|
1
|
<?xml version="1.0" encoding="UTF-8" ?>
|
|
2
|
|
|
3
|
<firewall name="/usr/share/era/modeles/4zones.xml" netbios="1" qos="0" version="2.42">
|
|
4
|
<zones>
|
|
5
|
<zone name="exterieur" level="10" ip="%%adresse_ip_eth0" network="%%adresse_network_eth0" netmask="%%adresse_netmask_eth0" interface="%%nom_zone_eth0"/>
|
|
6
|
<zone name="dmz" level="30" ip="%%adresse_ip_eth3" network="%%adresse_network_eth3" netmask="%%adresse_netmask_eth3" interface="%%nom_zone_eth3"/>
|
|
7
|
<zone name="pedago" level="40" ip="%%adresse_ip_eth2" network="%%adresse_network_eth2" netmask="%%adresse_netmask_eth2" interface="%%nom_zone_eth2"/>
|
|
8
|
<zone name="admin" level="50" ip="%%adresse_ip_eth1" network="%%adresse_network_eth1" netmask="%%adresse_netmask_eth1" interface="%%nom_zone_eth1"/>
|
|
9
|
<zone name="bastion" level="100" ip="127.0.0.1" network="0.0.0.0" netmask="255.255.255.255" interface="lo"/>
|
|
10
|
</zones>
|
|
11
|
<include>
|
|
12
|
|
|
13
|
|
|
14
|
</include>
|
|
15
|
<services>
|
|
16
|
<service name="8500" protocol="tcp" ports="8500" id="11" libelle="service 8500" tcpwrapper=""/>
|
|
17
|
<service name="agents_zephir" protocol="tcp" ports="8090" id="46" libelle="Acces web aux agents Zéphir" tcpwrapper=""/>
|
|
18
|
<service name="cntlm" protocol="tcp" ports="%%cntlm_port" id="67" libelle="Proxy Cntlm" tcpwrapper=""/>
|
|
19
|
<service name="cups" protocol="tcp" ports="631" id="76" libelle="Interface CUPS" tcpwrapper=""/>
|
|
20
|
<service name="dns-tcp" protocol="tcp" ports="53" id="6" libelle="serveur de noms" tcpwrapper=""/>
|
|
21
|
<service name="dns-udp" protocol="udp" ports="53" id="7" libelle="serveur de noms" tcpwrapper=""/>
|
|
22
|
<service name="ead" protocol="tcp" ports="4200" id="36" libelle="ead" tcpwrapper=""/>
|
|
23
|
<service name="ead-scribe" protocol="tcp" ports="%%revprox_ead_port" id="73" libelle="port EAD du Scribe avec reverse proxy" tcpwrapper=""/>
|
|
24
|
<service name="echo-reply" protocol="ICMP" ports="0" id="echo-reply" libelle="règle icmp echo-reply" tcpwrapper=""/>
|
|
25
|
<service name="echo-request" protocol="ICMP" ports="0" id="echo-request" libelle="règle icmp echo-request" tcpwrapper=""/>
|
|
26
|
<service name="eole-sso" protocol="tcp" ports="%%eolesso_port" id="45" libelle="Service Eole SSO" tcpwrapper=""/>
|
|
27
|
<service name="esp" protocol="esp" ports="0" id="51" libelle="protocole pour ipsec" tcpwrapper=""/>
|
|
28
|
<service name="ftp" protocol="tcp" ports="21" id="78" libelle="transfert de fichiers sur le port 21" tcpwrapper=""/>
|
|
29
|
<service name="ftp-tcp" protocol="tcp" ports="20-21" id="26" libelle="transfert de fichiers" tcpwrapper=""/>
|
|
30
|
<service name="ftps" protocol="tcp" ports="989-990" id="29" libelle="service ftps" tcpwrapper=""/>
|
|
31
|
<service name="gaspacho" protocol="tcp" ports="8080" id="80" libelle="Accès à l'outil Gaspacho" tcpwrapper=""/>
|
|
32
|
<service name="gen_config" protocol="tcp" ports="7000" id="68" libelle="Accès à gen_config depuis l'extérieur en https" tcpwrapper=""/>
|
|
33
|
<service name="http" protocol="tcp" ports="80" id="3" libelle="serveur web" tcpwrapper=""/>
|
|
34
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="serveur web sécurisé" tcpwrapper=""/>
|
|
35
|
<service name="imap" protocol="tcp" ports="143" id="21" libelle="service imap" tcpwrapper=""/>
|
|
36
|
<service name="imap4-ssl" protocol="tcp" ports="993" id="23" libelle="service imap4-ssl" tcpwrapper=""/>
|
|
37
|
<service name="irc" protocol="tcp" ports="194" id="15" libelle="service irc" tcpwrapper=""/>
|
|
38
|
<service name="ircs" protocol="tcp" ports="994" id="16" libelle="service ircs" tcpwrapper=""/>
|
|
39
|
<service name="ircu" protocol="tcp" ports="6665-6669" id="13" libelle="service ircu" tcpwrapper=""/>
|
|
40
|
<service name="isakmp_4500" protocol="udp" ports="4500" id="53" libelle="protocole pour ipsec" tcpwrapper=""/>
|
|
41
|
<service name="isakmp_500" protocol="udp" ports="500" id="52" libelle="protocol pour ipsec" tcpwrapper=""/>
|
|
42
|
<service name="ldap" protocol="tcp" ports="389" id="22" libelle="service d'annuaire" tcpwrapper="slapd"/>
|
|
43
|
<service name="ldap-horus" protocol="tcp" ports="1338" id="78" libelle="acces au ldap horus" tcpwrapper=""/>
|
|
44
|
<service name="ldap-scribe" protocol="tcp" ports="1337" id="77" libelle="acces au ldap scribe" tcpwrapper=""/>
|
|
45
|
<service name="ldaps" protocol="tcp" ports="636" id="24" libelle="service ldaps" tcpwrapper="slapd"/>
|
|
46
|
<service name="lightsquid" protocol="tcp" ports="%%lightsquid_port" id="54" libelle="port d'accès à l'application lightsquid" tcpwrapper=""/>
|
|
47
|
<service name="lockd" protocol="tcp" ports="4005" id="61" libelle="" tcpwrapper=""/>
|
|
48
|
<service name="ltspfsd" protocol="tcp" ports="9220" id="72" libelle="ltspfsd" tcpwrapper=""/>
|
|
49
|
<service name="mdqs" protocol="tcp" ports="666" id="15" libelle="service mdqs" tcpwrapper=""/>
|
|
50
|
<service name="mountd" protocol="tcp" ports="4003" id="62" libelle="" tcpwrapper=""/>
|
|
51
|
<service name="msnp" protocol="tcp" ports="1863" id="17" libelle="service msnp" tcpwrapper=""/>
|
|
52
|
<service name="nbd-client" protocol="tcp" ports="2000" id="71" libelle="nbd-client" tcpwrapper=""/>
|
|
53
|
<service name="news" protocol="tcp" ports="2009" id="32" libelle="nouvelles" tcpwrapper=""/>
|
|
54
|
<service name="nntp" protocol="tcp" ports="119" id="30" libelle="service nntp" tcpwrapper=""/>
|
|
55
|
<service name="nntps" protocol="tcp" ports="563" id="31" libelle="service nntps" tcpwrapper=""/>
|
|
56
|
<service name="ntp" protocol="udp" ports="123" id="56" libelle="serveur de temps" tcpwrapper=""/>
|
|
57
|
<service name="nuauth" protocol="tcp" ports="4129" id="43" libelle="Serveur d'authentification NuFw" tcpwrapper=""/>
|
|
58
|
<service name="pftp" protocol="tcp" ports="662" id="28" libelle="service pftp" tcpwrapper=""/>
|
|
59
|
<service name="pop" protocol="tcp" ports="110" id="20" libelle="service pop" tcpwrapper=""/>
|
|
60
|
<service name="pop3s" protocol="tcp" ports="995" id="25" libelle="service pop3s" tcpwrapper=""/>
|
|
61
|
<service name="portmap" protocol="tcp" ports="111" id="60" libelle="" tcpwrapper=""/>
|
|
62
|
<service name="posh-admin" protocol="tcp" ports="7070" id="48" libelle="administration posh" tcpwrapper=""/>
|
|
63
|
<service name="proxy" protocol="tcp" ports="3128" id="4" libelle="service proxy" tcpwrapper=""/>
|
|
64
|
<service name="proxy-8080" protocol="tcp" ports="8080" id="12" libelle="proxy" tcpwrapper=""/>
