|
1
|
<?xml version="1.0" encoding="UTF-8" ?>
|
|
2
|
|
|
3
|
<firewall name="/usr/share/era/modeles/5zones.xml" netbios="1" model="" qos="0" version="2.0">
|
|
4
|
<zones>
|
|
5
|
<zone name="exterieur" level="10" ip="%%adresse_ip_eth0" network="%%adresse_network_eth0" netmask="%%adresse_netmask_eth0" interface="eth0"/>
|
|
6
|
<zone name="pubdmz" level="20" ip="%%adresse_ip_eth4" network="%%adresse_network_eth4" netmask="%%adresse_netmask_eth4" interface="eth4"/>
|
|
7
|
<zone name="privdmz" level="30" ip="%%adresse_ip_eth3" network="%%adresse_network_eth3" netmask="%%adresse_netmask_eth3" interface="eth3"/>
|
|
8
|
<zone name="pedago" level="40" ip="%%adresse_ip_eth2" network="%%adresse_network_eth2" netmask="%%adresse_netmask_eth2" interface="eth2"/>
|
|
9
|
<zone name="admin" level="50" ip="%%adresse_ip_eth1" network="%%adresse_network_eth1" netmask="%%adresse_netmask_eth1" interface="eth1"/>
|
|
10
|
<zone name="bastion" level="100" ip="127.0.0.1" network="0.0.0.0" netmask="255.255.255.255" interface="lo"/>
|
|
11
|
</zones>
|
|
12
|
<services>
|
|
13
|
<service name="8500" protocol="tcp" ports="8500" id="11" libelle="service 8500" />
|
|
14
|
<service name="agents_zephir" protocol="tcp" ports="8090" id="41" libelle="Acces web aux agents Zephir" />
|
|
15
|
<service name="dns-tcp" protocol="tcp" ports="53" id="6" libelle="serveur de noms" />
|
|
16
|
<service name="dns-udp" protocol="udp" ports="53" id="7" libelle="serveur de noms" />
|
|
17
|
<service name="ead" protocol="tcp" ports="8501" id="10" libelle="Eole Admin" />
|
|
18
|
<service name="ead2" protocol="tcp" ports="4200" id="42" libelle="ead2" />
|
|
19
|
<service name="echo-reply" protocol="ICMP" ports="0" id="echo-reply" libelle="règle icmp echo-reply" />
|
|
20
|
<service name="echo-request" protocol="ICMP" ports="0" id="echo-request" libelle="règle icmp echo-request" />
|
|
21
|
<service name="eole-sso" protocol="tcp" ports="8443" id="45" libelle="Service Eole SSO" />
|
|
22
|
<service name="ftp-tcp" protocol="tcp" ports="20-21" id="26" libelle="transfert de fichiers" />
|
|
23
|
<service name="ftps" protocol="tcp" ports="989-990" id="29" libelle="service ftps" />
|
|
24
|
<service name="http" protocol="tcp" ports="80" id="3" libelle="serveur web" />
|
|
25
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="web sécurisé" />
|
|
26
|
<service name="imap" protocol="tcp" ports="143" id="21" libelle="service imap" />
|
|
27
|
<service name="imap4-ssl" protocol="tcp" ports="585" id="23" libelle="service imap4-ssl" />
|
|
28
|
<service name="irc" protocol="tcp" ports="194" id="15" libelle="service irc" />
|
|
29
|
<service name="ircs" protocol="tcp" ports="994" id="16" libelle="service ircs" />
|
|
30
|
<service name="ircu" protocol="tcp" ports="6665-6669" id="13" libelle="service ircu" />
|
|
31
|
<service name="ldap" protocol="tcp" ports="389" id="22" libelle="service d'annuaire" />
|
|
32
|
<service name="ldaps" protocol="tcp" ports="636" id="24" libelle="service ldaps" />
|
|
33
|
<service name="mdqs" protocol="tcp" ports="666" id="15" libelle="service mdqs" />
|
|
34
|
<service name="msnp" protocol="tcp" ports="1863" id="17" libelle="service msnp" />
|
|
35
|
<service name="news" protocol="tcp" ports="2009" id="32" libelle="nouvelles" />
|
|
36
|
<service name="nntp" protocol="tcp" ports="119" id="30" libelle="service nntp" />
|
|
37
|
