrapper=""/>
|
|
157
|
</groupe>
|
|
158
|
<groupe id="gr_redirection_https" libelle="Https a redifiger vers le proxy">
|
|
159
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="serveur web sécurisé" tcpwrapper=""/>
|
|
160
|
</groupe>
|
|
161
|
<groupe id="gr_restreint" libelle="on ferme tout sauf l'utilisation du web par le proxy">
|
|
162
|
<service name="tcp" protocol="tcp" ports="0-65535" id="33" libelle="tous les ports en tcp" tcpwrapper=""/>
|
|
163
|
<service name="udp" protocol="udp" ports="0-65535" id="34" libelle="tous les ports en udp" tcpwrapper=""/>
|
|
164
|
</groupe>
|
|
165
|
<groupe id="gr_smtp" libelle="smtp et smtps">
|
|
166
|
<service name="smtp" protocol="tcp" ports="25" id="19" libelle="service mail" tcpwrapper=""/>
|
|
167
|
<service name="smtps" protocol="tcp" ports="465" id="77" libelle="Service SMTP SSL" tcpwrapper=""/>
|
|
168
|
</groupe>
|
|
169
|
<groupe id="ipsec" libelle="Services utilises pas ipsec">
|
|
170
|
<service name="esp" protocol="esp" ports="0" id="51" libelle="protocole pour ipsec" tcpwrapper=""/>
|
|
171
|
<service name="isakmp_4500" protocol="udp" ports="4500" id="53" libelle="protocole pour ipsec" tcpwrapper=""/>
|
|
172
|
<service name="isakmp_500" protocol="udp" ports="500" id="52" libelle="protocol pour ipsec" tcpwrapper=""/>
|
|
173
|
</groupe>
|
|
174
|
<groupe id="nfs" libelle="Serveur NFS + portmap">
|
|
175
|
<service name="portmap" protocol="tcp" ports="111" id="60" libelle="" tcpwrapper=""/>
|
|
176
|
<service name="lockd" protocol="tcp" ports="4005" id="61" libelle="" tcpwrapper=""/>
|
|
177
|
<service name="mountd" protocol="tcp" ports="4003" id="62" libelle="" tcpwrapper=""/>
|
|
178
|
<service name="serveur_nfs" protocol="tcp" ports="2049" id="59" libelle="Serveur NFS" tcpwrapper=""/>
|
|
179
|
</groupe>
|
|
180
|
<groupe id="samba" libelle="samba proto">
|
|
181
|
<service name="samba-udp" protocol="udp" ports="137-139" id="37" libelle="samba" tcpwrapper=""/>
|
|
182
|
<service name="samba-tcp" protocol="tcp" ports="137-139" id="38" libelle="samba tcp" tcpwrapper=""/>
|
|
183
|
<service name="samba3" protocol="tcp" ports="445" id="39" libelle="samba3" tcpwrapper=""/>
|
|
184
|
</groupe>
|
|
185
|
<groupe id="scribe-pedago" libelle="service Scribe DMZ vers pedago">
|
|
186
|
<service name="samba-tcp" protocol="tcp" ports="137-139" id="38" libelle="samba tcp" tcpwrapper=""/>
|
|
187
|
<service name="samba-udp" protocol="udp" ports="137-139" id="37" libelle="samba" tcpwrapper=""/>
|
|
188
|
<service name="samba3" protocol="tcp" ports="445" id="39" libelle="samba3" tcpwrapper=""/>
|
|
189
|
<service name="scribe-service" protocol="tcp" ports="8788" id="36" libelle="service scribe sur les clients" tcpwrapper=""/>
|
|
190
|
<service name="scribe_vnc1" protocol="tcp" ports="5800" id="40" libelle="vnc 5800" tcpwrapper=""/>
|
|
191
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" tcpwrapper=""/>
|
|
192
|
</groupe>
|
|
193
|
<groupe id="scribe-pedago-dmz" libelle="client scribe vers la DMZ">
|
|
194
|
<service name="ldap" protocol="tcp" ports="389" id="22" libelle="service d'annuaire" tcpwrapper="slapd"/>
|
|
195
|
<service name="ldaps" protocol="tcp" ports="636" id="24" libelle="service ldaps" tcpwrapper="slapd"/>
|
|
196
|
<service name="samba-tcp" protocol="tcp" ports="137-139" id="38" libelle="samba tcp" tcpwrapper=""/>
|
|
197
|
<service name="samba-udp" protocol="udp" ports="137-139" id="37" libelle="samba" tcpwrapper=""/>
|
|
198
|
<service name="samba3" protocol="tcp" ports="445" id="39" libelle="samba3" tcpwrapper=""/>
|
|
199
|
<service name="scribe-controlevnc" protocol="tcp" ports="8789-8790" id="45" libelle="" tcpwrapper=""/>
|
|
200
|
<service name="scribe_vnc1" protocol="tcp" ports="5800" id="40" libelle="vnc 5800" tcpwrapper=""/>