|
|
65
|
<service name="proxy2" protocol="tcp" ports="%%dansguardian_port3" id="55" libelle="port 2eme instance de squid" tcpwrapper=""/>
|
|
66
|
<service name="pulseaudio" protocol="tcp" ports="16001" id="70" libelle="pulseaudio" tcpwrapper=""/>
|
|
67
|
<service name="radius" protocol="udp" ports="1812" id="70" libelle="" tcpwrapper=""/>
|
|
68
|
<service name="radius-acct" protocol="udp" ports="1813" id="74" libelle="" tcpwrapper=""/>
|
|
69
|
<service name="revprox-sso" protocol="tcp" ports="8443" id="79" libelle="Redirection du service EoleSSO" tcpwrapper=""/>
|
|
70
|
<service name="rsyslog_RELP" protocol="tcp" ports="20514" id="64" libelle="protocole RELP pour rsyslog" tcpwrapper=""/>
|
|
71
|
<service name="rsyslog_TCP" protocol="tcp" ports="10514" id="65" libelle="protocole TCP pour rsyslog" tcpwrapper=""/>
|
|
72
|
<service name="rsyslog_UDP" protocol="udp" ports="514" id="66" libelle="protocole UDP pour rsyslog" tcpwrapper=""/>
|
|
73
|
<service name="samba-tcp" protocol="tcp" ports="137-139" id="38" libelle="samba tcp" tcpwrapper=""/>
|
|
74
|
<service name="samba-udp" protocol="udp" ports="137-139" id="37" libelle="samba" tcpwrapper=""/>
|
|
75
|
<service name="samba3" protocol="tcp" ports="445" id="39" libelle="samba3" tcpwrapper=""/>
|
|
76
|
<service name="scribe-controlevnc" protocol="tcp" ports="8789-8790" id="45" libelle="" tcpwrapper=""/>
|
|
77
|
<service name="scribe-service" protocol="tcp" ports="8788" id="36" libelle="service scribe sur les clients" tcpwrapper=""/>
|
|
78
|
<service name="scribe_vnc1" protocol="tcp" ports="5800" id="40" libelle="vnc 5800" tcpwrapper=""/>
|
|
79
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" tcpwrapper=""/>
|
|
80
|
<service name="serveur_nfs" protocol="tcp" ports="2049" id="59" libelle="Serveur NFS" tcpwrapper=""/>
|
|
81
|
<service name="sftp" protocol="tcp" ports="115" id="27" libelle="service sftp" tcpwrapper=""/>
|
|
82
|
<service name="smtp" protocol="tcp" ports="25" id="19" libelle="service mail" tcpwrapper=""/>
|
|
83
|
<service name="smtps" protocol="tcp" ports="465" id="77" libelle="Service SMTP SSL" tcpwrapper=""/>
|
|
84
|
<service name="ssh" protocol="tcp" ports="22" id="8" libelle="shell sécrurisé" tcpwrapper="sshd"/>
|
|
85
|
<service name="sympa-internet" protocol="tcp" ports="8787" id="58" libelle="serveur sympa internet" tcpwrapper=""/>
|
|
86
|
<service name="sympa-restreint" protocol="tcp" ports="8888" id="57" libelle="sympa domaine restreint" tcpwrapper=""/>
|
|
87
|
<service name="talk" protocol="tcp" ports="517-518" id="18" libelle="service talk" tcpwrapper=""/>
|
|
88
|
<service name="tcp" protocol="tcp" ports="0-65535" id="33" libelle="tous les ports en tcp" tcpwrapper=""/>
|
|
89
|
<service name="tftpd-hpa" protocol="udp" ports="69" id="75" libelle="Accès aux serveurs TFTP" tcpwrapper="in.tftpd"/>
|
|
90
|
<service name="tous" protocol="TOUT" ports="0" id="tout" libelle="tous les services" tcpwrapper=""/>
|
|
91
|
<service name="udp" protocol="udp" ports="0-65535" id="34" libelle="tous les ports en udp" tcpwrapper=""/>
|
|
92
|
<service name="webmin" protocol="tcp" ports="10000" id="9" libelle="appliquation web d'administration" tcpwrapper=""/>
|
|
93
|
<service name="xmpp" protocol="tcp" ports="5222" id="63" libelle="Serveur jabber (XMPP)" tcpwrapper=""/>
|
|
94
|
<service name="xmpp-ssl" protocol="tcp" ports="5223" id="81" libelle="Serveur jabber SSL (XMPP)" tcpwrapper=""/>
|
|
95
|
<groupe id="admin_amon" libelle="Port autorise pour l'administration distante d'Amon (ssh, ead, agents zephir)">
|
|
96
|
<service name="agents_zephir" protocol="tcp" ports="8090" id="46" libelle="Acces web aux agents Zéphir" tcpwrapper=""/>
|
|
97
|
<service name="ead" protocol="tcp" ports="4200" id="36" libelle="ead" tcpwrapper=""/>
|
|
98
|
<service name="lightsquid" protocol="tcp" ports="%%lightsquid_port" id="54" libelle="port d'accès à l'application lightsquid" tcpwrapper=""/>
|
|
99
|
<service name="echo-request" protocol="ICMP" ports="0" id="echo-request" libelle="règle icmp echo-request" tcpwrapper=""/>
|
|
100
|
</groupe>
|
|
101
|
<groupe id="dns" libelle="dns tcp et udp">
|
|
102
|
<service name="dns-udp" protocol="udp" ports="53" id="7" libelle="serveur de noms" tcpwrapper=""/>
|
|
103
|
<service name="dns-tcp" protocol="tcp" ports="53" id="6" libelle="serveur de noms" tcpwrapper=""/>
|
|
104
|
</groupe>
|
|
105
|
<groupe id="eclair-dmz" libelle="Eclair en DMZ">
|
|
106
|
<service name="ltspfsd" protocol="tcp" ports="9220" id="72" libelle="ltspfsd" tcpwrapper=""/>
|
|
107
|
<service name="nbd-client" protocol="tcp" ports="2000" id="71" libelle="nbd-client" tcpwrapper=""/>
|
|
108
|
<service name="pulseaudio" protocol="tcp" ports="16001" id="70" libelle="pulseaudio" tcpwrapper=""/>
|
|
109
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" tcpwrapper=""/>
|
|
110
|
</groupe>
|
|
111
|
<groupe id="gr_forum" libelle="interdire l'utilisation des forums">
|
|
112
|
<service name="nntp" protocol="tcp" ports="119" id="30" libelle="service nntp" tcpwrapper=""/>
|
|
113
|
<service name="nntps" protocol="tcp" ports="563" id="31" libelle="service nntps" tcpwrapper=""/>
|
|
114
|
<service name="news" protocol="tcp" ports="2009" id="32" libelle="nouvelles" tcpwrapper=""/>
|
|
115
|
</groupe>
|
|
116
|
<groupe id="gr_ftp" libelle="">
|
|
117
|
<service name="ftp-tcp" protocol="tcp" ports="20-21" id="26" libelle="transfert de fichiers" tcpwrapper=""/>
|
|
118
|
<service name="ftps" protocol="tcp" ports="989-990" id="29" libelle="service ftps" tcpwrapper=""/>
|
|
119
|
<service name="pftp" protocol="tcp" ports="662" id="28" libelle="service pftp" tcpwrapper=""/>
|
|
120
|
<service name="sftp" protocol="tcp" ports="115" id="27" libelle="service sftp" tcpwrapper=""/>
|
|
121
|
</groupe>
|
|
122
|
<groupe id="gr_imap" libelle="imap et imap-ssl">
|
|
123
|
<service name="imap" protocol="tcp" ports="143" id="21" libelle="service imap" tcpwrapper=""/>
|
|
124
|
<service name="imap4-ssl" protocol="tcp" ports="993" id="23" libelle="service imap4-ssl" tcpwrapper=""/>
|
|
125
|
</groupe>
|
|
126
|
<groupe id="gr_irc" libelle="interdire l'utilisation des dialogues en direct (icq)">
|
|
127
|
<service name="talk" protocol="tcp" ports="517-518" id="18" libelle="service talk" tcpwrapper=""/>
|
|
128
|
<service name="msnp" protocol="tcp" ports="1863" id="17" libelle="service msnp" tcpwrapper=""/>
|
|
129
|
<service name="mdqs" protocol="tcp" ports="666" id="15" libelle="service mdqs" tcpwrapper=""/>