<service name="nntps" protocol="tcp" ports="563" id="31" libelle="service nntps" />
|
|
38
|
<service name="nuauth" protocol="tcp" ports="4129" id="43" libelle="Serveur d'authentification NuFw" />
|
|
39
|
<service name="pftp" protocol="tcp" ports="662" id="28" libelle="service pftp" />
|
|
40
|
<service name="pop" protocol="tcp" ports="110" id="20" libelle="service pop" />
|
|
41
|
<service name="pop3s" protocol="tcp" ports="995" id="25" libelle="service pop3s" />
|
|
42
|
<service name="proxy" protocol="tcp" ports="3128" id="4" libelle="service proxy" />
|
|
43
|
<service name="proxy-8080" protocol="tcp" ports="8080" id="12" libelle="proxy" />
|
|
44
|
<service name="samba-tcp" protocol="tcp" ports="137-139" id="38" libelle="samba tcp" />
|
|
45
|
<service name="samba-udp" protocol="udp" ports="137-139" id="37" libelle="samba" />
|
|
46
|
<service name="samba3" protocol="tcp" ports="445" id="39" libelle="samba3" />
|
|
47
|
<service name="scribe-service" protocol="tcp" ports="8788" id="36" libelle="service scribe sur les clients" />
|
|
48
|
<service name="scribe_vnc1" protocol="tcp" ports="5800" id="40" libelle="vnc 5800" />
|
|
49
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" />
|
|
50
|
<service name="sftp" protocol="tcp" ports="115" id="27" libelle="service sftp" />
|
|
51
|
<service name="smtp" protocol="tcp" ports="25" id="19" libelle="service mail" />
|
|
52
|
<service name="ssh" protocol="tcp" ports="22" id="8" libelle="shell sécrurisé" />
|
|
53
|
<service name="sso" protocol="tcp" ports="8443" id="44" libelle="serveur d'auth" />
|
|
54
|
<service name="talk" protocol="tcp" ports="517-518" id="18" libelle="service talk" />
|
|
55
|
<service name="tcp" protocol="tcp" ports="0-65535" id="33" libelle="tous les ports en tcp" />
|
|
56
|
<service name="tous" protocol="TOUT" ports="0" id="tout" libelle="tous les services" />
|
|
57
|
<service name="udp" protocol="udp" ports="0-65535" id="34" libelle="tous les ports en udp" />
|
|
58
|
<service name="webmin" protocol="tcp" ports="10000" id="9" libelle="appliquation web d'administration" />
|
|
59
|
<groupe id="admin_amon" libelle="Port autorise pour l'administration distante d'Amon (ssh, ead, agents zephir)">
|
|
60
|
<service name="agents_zephir" protocol="tcp" ports="8090" id="41" libelle="Acces web aux agents Zephir" />
|
|
61
|
<service name="ead" protocol="tcp" ports="8501" id="10" libelle="Eole Admin" />
|
|
62
|
<service name="ead2" protocol="tcp" ports="4200" id="42" libelle="ead2" />
|
|
63
|
<service name="echo-request" protocol="ICMP" ports="0" id="echo-request" libelle="règle icmp echo-request" />
|
|
64
|
<service name="eole-sso" protocol="tcp" ports="8443" id="45" libelle="Service Eole SSO" />
|
|
65
|
<service name="ssh" protocol="tcp" ports="22" id="8" libelle="shell sécrurisé" />
|
|
66
|
</groupe>
|
|
67
|
<groupe id="dns" libelle="dns tcp et udp">
|
|
68
|
<service name="dns-udp" protocol="udp" ports="53" id="7" libelle="serveur de noms" />
|
|
69
|
<service name="dns-tcp" protocol="tcp" ports="53" id="6" libelle="serveur de noms" />
|
|
70
|
</groupe>
|
|
71
|
<groupe id="gr_ead" libelle="eole admin">
|
|
72
|
<service name="ead" protocol="tcp" ports="8501" id="10" libelle="Eole Admin" />
|
|
73
|
<service name="ead2" protocol="tcp" ports="4200" id="42" libelle="ead2" />
|
|
74
|
</groupe>
|
|
75
|
<groupe id="gr_forum" libelle="interdire l'utilisation des forums">