|
|
201
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" tcpwrapper=""/>
|
|
202
|
</groupe>
|
|
203
|
<groupe id="scribe-posh" libelle="Ouverture des ports pour l'utilisation de nginx pour Posh">
|
|
204
|
<service name="http" protocol="tcp" ports="80" id="3" libelle="serveur web" tcpwrapper=""/>
|
|
205
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="serveur web sécurisé" tcpwrapper=""/>
|
|
206
|
<service name="posh-admin" protocol="tcp" ports="7070" id="48" libelle="administration posh" tcpwrapper=""/>
|
|
207
|
</groupe>
|
|
208
|
<groupe id="scribe_ext" libelle="services extranet scribe ">
|
|
209
|
<service name="ftp-tcp" protocol="tcp" ports="20-21" id="26" libelle="transfert de fichiers" tcpwrapper=""/>
|
|
210
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="serveur web sécurisé" tcpwrapper=""/>
|
|
211
|
</groupe>
|
|
212
|
<groupe id="sympa" libelle="serveur sympa">
|
|
213
|
<service name="sympa-internet" protocol="tcp" ports="8787" id="58" libelle="serveur sympa internet" tcpwrapper=""/>
|
|
214
|
<service name="sympa-restreint" protocol="tcp" ports="8888" id="57" libelle="sympa domaine restreint" tcpwrapper=""/>
|
|
215
|
</groupe>
|
|
216
|
<groupe id="vnc" libelle="vnc">
|
|
217
|
<service name="scribe_vnc1" protocol="tcp" ports="5800" id="40" libelle="vnc 5800" tcpwrapper=""/>
|
|
218
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" tcpwrapper=""/>
|
|
219
|
</groupe>
|
|
220
|
</services>
|
|
221
|
<qosclasses upload="" download="">
|
|
222
|
</qosclasses>
|
|
223
|
<extremites>
|
|
224
|
<extremite zone="admin" name="admin_restreint" libelle="zone restreinte" netmask="%%adresse_netmask_eth1" subnet="1" type="" interface="" container="">
|
|
225
|
<ip address="%%adresse_network_eth1"/>
|
|
226
|
</extremite>
|
|
227
|
<extremite zone="exterieur" name="exterieur" libelle="Zone entière" netmask="%%adresse_netmask_eth0" subnet="1" type="" interface="" container="">
|
|
228
|
<ip address="%%adresse_ip_eth0"/>
|
|
229
|
</extremite>
|
|
230
|
<extremite zone="bastion" name="internet_eth1" libelle="eth1 dans le conteneur internet" netmask="255.255.255.255" subnet="0" type="conteneur" interface="eth1" container="internet">
|
|
231
|
<ip address="%%adresse_ip_eth1_proxy_link"/>
|
|
232
|
</extremite>
|
|
233
|
<extremite zone="exterieur" name="exterieur_admin" libelle="reseau autorise a administrer depuis l'exterieur" netmask="%%netmask_admin_eth0" subnet="1" type="" interface="" container="">
|
|
234
|
<ip address="%%ip_admin_eth0"/>
|
|
235
|
</extremite>
|
|
236
|
<extremite zone="exterieur" name="exterieur_restreint" libelle="zone restreinte" netmask="%%adresse_netmask_eth0" subnet="1" type="" interface="" container="">
|
|
237
|
<ip address="%%adresse_network_eth0"/>
|
|
238
|
</extremite>
|
|
239
|
<extremite zone="admin" name="admin_admin" libelle="reseau autorise a administrer depuis le reseau administratif" netmask="%%netmask_admin_eth1" subnet="1" type="" interface="" container="">
|
|
240
|
<ip address="%%ip_admin_eth1"/>
|
|
241
|
</extremite>
|
|
242
|
<extremite zone="exterieur" name="clients_relp_rsyslog" libelle="clients de l'agrégateur de logs en relp" netmask="%%netmask_client_logs_relp" subnet="0" type="" interface="" container="">
|
|
243
|
<ip address="%%adresses_ip_clients_logs_relp"/>
|
|
244
|
</extremite>
|
|
245
|
<extremite zone="exterieur" name="clients_udp_rsyslog" libelle="clients de l'agrégateur de logs en udp" netmask="%%netmask_client_logs_udp" subnet="0" type="" interface="" container="">
|
|
246
|
<ip address="%%adresses_ip_clients_logs_udp"/>
|
|
247
|
</extremite>
|
|
248
|
<extremite zone="exterieur" name="admin_bastion" libelle="adresse du bastion sur le reseau admin" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