|
|
130
|
<service name="ircs" protocol="tcp" ports="994" id="16" libelle="service ircs" tcpwrapper=""/>
|
|
131
|
<service name="irc" protocol="tcp" ports="194" id="15" libelle="service irc" tcpwrapper=""/>
|
|
132
|
<service name="ircu" protocol="tcp" ports="6665-6669" id="13" libelle="service ircu" tcpwrapper=""/>
|
|
133
|
</groupe>
|
|
134
|
<groupe id="gr_messagerie" libelle="interdire l'utilisation des dialogues en direct (icq)">
|
|
135
|
<service name="imap" protocol="tcp" ports="143" id="21" libelle="service imap" tcpwrapper=""/>
|
|
136
|
<service name="imap4-ssl" protocol="tcp" ports="993" id="23" libelle="service imap4-ssl" tcpwrapper=""/>
|
|
137
|
<service name="ldap" protocol="tcp" ports="389" id="22" libelle="service d'annuaire" tcpwrapper="slapd"/>
|
|
138
|
<service name="ldaps" protocol="tcp" ports="636" id="24" libelle="service ldaps" tcpwrapper="slapd"/>
|
|
139
|
<service name="pop" protocol="tcp" ports="110" id="20" libelle="service pop" tcpwrapper=""/>
|
|
140
|
<service name="pop3s" protocol="tcp" ports="995" id="25" libelle="service pop3s" tcpwrapper=""/>
|
|
141
|
<service name="smtp" protocol="tcp" ports="25" id="19" libelle="service mail" tcpwrapper=""/>
|
|
142
|
<service name="smtps" protocol="tcp" ports="465" id="77" libelle="Service SMTP SSL" tcpwrapper=""/>
|
|
143
|
</groupe>
|
|
144
|
<groupe id="gr_pop" libelle="pop3 et pop3s">
|
|
145
|
<service name="pop" protocol="tcp" ports="110" id="20" libelle="service pop" tcpwrapper=""/>
|
|
146
|
<service name="pop3s" protocol="tcp" ports="995" id="25" libelle="service pop3s" tcpwrapper=""/>
|
|
147
|
</groupe>
|
|
148
|
<groupe id="gr_radius" libelle="Serveur radius (UDP)">
|
|
149
|
<service name="radius" protocol="udp" ports="1812" id="70" libelle="" tcpwrapper=""/>
|
|
150
|
<service name="radius-acct" protocol="udp" ports="1813" id="74" libelle="" tcpwrapper=""/>
|
|
151
|
</groupe>
|
|
152
|
<groupe id="gr_redirection" libelle="Protocoles a rediriger vers le proxy">
|
|
153
|
<service name="http" protocol="tcp" ports="80" id="3" libelle="serveur web" tcpwrapper=""/>
|
|
154
|
<service name="proxy" protocol="tcp" ports="3128" id="4" libelle="service proxy" tcpwrapper=""/>
|
|
155
|
<service name="proxy-8080" protocol="tcp" ports="8080" id="12" libelle="proxy" tcpwrapper=""/>
|
|
156
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="serveur web sécurisé" tcpwrapper=""/>
|
|
157
|
</groupe>
|
|
158
|
<groupe id="gr_redirection_http" libelle="Protocoles http a rediriger vers le proxy">
|
|
159
|
<service name="http" protocol="tcp" ports="80" id="3" libelle="serveur web" tcpwrapper=""/>
|
|
160
|
<service name="proxy" protocol="tcp" ports="3128" id="4" libelle="service proxy" tcpwrapper=""/>
|
|
161
|
<service name="proxy-8080" protocol="tcp" ports="8080" id="12" libelle="proxy" tcpwrapper=""/>
|
|
162
|
</groupe>
|
|
163
|
<groupe id="gr_redirection_https" libelle="Https a redifiger vers le proxy">
|
|
164
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="serveur web sécurisé" tcpwrapper=""/>
|
|
165
|
</groupe>
|
|
166
|
<groupe id="gr_restreint" libelle="on ferme tout sauf l'utilisation du web par le proxy">
|
|
167
|
<service name="tcp" protocol="tcp" ports="0-65535" id="33" libelle="tous les ports en tcp" tcpwrapper=""/>
|
|
168
|
<service name="udp" protocol="udp" ports="0-65535" id="34" libelle="tous les ports en udp" tcpwrapper=""/>
|
|
169
|
</groupe>
|
|
170
|
<groupe id="gr_smtp" libelle="smtp et smtps">
|
|
171
|
<service name="smtp" protocol="tcp" ports="25" id="19" libelle="service mail" tcpwrapper=""/>
|
|
172
|
<service name="smtps" protocol="tcp" ports="465" id="77" libelle="Service SMTP SSL" tcpwrapper=""/>
|
|
173
|
</groupe>
|
|
174
|
<groupe id="ipsec" libelle="Services utilises pas ipsec">
|
|
175
|
<service name="esp" protocol="esp" ports="0" id="51" libelle="protocole pour ipsec" tcpwrapper=""/>
|
|
176
|
<service name="isakmp_4500" protocol="udp" ports="4500" id="53" libelle="protocole pour ipsec" tcpwrapper=""/>
|
|
177
|
<service name="isakmp_500" protocol="udp" ports="500" id="52" libelle="protocol pour ipsec" tcpwrapper=""/>
|
|
178
|
</groupe>
|
|
179
|
<groupe id="nfs" libelle="Serveur NFS + portmap">
|
|
180
|
<service name="portmap" protocol="tcp" ports="111" id="60" libelle="" tcpwrapper=""/>
|
|
181
|
<service name="lockd" protocol="tcp" ports="4005" id="61" libelle="" tcpwrapper=""/>
|
|
182
|
<service name="mountd" protocol="tcp" ports="4003" id="62" libelle="" tcpwrapper=""/>
|
|
183
|
<service name="serveur_nfs" protocol="tcp" ports="2049" id="59" libelle="Serveur NFS" tcpwrapper=""/>
|
|
184
|
</groupe>
|
|
185
|
<groupe id="samba" libelle="samba proto">
|
|
186
|
<service name="samba-udp" protocol="udp" ports="137-139" id="37" libelle="samba" tcpwrapper=""/>
|
|
187
|
<service name="samba-tcp" protocol="tcp" ports="137-139" id="38" libelle="samba tcp" tcpwrapper=""/>
|
|
188
|
<service name="samba3" protocol="tcp" ports="445" id="39" libelle="samba3" tcpwrapper=""/>
|
|
189
|
</groupe>
|
|
190
|
<groupe id="scribe-dmz-pedago" libelle="service Scribe DMZ vers pedago">
|
|
191
|
<service name="samba-tcp" protocol="tcp" ports="137-139" id="38" libelle="samba tcp" tcpwrapper=""/>
|
|
192
|
<service name="samba-udp" protocol="udp" ports="137-139" id="37" libelle="samba" tcpwrapper=""/>
|
|
193
|
<service name="samba3" protocol="tcp" ports="445" id="39" libelle="samba3" tcpwrapper=""/>
|
|
194
|
<service name="scribe-service" protocol="tcp" ports="8788" id="36" libelle="service scribe sur les clients" tcpwrapper=""/>
|
|
195
|
<service name="scribe_vnc1" protocol="tcp" ports="5800" id="40" libelle="vnc 5800" tcpwrapper=""/>
|
|
196
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" tcpwrapper=""/>
|
|
197
|
</groupe>
|
|
198
|
<groupe id="scribe-pedago-dmz" libelle="client scribe vers la DMZ">
|
|
199
|
<service name="ldap" protocol="tcp" ports="389" id="22" libelle="service d'annuaire" tcpwrapper="slapd"/>
|
|
200
|
<service name="ldaps" protocol="tcp" ports="636" id="24" libelle="service ldaps" tcpwrapper="slapd"/>
|
|
201
|
<service name="samba-tcp" protocol="tcp" ports="137-139" id="38" libelle="samba tcp" tcpwrapper=""/>
|
|
202
|
<service name="samba-udp" protocol="udp" ports="137-139" id="37" libelle="samba" tcpwrapper=""/>
|
|
203
|
<service name="samba3" protocol="tcp" ports="445" id="39" libelle="samba3" tcpwrapper=""/>
|
|
204
|
<service name="scribe-controlevnc" protocol="tcp" ports="8789-8790" id="45" libelle="" tcpwrapper=""/>
|
|
205
|
<service name="scribe_vnc1" protocol="tcp" ports="5800" id="40" libelle="vnc 5800" tcpwrapper=""/>
|
|
206
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" tcpwrapper=""/>
|
|
207
|
</groupe>
|
|
208
|
<groupe id="scribe-posh" libelle="Ouverture des ports pour l'utilisation de nginx pour Posh">
|
|
209
|
<service name="http" protocol="tcp" ports="80" id="3" libelle="serveur web" tcpwrapper=""/>
|
|
210
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="serveur web sécurisé" tcpwrapper=""/>
|
|
211
|
<service name="posh-admin" protocol="tcp" ports="7070" id="48" libelle="administration posh" tcpwrapper=""/>
|
|
212
|
</groupe>
|
|
213
|
<groupe id="scribe_ext" libelle="services extranet scribe ">
|
|
214
|
<service name="ftp-tcp" protocol="tcp" ports="20-21" id="26" libelle="transfert de fichiers" tcpwrapper=""/>
|
|
215
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="serveur web sécurisé" tcpwrapper=""/>
|
|
216
|
</groupe>
|
|
217
|
<groupe id="sympa" libelle="serveur sympa">
|
|
218
|
<service name="sympa-internet" protocol="tcp" ports="8787" id="58" libelle="serveur sympa internet" tcpwrapper=""/>
|
|
219
|
<service name="sympa-restreint" protocol="tcp" ports="8888" id="57" libelle="sympa domaine restreint" tcpwrapper=""/>
|
|
220
|
</groupe>
|
|
221
|
<groupe id="vnc" libelle="vnc">
|
|
222
|
<service name="scribe_vnc1" protocol="tcp" ports="5800" id="40" libelle="vnc 5800" tcpwrapper=""/>
|
|
223
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" tcpwrapper=""/>
|
|
224
|
</groupe>
|
|
225
|
</services>
|
|
226
|
<qosclasses upload="" download="">
|
|
227
|
</qosclasses>
|
|
228
|
<extremites>
|
|
229
|
<extremite zone="admin" name="admin_restreint" libelle="zone restreinte" netmask="%%adresse_netmask_eth1" subnet="1" type="" interface="" container="">
|
|
230
|
<ip address="%%adresse_network_eth1"/>
|
|
231
|
</extremite>
|
|
232
|
<extremite zone="exterieur" name="pedago_bastion" libelle="" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
233
|
<ip address="%%adresse_ip_eth2"/>
|
|
234
|
</extremite>
|
|
235
|
<extremite zone="admin" name="horus" libelle="monhorus" netmask="255.255.255.255" subnet="0" type="normal" interface="" container="">
|
|
236
|
<ip address="10.1.1.10"/>
|
|
237
|
</extremite>
|
|
238
|
<extremite zone="bastion" name="internet_eth1" libelle="eth1 dans le conteneur internet" netmask="255.255.255.255" subnet="0" type="conteneur" interface="eth1" container="internet">
|
|
239
|
<ip address="%%adresse_ip_eth1_proxy_link"/>
|
|
240
|
</extremite>
|
|
241
|
<extremite zone="exterieur" name="exterieur_admin" libelle="reseau autorise a administrer depuis l'exterieur" netmask="%%netmask_admin_eth0" subnet="1" type="" interface="" container="">
|
|
242
|
<ip address="%%ip_admin_eth0"/>
|
|
243
|
</extremite>
|
|
244
|
<extremite zone="exterieur" name="exterieur_restreint" libelle="zone restreinte" netmask="%%adresse_netmask_eth0" subnet="1" type="" interface="" container="">
|
|
245
|
<ip address="%%adresse_network_eth0"/>
|
|
246
|
</extremite>
|
|
247
|
<extremite zone="admin" name="admin_admin" libelle="reseau autorise a administrer depuis le reseau administratif" netmask="%%netmask_admin_eth1" subnet="1" type="" interface="" container="">
|
|
248
|
<ip address="%%ip_admin_eth1"/>
|
|
249
|
</extremite>
|
|
250
|
<extremite zone="exterieur" name="clients_relp_rsyslog" libelle="clients de l'agrégateur de logs en relp" netmask="%%netmask_client_logs_relp" subnet="0" type="" interface="" container="">
|
|
251
|
<ip address="%%adresses_ip_clients_logs_relp"/>
|
|
252
|
</extremite>
|
|
253
|
<extremite zone="dmz" name="serveur_scribe_dmz" libelle="serveur scribe sur DMZ" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
254
|
<ip address="%%ip_serveur_scribe_dmz"/>
|
|
255
|
</extremite>
|
|
256
|
<extremite zone="dmz" name="dmz_restreint" libelle="zone restreinte" netmask="%%adresse_netmask_eth3" subnet="1" type="" interface="" container="">
|
|
257
|
<ip address="%%adresse_network_eth3"/>
|
|
258
|
</extremite>
|
|
259
|
<extremite zone="exterieur" name="clients_udp_rsyslog" libelle="clients de l'agrégateur de logs en udp" netmask="%%netmask_client_logs_udp" subnet="0" type="" interface="" container="">
|
|
260
|
<ip address="%%adresses_ip_clients_logs_udp"/>
|
|
261
|
</extremite>
|
|
262
|
<extremite zone="dmz" name="dmz_admin" libelle="reseau autorise a administrer depuis la dmz" netmask="%%netmask_admin_eth3" subnet="1" type="" interface="" container="">
|
|
263
|
<ip address="%%ip_admin_eth3"/>
|
|
264
|
</extremite>
|
|
265
|
<extremite zone="bastion" name="bastion_exterieur" libelle="Bastion sur la zone exterieur" netmask="255.255.255.255" subnet="0" type="normal" interface="eth0" container="">
|
|
266
|
<ip address="%%adresse_ip_eth0"/>
|
|
267
|
</extremite>
|
|
268
|
<extremite zone="dmz" name="scribe" libelle="monscribe" netmask="255.255.255.255" subnet="0" type="normal" interface="" container="">
|
|
269
|
<ip address="10.1.3.5"/>
|
|
270
|
</extremite>
|
|
271
|
<extremite zone="pedago" name="pedago_admin" libelle="reseau autorise a administrer depuis le reseau pedagogique" netmask="%%netmask_admin_eth2" subnet="1" type="" interface="" container="">
|
|
272
|
<ip address="%%ip_admin_eth2"/>
|
|
273
|
</extremite>
|
|
274
|
<extremite zone="exterieur" name="admin_bastion" libelle="adresse du bastion sur le reseau admin" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
275
|
<ip address="%%adresse_ip_eth1"/>
|
|
276
|
</extremite>
|
|
277
|
<extremite zone="bastion" name="internet_eth2" libelle="eth2 dans le conteneur internet" netmask="255.255.255.255" subnet="0" type="conteneur" interface="eth2" container="internet">
|
|
278
|
<ip address="%%adresse_ip_eth2_proxy_link"/>
|
|
279
|
</extremite>
|
|
280
|
<extremite zone="exterieur" name="clients_tcp_rsyslog" libelle="clients de l'agrégateur de logs en tcp" netmask="%%netmask_client_logs_tcp" subnet="0" type="" interface="" container="">
|
|
281
|
<ip address="%%adresses_ip_clients_logs_tcp"/>
|
|
282
|
</extremite>
|
|
283
|
<extremite zone="exterieur" name="exterieur" libelle="Zone entière" netmask="%%adresse_netmask_eth0" subnet="1" type="" interface="" container="">
|
|
284
|
<ip address="%%adresse_ip_eth0"/>
|
|
285
|
</extremite>
|
|
286
|
<extremite zone="pedago" name="pedago_restreint" libelle="zone restreinte" netmask="%%adresse_netmask_eth2" subnet="1" type="" interface="" container="">
|
|
287
|
<ip address="%%adresse_network_eth2"/>