249
|
<ip address="%%adresse_ip_eth1"/>
|
|
250
|
</extremite>
|
|
251
|
<extremite zone="bastion" name="internet_eth2" libelle="eth2 dans le conteneur internet" netmask="255.255.255.255" subnet="0" type="conteneur" interface="eth2" container="internet">
|
|
252
|
<ip address="%%adresse_ip_eth2_proxy_link"/>
|
|
253
|
</extremite>
|
|
254
|
<extremite zone="exterieur" name="clients_tcp_rsyslog" libelle="clients de l'agrégateur de logs en tcp" netmask="%%netmask_client_logs_tcp" subnet="0" type="" interface="" container="">
|
|
255
|
<ip address="%%adresses_ip_clients_logs_tcp"/>
|
|
256
|
</extremite>
|
|
257
|
<extremite zone="admin" name="admin_ssh" libelle="reseau autorise a se connecter a ssh depuis le reseau administratif" netmask="%%netmask_ssh_eth1" subnet="1" type="" interface="" container="">
|
|
258
|
<ip address="%%ip_ssh_eth1"/>
|
|
259
|
</extremite>
|
|
260
|
<extremite zone="admin" name="admin" libelle="Zone entière" netmask="%%adresse_netmask_eth1" subnet="1" type="" interface="" container="">
|
|
261
|
<ip address="%%adresse_ip_eth1"/>
|
|
262
|
</extremite>
|
|
263
|
<extremite zone="exterieur" name="exterieur_ssh" libelle="reseau autorise a se connecter a ssh" netmask="%%netmask_ssh_eth0" subnet="1" type="" interface="" container="">
|
|
264
|
<ip address="%%ip_ssh_eth0"/>
|
|
265
|
</extremite>
|
|
266
|
<extremite zone="bastion" name="bastion" libelle="Zone entière" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
267
|
<ip address="127.0.0.1"/>
|
|
268
|
</extremite>
|
|
269
|
<extremite zone="bastion" name="internet" libelle="conteneur internet" netmask="255.255.255.255" subnet="0" type="conteneur" interface="containers" container="internet">
|
|
270
|
<ip address="%%container_ip_internet"/>
|
|
271
|
</extremite>
|
|
272
|
<extremite zone="exterieur" name="exterieur_bastion" libelle="IP de bastion sur la zone exterieur" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
273
|
<ip address="%%adresse_ip_eth0"/>
|
|
274
|
</extremite>
|
|
275
|
</extremites>
|
|
276
|
<ranges>
|
|
277
|
</ranges>
|
|
278
|
<user_groups>
|
|
279
|
</user_groups>
|
|
280
|
<applications>
|
|
281
|
</applications>
|
|
282
|
<flux-list>
|
|
283
|
<flux zoneA="bastion" zoneB="exterieur">
|
|
284
|
<montantes default_policy="0">
|
|
285
|
<directive tag="ActiverNGINX" service="scribe-posh" priority="1" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="ouverture de posh a travers de nginx" ipsec="0" accept="0">
|
|
286
|
<source name="exterieur"/>
|
|
287
|
<destination name="bastion"/>
|
|
288
|
</directive>
|
|
289
|
<directive tag="ead_scribe" service="ead-scribe" priority="2" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="ouverture de l'EAD Scribe a travers de nginx" ipsec="0" accept="0">
|
|
290
|
<source name="exterieur"/>
|
|
291
|
<destination name="bastion"/>
|
|
292
|
</directive>
|
|
293
|
<directive tag="SSHDepuisEth0" service="ssh" priority="3" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="ssh exterieur vers Amon" ipsec="0" accept="0">
|
|
294
|
<source name="exterieur_ssh"/>
|
|
295
|
<destination name="bastion"/>
|
|
296
|
</directive>
|
|
297
|
<directive tag="AdminDepuisEth0" service="admin_amon" priority="4" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="administration exterieure vers Amon" ipsec="0" accept="0">
|
|
298
|
<source name="exterieur_admin"/>
|
|
299
|
<destination name="bastion"/>
|
|
300
|
</directive>
|
|
301
|
<directive tag="lightsquid0" service="lightsquid" priority="5" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="administration exterieure vers Amon" ipsec="0" accept="0">
|
|
302
|
<source name="exterieur_admin"/>
|
|
303
|
<destination name="bastion"/>
|
|
304
|
</directive>
|
|
305
|