|
|
288
|
</extremite>
|
|
289
|
<extremite zone="admin" name="admin_ssh" libelle="reseau autorise a se connecter a ssh depuis le reseau administratif" netmask="%%netmask_ssh_eth1" subnet="1" type="" interface="" container="">
|
|
290
|
<ip address="%%ip_ssh_eth1"/>
|
|
291
|
</extremite>
|
|
292
|
<extremite zone="admin" name="admin" libelle="Zone entière" netmask="%%adresse_netmask_eth1" subnet="1" type="" interface="" container="">
|
|
293
|
<ip address="%%adresse_ip_eth1"/>
|
|
294
|
</extremite>
|
|
295
|
<extremite zone="pedago" name="pedago_ssh" libelle="reseau autorise a se connecter a ssh depuis le reseau pedagogique" netmask="%%netmask_ssh_eth2" subnet="1" type="" interface="" container="">
|
|
296
|
<ip address="%%ip_ssh_eth2"/>
|
|
297
|
</extremite>
|
|
298
|
<extremite zone="pedago" name="pedago" libelle="Zone entière" netmask="%%adresse_netmask_eth2" subnet="1" type="" interface="" container="">
|
|
299
|
<ip address="%%adresse_ip_eth2"/>
|
|
300
|
</extremite>
|
|
301
|
<extremite zone="exterieur" name="exterieur_ssh" libelle="reseau autorise a se connecter a ssh" netmask="%%netmask_ssh_eth0" subnet="1" type="" interface="" container="">
|
|
302
|
<ip address="%%ip_ssh_eth0"/>
|
|
303
|
</extremite>
|
|
304
|
<extremite zone="bastion" name="bastion" libelle="Zone entière" netmask="255.255.255.255" subnet="1" type="" interface="" container="">
|
|
305
|
<ip address="127.0.0.1"/>
|
|
306
|
</extremite>
|
|
307
|
<extremite zone="bastion" name="internet" libelle="conteneur internet" netmask="255.255.255.255" subnet="0" type="conteneur" interface="containers" container="internet">
|
|
308
|
<ip address="%%container_ip_internet"/>
|
|
309
|
</extremite>
|
|
310
|
<extremite zone="dmz" name="dmz" libelle="Zone entière" netmask="%%adresse_netmask_eth3" subnet="1" type="" interface="" container="">
|
|
311
|
<ip address="%%adresse_ip_eth3"/>
|
|
312
|
</extremite>
|
|
313
|
<extremite zone="exterieur" name="exterieur_bastion" libelle="IP de bastion sur la zone exterieur" netmask="255.255.255.255" subnet="0" type="" interface="" container="">
|
|
314
|
<ip address="%%adresse_ip_eth0"/>
|
|
315
|
</extremite>
|
|
316
|
<extremite zone="dmz" name="dmz_ssh" libelle="reseau autorise a se connecter a ssh depuis la dmz" netmask="%%netmask_ssh_eth3" subnet="1" type="" interface="" container="">
|
|
317
|
<ip address="%%ip_ssh_eth3"/>
|
|
318
|
</extremite>
|
|
319
|
</extremites>
|
|
320
|
<ranges>
|
|
321
|
</ranges>
|
|
322
|
<user_groups>
|
|
323
|
</user_groups>
|
|
324
|
<applications>
|
|
325
|
</applications>
|
|
326
|
<flux-list>
|
|
327
|
<flux zoneA="bastion" zoneB="exterieur">
|
|
328
|
<montantes default_policy="0">
|
|
329
|
<directive tag="ActiverNGINX" service="scribe-posh" priority="1" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="ouverture de posh a travers de nginx" ipsec="0" accept="0">
|
|
330
|
<source name="exterieur"/>
|
|
331
|
<destination name="bastion"/>
|
|
332
|
</directive>
|
|
333
|
<directive tag="ead_scribe" service="ead-scribe" priority="2" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="ouverture de l'EAD Scribe a travers de nginx" ipsec="0" accept="0">
|
|
334
|
<source name="exterieur"/>
|
|
335
|
<destination name="bastion"/>
|
|
336
|
</directive>
|
|
337
|
<directive tag="SSHDepuisEth0" service="ssh" priority="3" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="ssh exterieur vers Amon" ipsec="0" accept="0">
|
|
338
|
<source name="exterieur_ssh"/>
|
|
339
|
<destination name="bastion"/>
|
|
340
|
</directive>
|
|
341
|
<directive tag="AdminDepuisEth0" service="admin_amon" priority="4" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="administration exterieure vers Amon" ipsec="0" accept="0">
|
|
342
|
<source name="exterieur_admin"/>
|
|
343
|
<destination name="bastion"/>
|
|
344
|
</directive>
|
|
345
|
<directive tag="lightsquid0" service="lightsquid" priority="5" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="administration exterieure vers Amon" ipsec="0" accept="0">
|
|
346
|
<source name="exterieur_admin"/>
|
|
347
|
<destination name="bastion"/>
|
|
348
|
</directive>
|
|
349
|
<directive tag="eole_sso" service="eole-sso" priority="6" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
350
|
<source name="exterieur"/>
|
|
351
|
<destination name="bastion"/>
|
|
352
|
</directive>
|
|
353
|
<directive tag="revprox_sso" service="revprox-sso" priority="7" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="redirection du service EoleSSO par le proxy inverse" ipsec="0" accept="0">
|
|
354
|
<source name="exterieur"/>
|
|
355
|
<destination name="bastion"/>
|
|
356
|
</directive>
|
|
357
|
<directive service="ipsec" priority="8" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser ipsec" ipsec="0" accept="0">
|
|
358
|
<source name="exterieur"/>
|
|
359
|
<destination name="bastion"/>
|
|
360
|
</directive>
|
|
361
|
<directive tag="SSHDepuisEth0" service="gen_config" priority="9" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="gen_config exterieur vers Amon" ipsec="0" accept="0">
|
|
362
|
<source name="exterieur_ssh"/>
|
|
363
|
<destination name="bastion"/>
|
|
364
|
</directive>
|
|
365
|
<directive tag="ClientRsyslogRELP" service="rsyslog_RELP" priority="10" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
366
|
<source name="clients_relp_rsyslog"/>
|
|
367
|
<destination name="bastion"/>
|
|
368
|
</directive>
|
|
369
|
<directive tag="ClientRsyslogTCP" service="rsyslog_TCP" priority="11" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
370
|
<source name="clients_tcp_rsyslog"/>
|
|
371
|
<destination name="bastion"/>
|
|
372
|
</directive>
|
|
373
|
<directive tag="ClientRsyslogUDP" service="rsyslog_UDP" priority="12" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
374
|
<source name="clients_udp_rsyslog"/>
|
|
375
|
<destination name="bastion"/>
|
|
376
|
</directive>
|
|
377
|
</montantes>
|
|
378
|
<descendantes default_policy="1">
|
|
379
|
</descendantes>
|
|
380
|
</flux>
|
|
381
|
<flux zoneA="exterieur" zoneB="admin">
|
|
382
|
<montantes default_policy="0">
|
|
383
|
</montantes>
|
|
384
|
<descendantes default_policy="1">
|
|
385
|
<directive service="tous" priority="1" action="16" attrs="0" nat_extr="exterieur_bastion" nat_port="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
386
|
<source name="admin_restreint"/>
|
|
387
|
<destination name="exterieur"/>
|
|
388
|
</directive>
|
|
389
|