<directive tag="eole_sso" service="eole-sso" priority="6" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
306
|
<source name="exterieur"/>
|
|
307
|
<destination name="bastion"/>
|
|
308
|
</directive>
|
|
309
|
<directive tag="revprox_sso" service="revprox-sso" priority="7" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="redirection du service EoleSSO par le proxy inverse" ipsec="0" accept="0">
|
|
310
|
<source name="exterieur"/>
|
|
311
|
<destination name="bastion"/>
|
|
312
|
</directive>
|
|
313
|
<directive service="ipsec" priority="8" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser ipsec" ipsec="0" accept="0">
|
|
314
|
<source name="exterieur"/>
|
|
315
|
<destination name="bastion"/>
|
|
316
|
</directive>
|
|
317
|
<directive tag="SSHDepuisEth0" service="gen_config" priority="9" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="gen_config exterieur vers Amon" ipsec="0" accept="0">
|
|
318
|
<source name="exterieur_ssh"/>
|
|
319
|
<destination name="bastion"/>
|
|
320
|
</directive>
|
|
321
|
<directive tag="ClientRsyslogRELP" service="rsyslog_RELP" priority="10" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
322
|
<source name="clients_relp_rsyslog"/>
|
|
323
|
<destination name="bastion"/>
|
|
324
|
</directive>
|
|
325
|
<directive tag="ClientRsyslogTCP" service="rsyslog_TCP" priority="11" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
326
|
<source name="clients_tcp_rsyslog"/>
|
|
327
|
<destination name="bastion"/>
|
|
328
|
</directive>
|
|
329
|
<directive tag="ClientRsyslogUDP" service="rsyslog_UDP" priority="12" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
330
|
<source name="clients_udp_rsyslog"/>
|
|
331
|
<destination name="bastion"/>
|
|
332
|
</directive>
|
|
333
|
</montantes>
|
|
334
|
<descendantes default_policy="1">
|
|
335
|
</descendantes>
|
|
336
|
</flux>
|
|
337
|
<flux zoneA="exterieur" zoneB="admin">
|
|
338
|
<montantes default_policy="1">
|
|
339
|
<directive service="8500" priority="1" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="directive avec exception de type nom" ipsec="0" accept="0">
|
|
340
|
<source name="exterieur"/>
|
|
341
|
<destination name="admin"/>
|
|
342
|
<exception name="ac-dijon.fr" ip="" eolvar="" src="0" dest="1"/>
|
|
343
|
</directive>
|
|
344
|
</montantes>
|
|
345
|
<descendantes default_policy="1">
|
|
346
|
<directive service="totoserv" priority="1" action="16" attrs="0" nat_extr="exterieur_bastion" nat_port="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
347
|
<source name="admin_restreint"/>
|
|
348
|
<destination name="exterieur"/>
|
|
349
|
</directive>
|
|
350
|
<directive tag="ProxyBypass1" service="gr_redirection_http" priority="2" action="4" attrs="17" nat_port="3128" src_inv="0" dest_inv="1" serv_inv="0" libelle="Redirection des flux http sans proxy" ipsec="0" accept="0">
|
|
351
|
<source name="admin"/>
|
|
352
|
<destination name="exterieur_bastion"/>
|
|
353
|
<exception name="" ip="" eolvar="%%proxy_bypass_network_eth1/%%calc_classe(%%proxy_bypass_netmask_eth1)" src="0" dest="1"/>
|
|
354
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth1" src="0" dest="1"/>
|
|
355
|
</directive>
|
|
356
|
<directive tag="ProxyBypass1" service="gr_redirection_http" priority="3" action="4" attrs="17" nat_port="81" src_inv="0" dest_inv="0" serv_inv="0" libelle="Redirection des flux vers le serveur de distribution du fichier wpad" ipsec="0" accept="0">
|
|
357
|
<source name="admin"/>
|
|
358
|
<destination name="exterieur"/>
|
|
359
|
<exception name="" ip="" eolvar="%%proxy_bypass_network_eth1/%%calc_classe(%%proxy_bypass_netmask_eth1)" src="0" dest="1"/>
|
|
360
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth1" src="0" dest="1"/>
|
|
361
|
</directive>
|
|
362
|
<directive tag="ProxyBypass1" service="gr_redirection_https" priority="4" action="4" attrs="17" nat_port="82" src_inv="0" dest_inv="0" serv_inv="0" libelle="Redirection des flux https sans proxy vers une page d'erreur" ipsec="0" accept="0">
|
|
363
|
<source name="admin"/>
|
|
364
|
<destination name="exterieur"/>
|
|
365
|
<exception name="" ip="" eolvar="%%proxy_bypass_network_eth1/%%calc_classe(%%proxy_bypass_netmask_eth1)" src="0" dest="1"/>
|
|
366
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth1" src="0" dest="1"/>
|
|
367
|
</directive>
|
|
368
|
</descendantes>
|
|
369
|
</flux>
|
|
370
|
<flux zoneA="bastion" zoneB="admin">
|
|
371
|
<montantes default_policy="0">
|
|
372
|
<directive service="http" priority="1" action="4" attrs="0" nat_port="81" src_inv="0" dest_inv="0" serv_inv="0" libelle="Redirection pour le fichier wpad." ipsec="0" accept="0">
|
|
373
|
<source name="admin"/>
|
|
374
|
<destination name="bastion"/>
|
|
375
|
</directive>
|
|
376
|
<directive tag="SSHDepuisEth1" service="ssh" priority="2" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="ssh admin vers Amon" ipsec="0" accept="0">
|
|
377
|
<source name="admin_ssh"/>
|
|
378
|
<destination name="bastion"/>
|
|
379
|
</directive>
|
|
380
|
<directive tag="AdminDepuisEth1" service="admin_amon" priority="3" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="administration admin vers Amon" ipsec="0" accept="0">
|
|
381
|
<source name="admin_admin"/>
|
|
382
|
<destination name="bastion"/>
|
|
383
|
</directive>
|
|
384
|
<directive service="dns-tcp" priority="4" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
385
|
<source name="admin"/>
|
|
386
|
<destination name="internet_eth1"/>
|
|
387
|
</directive>
|
|
388
|
<directive service="dns-udp" priority="5" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
389
|
<source name="admin"/>
|
|
390
|
<destination name="internet_eth1"/>
|
|
391
|
</directive>
|
|
392
|
<directive tag="auth_nufw" service="nuauth" priority="6" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="autoriser l'acces a Nuauth" ipsec="0" accept="0">
|
|
393
|
<source name="admin"/>
|
|
394
|
<destination name="bastion"/>
|
|
395
|
</directive>
|
|
396
|
<directive tag="eole_sso" service="eole-sso" priority="7" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
397
|
<source name="admin"/>
|
|
398
|
<destination name="bastion"/>
|
|
399
|
</directive>
|
|
400
|
<directive service="proxy" priority="8" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
401
|
<source name="admin"/>
|
|
402
|
<destination name="internet_eth1"/>
|
|
403
|
</directive>
|
|
404
|
<directive tag="Activer squid2" service="proxy2" priority="9" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
405
|
<source name="admin"/>
|
|
406
|
<destination name="internet_eth1"/>
|
|
407
|
</directive>
|
|
408
|
<directive tag="cntlm" service="cntlm" priority="10" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
409
|
<source name="admin"/>
|
|
410
|
<destination name="internet_eth1"/>
|
|
411
|
</directive>
|
|
412
|
<directive tag="SSHDepuisEth1" service="gen_config" priority="11" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="gen_config admin vers Amon" ipsec="0" accept="0">
|
|
413
|
<source name="admin_ssh"/>
|
|
414
|
<destination name="bastion"/>
|
|
415
|
</directive>
|
|
416
|
<directive tag="ActiverRadiuseth1" service="gr_radius" priority="12" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="raduis admin vers Amon" ipsec="0" accept="0">
|
|
417
|
<source name="admin"/>
|
|
418
|
<destination name="bastion"/>
|
|
419
|
</directive>
|
|
420
|
</montantes>
|
|
421
|
<descendantes default_policy="1">
|
|
422
|
</descendantes>
|
|
423
|
</flux>
|
|
424
|
</flux-list>
|
|
425
|
</firewall>
|