<directive tag="ProxyBypass1" service="gr_redirection_http" priority="2" action="4" attrs="17" nat_port="3128" src_inv="0" dest_inv="1" serv_inv="0" libelle="Redirection des flux http sans proxy" ipsec="0" accept="0">
|
|
390
|
<source name="admin"/>
|
|
391
|
<destination name="exterieur_bastion"/>
|
|
392
|
<exception name="" ip="" eolvar="%%proxy_bypass_network_eth1/%%calc_classe(%%proxy_bypass_netmask_eth1)" src="0" dest="1"/>
|
|
393
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth1" src="0" dest="1"/>
|
|
394
|
</directive>
|
|
395
|
<directive tag="ProxyBypass1" service="gr_redirection_https" priority="3" action="4" attrs="17" nat_port="82" src_inv="0" dest_inv="0" serv_inv="0" libelle="Redirection des flux https sans proxy vers une page d'erreur" ipsec="0" accept="0">
|
|
396
|
<source name="admin"/>
|
|
397
|
<destination name="exterieur"/>
|
|
398
|
<exception name="" ip="" eolvar="%%proxy_bypass_network_eth1/%%calc_classe(%%proxy_bypass_netmask_eth1)" src="0" dest="1"/>
|
|
399
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth1" src="0" dest="1"/>
|
|
400
|
</directive>
|
|
401
|
<directive tag="ForceProxy1" service="gr_redirection_http" priority="4" action="4" attrs="17" nat_port="3128" src_inv="0" dest_inv="1" serv_inv="0" libelle="Redirection des flux http sans proxy" ipsec="0" accept="0">
|
|
402
|
<source name="admin"/>
|
|
403
|
<destination name="exterieur_bastion"/>
|
|
404
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth1" src="0" dest="1"/>
|
|
405
|
</directive>
|
|
406
|
<directive tag="ForceProxy1" service="gr_redirection_https" priority="5" action="4" attrs="17" nat_port="82" src_inv="0" dest_inv="0" serv_inv="0" libelle="Redirection des flux https sans proxy vers une page d'erreur" ipsec="0" accept="0">
|
|
407
|
<source name="admin"/>
|
|
408
|
<destination name="exterieur"/>
|
|
409
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth1" src="0" dest="1"/>
|
|
410
|
</directive>
|
|
411
|
</descendantes>
|
|
412
|
</flux>
|
|
413
|
<flux zoneA="bastion" zoneB="admin">
|
|
414
|
<montantes default_policy="0">
|
|
415
|
<directive tag="SSHDepuisEth1" service="ssh" priority="1" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="ssh admin vers Amon" ipsec="0" accept="0">
|
|
416
|
<source name="admin_ssh"/>
|
|
417
|
<destination name="bastion"/>
|
|
418
|
</directive>
|
|
419
|
<directive tag="AdminDepuisEth1" service="admin_amon" priority="2" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="administration admin vers Amon" ipsec="0" accept="0">
|
|
420
|
<source name="admin_admin"/>
|
|
421
|
<destination name="bastion"/>
|
|
422
|
</directive>
|
|
423
|
<directive service="dns-tcp" priority="3" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
424
|
<source name="admin"/>
|
|
425
|
<destination name="internet_eth1"/>
|
|
426
|
</directive>
|
|
427
|
<directive service="dns-udp" priority="4" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
428
|
<source name="admin"/>
|
|
429
|
<destination name="internet_eth1"/>
|
|
430
|
</directive>
|
|
431
|
<directive tag="auth_nufw" service="nuauth" priority="5" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="autoriser l'acces a Nuauth" ipsec="0" accept="0">
|
|
432
|
<source name="admin"/>
|
|
433
|
<destination name="bastion"/>
|
|
434
|
</directive>
|
|
435
|
<directive tag="eole_sso" service="eole-sso" priority="6" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
436
|
<source name="admin"/>
|
|
437
|
<destination name="bastion"/>
|
|
438
|
</directive>
|
|
439
|
<directive service="proxy" priority="7" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
440
|
<source name="admin"/>
|
|
441
|
<destination name="internet_eth1"/>
|
|
442
|
</directive>
|
|
443
|
<directive tag="Activer squid2" service="proxy2" priority="8" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
444
|
<source name="admin"/>
|
|
445
|
<destination name="internet_eth1"/>
|
|
446
|
</directive>
|
|
447
|
<directive tag="cntlm" service="cntlm" priority="9" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
448
|
<source name="admin"/>
|
|
449
|
<destination name="internet_eth1"/>
|
|
450
|
</directive>
|
|
451
|
<directive tag="SSHDepuisEth1" service="gen_config" priority="10" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="gen_config admin vers Amon" ipsec="0" accept="0">
|
|
452
|
<source name="admin_ssh"/>
|
|
453
|
<destination name="bastion"/>
|
|
454
|
</directive>
|
|
455
|
<directive tag="ActiverRadiuseth1" service="gr_radius" priority="11" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="raduis admin vers Amon" ipsec="0" accept="0">
|
|
456
|
<source name="admin"/>
|
|
457
|
<destination name="bastion"/>
|
|
458
|
</directive>
|
|
459
|
<directive service="http" priority="12" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorisation reverse proxy + WPAD" ipsec="0" accept="0">
|
|
460
|
<source name="admin"/>
|
|
461
|
<destination name="bastion_exterieur"/>
|
|
462
|
</directive>
|
|
463
|
</montantes>
|
|
464
|
<descendantes default_policy="1">
|
|
465
|
</descendantes>
|
|
466
|
</flux>
|
|
467
|
<flux zoneA="exterieur" zoneB="pedago">
|
|
468
|
<montantes default_policy="0">
|
|
469
|
</montantes>
|
|
470
|
<descendantes default_policy="1">
|
|
471
|
<directive service="tous" priority="1" action="16" attrs="0" nat_extr="exterieur_bastion" nat_port="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
472
|
<source name="pedago_restreint"/>
|
|
473
|
<destination name="exterieur"/>
|
|
474
|
</directive>
|
|
475
|
<directive tag="Interdiction des forums" service="gr_forum" priority="2" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="pedago -> exterieur : interdire les protocoles de news, forums ..." ipsec="0" accept="0">
|
|
476
|
<source name="pedago"/>
|
|
477
|
<destination name="exterieur"/>
|
|
478
|
</directive>
|
|
479
|
<directive tag="Interdire les connexions FTP" service="gr_ftp" priority="3" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="Interdire les connexions FTP" ipsec="0" accept="0">
|
|
480
|
<source name="pedago"/>
|
|
481
|
<destination name="exterieur"/>
|
|
482
|
</directive>
|
|
483
|
<directive tag="Interdire l'utilisation des dialogues en direct" service="gr_irc" priority="4" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="pedago -> exterieur : interdire les protocoles de discussion en ligne (irc ...)" ipsec="0" accept="0">
|
|
484
|
<source name="pedago"/>
|
|
485
|
<destination name="exterieur"/>
|
|
486
|
</directive>
|
|
487
|
<directive tag="Interdiction des protocoles de messagerie" service="gr_messagerie" priority="5" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="pedago -> exterieur : interdire les protocoles de messagerie (pop, imap ...)" ipsec="0" accept="0">
|
|
488
|
<source name="pedago"/>
|
|
489
|
<destination name="exterieur"/>
|
|
490
|
</directive>
|
|
491
|
<directive tag="Internet restreint" service="gr_restreint" priority="6" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="pedago -> exterieur : tout interdire (sauf le web via le proxy)" ipsec="0" accept="0">
|
|
492
|
<source name="pedago"/>
|
|
493
|
<destination name="exterieur"/>
|
|
494
|
</directive>
|
|
495
|
<directive tag="ProxyBypass2" service="gr_redirection_http" priority="7" action="4" attrs="17" nat_port="3128" src_inv="0" dest_inv="1" serv_inv="0" libelle="Redirection des flux http sans proxy" ipsec="0" accept="0">
|
|
496
|
<source name="pedago"/>
|
|
497
|
<destination name="exterieur_bastion"/>
|
|
498
|
<exception name="" ip="" eolvar="%%proxy_bypass_network_eth2/%%calc_classe(%%proxy_bypass_netmask_eth2)" src="0" dest="1"/>
|
|
499
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth2" src="0" dest="1"/>
|
|
500
|
</directive>
|
|
501
|
<directive tag="ProxyBypass2" service="gr_redirection_https" priority="8" action="4" attrs="17" nat_port="82" src_inv="0" dest_inv="0" serv_inv="0" libelle="Redirection des flux https sans proxy vers une page d'erreur" ipsec="0" accept="0">
|
|
502
|
<source name="pedago"/>
|
|
503
|
<destination name="exterieur"/>
|
|
504
|
<exception name="" ip="" eolvar="%%proxy_bypass_network_eth2/%%calc_classe(%%proxy_bypass_netmask_eth2)" src="0" dest="1"/>
|
|
505
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth2" src="0" dest="1"/>
|
|
506
|
</directive>
|
|
507
|
<directive tag="ForceProxy2" service="gr_redirection_http" priority="9" action="4" attrs="17" nat_port="3128" src_inv="0" dest_inv="1" serv_inv="0" libelle="Redirection des flux http sans proxy" ipsec="0" accept="0">
|
|
508
|
<source name="pedago"/>
|
|
509
|
<destination name="exterieur_bastion"/>
|
|
510
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth2" src="0" dest="1"/>
|
|
511
|
</directive>
|
|
512
|
<directive tag="ForceProxy2" service="gr_redirection_https" priority="10" action="4" attrs="17" nat_port="82" src_inv="0" dest_inv="0" serv_inv="0" libelle="Redirection des flux https sans proxy vers une page d'erreur" ipsec="0" accept="0">
|
|
513
|
<source name="pedago"/>
|
|
514
|
<destination name="exterieur"/>
|
|
515
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth2" src="0" dest="1"/>
|
|
516
|
</directive>
|
|
517
|
</descendantes>
|
|
518
|
</flux>
|
|
519
|
<flux zoneA="admin" zoneB="pedago">
|
|
520
|
<montantes default_policy="0">
|
|
521
|
</montantes>
|
|
522
|
<descendantes default_policy="1">
|
|
523
|
</descendantes>
|
|
524
|
</flux>
|
|
525
|
<flux zoneA="bastion" zoneB="pedago">
|
|
526
|
<montantes default_policy="0">
|
|
527
|
<directive tag="SSHDepuisEth2" service="ssh" priority="1" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="ssh pedago vers Amon" ipsec="0" accept="0">
|
|
528
|
<source name="pedago_ssh"/>
|
|
529
|
<destination name="bastion"/>
|
|
530
|
</directive>
|
|
531
|
<directive tag="AdminDepuisEth2" service="admin_amon" priority="2" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="administration pedago vers Amon" ipsec="0" accept="0">
|
|
532
|
<source name="pedago_admin"/>
|
|
533
|
<destination name="bastion"/>
|
|
534
|
</directive>
|
|
535
|
<directive tag="lightsquid2" service="lightsquid" priority="3" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="administration pedago vers Amon" ipsec="0" accept="0">
|
|
536
|
<source name="pedago_admin"/>
|
|
537
|
<destination name="bastion"/>
|
|
538
|
</directive>
|
|
539
|
<directive service="dns-tcp" priority="4" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
540
|
<source name="pedago"/>
|
|
541
|
<destination name="internet_eth2"/>
|
|
542
|
</directive>
|
|
543
|
<directive service="dns-udp" priority="5" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
544
|
<source name="pedago"/>
|
|
545
|
<destination name="internet_eth2"/>
|
|
546
|
</directive>
|
|
547
|
<directive tag="auth_nufw" service="nuauth" priority="6" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="autoriser l'acces a Nuauth" ipsec="0" accept="0">
|
|
548
|
<source name="pedago"/>
|
|
549
|
<destination name="bastion"/>
|
|
550
|
</directive>
|
|
551
|
<directive tag="eole_sso" service="eole-sso" priority="7" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
552
|
<source name="pedago"/>
|
|
553
|
<destination name="bastion"/>
|
|
554
|
</directive>
|
|
555
|
<directive service="proxy" priority="8" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
556
|
<source name="pedago"/>
|
|
557
|
<destination name="internet_eth2"/>
|
|
558
|
</directive>
|
|
559
|
<directive tag="Activer squid2" service="proxy2" priority="9" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
560
|
<source name="pedago"/>
|
|
561
|
<destination name="internet_eth2"/>
|
|
562
|
</directive>
|
|
563
|
<directive tag="cntlm" service="cntlm" priority="10" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
564
|
<source name="pedago"/>
|
|
565
|
<destination name="internet_eth2"/>
|
|
566
|
</directive>
|
|
567
|
<directive tag="SSHDepuisEth2" service="gen_config" priority="11" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="gen_config pedago vers Amon" ipsec="0" accept="0">
|
|
568
|
<source name="pedago_ssh"/>
|
|
569
|
<destination name="bastion"/>
|
|
570
|
</directive>
|
|
571
|
<directive tag="ActiverRadiuseth2" service="gr_radius" priority="12" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="raduis admin vers Amon" ipsec="0" accept="0">
|
|
572
|
<source name="pedago"/>
|
|
573
|
<destination name="bastion"/>
|
|
574
|
</directive>
|
|
575
|
<directive service="http" priority="13" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorisation reverse proxy + WPAD" ipsec="0" accept="0">
|
|
576
|
<source name="pedago"/>
|
|
577
|
<destination name="bastion_exterieur"/>
|
|
578
|
</directive>
|
|
579
|
</montantes>
|
|
580
|
<descendantes default_policy="1">
|
|
581
|
</descendantes>
|
|
582
|
</flux>
|
|
583
|
<flux zoneA="exterieur" zoneB="dmz">
|
|
584
|
<montantes default_policy="0">
|
|
585
|
</montantes>
|
|
586
|
<descendantes default_policy="1">
|
|
587
|
<directive tag="ProxyBypass3" service="gr_redirection_http" priority="1" action="4" attrs="17" nat_port="3128" src_inv="0" dest_inv="1" serv_inv="0" libelle="Redirection des flux http sans proxy" ipsec="0" accept="0">
|
|
588
|
<source name="dmz"/>
|
|
589
|
<destination name="exterieur_bastion"/>
|
|
590
|
<exception name="" ip="" eolvar="%%proxy_bypass_network_eth3/%%calc_classe(%%proxy_bypass_netmask_eth3)" src="0" dest="1"/>
|
|
591
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth3" src="0" dest="1"/>
|
|
592
|
</directive>
|
|
593
|
<directive tag="ProxyBypass3" service="gr_redirection_https" priority="2" action="4" attrs="17" nat_port="82" src_inv="0" dest_inv="0" serv_inv="0" libelle="Redirection des flux https sans proxy vers une page d'erreur" ipsec="0" accept="0">
|
|
594
|
<source name="dmz"/>
|
|
595
|
<destination name="exterieur"/>
|
|
596
|
<exception name="" ip="" eolvar="%%proxy_bypass_network_eth3/%%calc_classe(%%proxy_bypass_netmask_eth3)" src="0" dest="1"/>
|
|
597
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth3" src="0" dest="1"/>
|
|
598
|
</directive>
|
|
599
|
<directive tag="ForceProxy3" service="gr_redirection_http" priority="3" action="4" attrs="17" nat_port="3128" src_inv="0" dest_inv="1" serv_inv="0" libelle="Redirection des flux http sans proxy" ipsec="0" accept="0">
|
|
600
|
<source name="dmz"/>
|
|
601
|
<destination name="exterieur_bastion"/>
|
|
602
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth3" src="0" dest="1"/>
|
|
603
|
</directive>
|
|
604
|
<directive tag="ForceProxy3" service="gr_redirection_https" priority="4" action="4" attrs="17" nat_port="82" src_inv="0" dest_inv="0" serv_inv="0" libelle="Redirection des flux https sans proxy vers une page d'erreur" ipsec="0" accept="0">
|
|
605
|
<source name="dmz"/>
|
|
606
|
<destination name="exterieur"/>
|
|
607
|
<exception name="" ip="" eolvar="%%proxy_bypass_domain_eth3" src="0" dest="1"/>
|
|
608
|
</directive>
|
|
609
|
<directive tag="ScribeDMZ" service="tous" priority="5" action="16" attrs="17" nat_extr="exterieur_bastion" nat_port="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="autoriser scribe a sortir sur Internet" ipsec="0" accept="0">
|
|
610
|
<source name="serveur_scribe_dmz"/>
|
|
611
|
<destination name="exterieur"/>
|
|
612
|
</directive>
|
|
613
|
</descendantes>
|
|
614
|
</flux>
|
|
615
|
<flux zoneA="admin" zoneB="dmz">
|
|
616
|
<montantes default_policy="0">
|
|
617
|
</montantes>
|
|
618
|
<descendantes default_policy="1">
|
|
619
|
</descendantes>
|
|
620
|
</flux>
|
|
621
|
<flux zoneA="bastion" zoneB="dmz">
|
|
622
|
<montantes default_policy="0">
|
|
623
|
<directive service="http" priority="1" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autorisation reverse proxy + WPAD" ipsec="0" accept="0">
|
|
624
|
<source name="dmz"/>
|
|
625
|
<destination name="bastion_exterieur"/>
|
|
626
|
</directive>
|
|
627
|
<directive tag="SSHDepuisEth3" service="ssh" priority="2" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="ssh dmz vers Amon" ipsec="0" accept="0">
|
|
628
|
<source name="dmz_ssh"/>
|
|
629
|
<destination name="bastion"/>
|
|
630
|
</directive>
|
|
631
|
<directive tag="AdminDepuisEth3" service="admin_amon" priority="3" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="administration dmz vers Amon" ipsec="0" accept="0">
|
|
632
|
<source name="dmz_admin"/>
|
|
633
|
<destination name="bastion"/>
|
|
634
|
</directive>
|
|
635
|
<directive tag="lightsquid3" service="lightsquid" priority="4" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="administration dmz vers Amon" ipsec="0" accept="0">
|
|
636
|
<source name="dmz_admin"/>
|
|
637
|
<destination name="bastion"/>
|
|
638
|
</directive>
|
|
639
|
<directive service="dns-tcp" priority="5" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
640
|
<source name="dmz"/>
|
|
641
|
<destination name="internet"/>
|
|
642
|
</directive>
|
|
643
|
<directive service="dns-udp" priority="6" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
644
|
<source name="dmz"/>
|
|
645
|
<destination name="internet"/>
|
|
646
|
</directive>
|
|
647
|
<directive tag="eole_sso" service="eole-sso" priority="7" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
648
|
<source name="dmz"/>
|
|
649
|
<destination name="bastion"/>
|
|
650
|
</directive>
|
|
651
|
<directive service="proxy" priority="8" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
652
|
<source name="dmz"/>
|
|
653
|
<destination name="internet"/>
|
|
654
|
</directive>
|
|
655
|
<directive tag="Activer squid2" service="proxy2" priority="9" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
656
|
<source name="dmz"/>
|
|
657
|
<destination name="internet"/>
|
|
658
|
</directive>
|
|
659
|
<directive tag="cntlm" service="cntlm" priority="10" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" ipsec="0" accept="0">
|
|
660
|
<source name="dmz"/>
|
|
661
|
<destination name="internet"/>
|
|
662
|
</directive>
|
|
663
|
<directive tag="SSHDepuisEth3" service="gen_config" priority="11" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="gen_config dmz vers Amon" ipsec="0" accept="0">
|
|
664
|
<source name="dmz_ssh"/>
|
|
665
|
<destination name="bastion"/>
|
|
666
|
</directive>
|
|
667
|
<directive service="ldap-horus" priority="12" action="8" attrs="0" nat_extr="horus" nat_port="389" src_inv="0" dest_inv="0" serv_inv="0" libelle="dnat de horus" ipsec="0" accept="0">
|
|
668
|
<source name="scribe"/>
|
|
669
|
<destination name="bastion"/>
|
|
670
|
</directive>
|
|
671
|
<directive service="ldap-scribe" priority="13" action="8" attrs="0" mark_operator="None" mark_value="" nat_extr="scribe" nat_port="389" src_inv="0" dest_inv="0" serv_inv="0" libelle="dnat vers le ldap du scribe" ipsec="0" accept="0">
|
|
672
|
<source name="scribe"/>
|
|
673
|
<destination name="bastion"/>
|
|
674
|
</directive>
|
|
675
|
</montantes>
|
|
676
|
<descendantes default_policy="1">
|
|
677
|
</descendantes>
|
|
678
|
</flux>
|
|
679
|
<flux zoneA="pedago" zoneB="dmz">
|
|
680
|
<montantes default_policy="0">
|
|
681
|
<directive tag="ScribeDMZ" service="scribe-dmz-pedago" priority="1" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="autoriser scribe a se connecter au reseau pedago" ipsec="0" accept="0">
|
|
682
|
<source name="serveur_scribe_dmz"/>
|
|
683
|
<destination name="pedago"/>
|
|
684
|
</directive>
|
|
685
|
</montantes>
|
|
686
|
<descendantes default_policy="1">
|
|
687
|
</descendantes>
|
|
688
|
</flux>
|
|
689
|
</flux-list>
|
|
690
|
</firewall>
|