|
|
76
|
<service name="nntp" protocol="tcp" ports="119" id="30" libelle="service nntp" />
|
|
77
|
<service name="nntps" protocol="tcp" ports="563" id="31" libelle="service nntps" />
|
|
78
|
<service name="news" protocol="tcp" ports="2009" id="32" libelle="nouvelles" />
|
|
79
|
</groupe>
|
|
80
|
<groupe id="gr_ftp" libelle="">
|
|
81
|
<service name="ftp-tcp" protocol="tcp" ports="20-21" id="26" libelle="transfert de fichiers" />
|
|
82
|
<service name="ftps" protocol="tcp" ports="989-990" id="29" libelle="service ftps" />
|
|
83
|
<service name="pftp" protocol="tcp" ports="662" id="28" libelle="service pftp" />
|
|
84
|
<service name="sftp" protocol="tcp" ports="115" id="27" libelle="service sftp" />
|
|
85
|
</groupe>
|
|
86
|
<groupe id="gr_irc" libelle="interdire l'utilisation des dialogues en direct (icq)">
|
|
87
|
<service name="talk" protocol="tcp" ports="517-518" id="18" libelle="service talk" />
|
|
88
|
<service name="msnp" protocol="tcp" ports="1863" id="17" libelle="service msnp" />
|
|
89
|
<service name="mdqs" protocol="tcp" ports="666" id="15" libelle="service mdqs" />
|
|
90
|
<service name="ircs" protocol="tcp" ports="994" id="16" libelle="service ircs" />
|
|
91
|
<service name="irc" protocol="tcp" ports="194" id="15" libelle="service irc" />
|
|
92
|
<service name="ircu" protocol="tcp" ports="6665-6669" id="13" libelle="service ircu" />
|
|
93
|
</groupe>
|
|
94
|
<groupe id="gr_messagerie" libelle="interdire l'utilisation des dialogues en direct (icq)">
|
|
95
|
<service name="imap" protocol="tcp" ports="143" id="21" libelle="service imap" />
|
|
96
|
<service name="imap4-ssl" protocol="tcp" ports="585" id="23" libelle="service imap4-ssl" />
|
|
97
|
<service name="ldap" protocol="tcp" ports="389" id="22" libelle="service d'annuaire" />
|
|
98
|
<service name="ldaps" protocol="tcp" ports="636" id="24" libelle="service ldaps" />
|
|
99
|
<service name="pop" protocol="tcp" ports="110" id="20" libelle="service pop" />
|
|
100
|
<service name="pop3s" protocol="tcp" ports="995" id="25" libelle="service pop3s" />
|
|
101
|
<service name="smtp" protocol="tcp" ports="25" id="19" libelle="service mail" />
|
|
102
|
</groupe>
|
|
103
|
<groupe id="gr_redirection" libelle="Protocoles a rediriger vers le proxy">
|
|
104
|
<service name="http" protocol="tcp" ports="80" id="3" libelle="serveur web" />
|
|
105
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="web sécurisé" />
|
|
106
|
<service name="proxy" protocol="tcp" ports="3128" id="4" libelle="service proxy" />
|
|
107
|
<service name="proxy-8080" protocol="tcp" ports="8080" id="12" libelle="proxy" />
|
|
108
|
</groupe>
|
|
109
|
<groupe id="gr_restreint" libelle="on ferme tout sauf l'utilisation du web par le proxy">
|
|
110
|
<service name="tcp" protocol="tcp" ports="0-65535" id="33" libelle="tous les ports en tcp" />
|
|
111
|
<service name="udp" protocol="udp" ports="0-65535" id="34" libelle="tous les ports en udp" />
|
|
112
|
</groupe>
|
|
113
|
<groupe id="samba" libelle="samba proto">
|
|
114
|
<service name="samba-udp" protocol="udp" ports="137-139" id="37" libelle="samba" />
|
|
115
|
<service name="samba-tcp" protocol="tcp" ports="137-139" id="38" libelle="samba tcp" />
|
|
116
|
<service name="samba3" protocol="tcp" ports="445" id="39" libelle="samba3" />
|
|
117
|
</groupe>
|
|
118
|
<groupe id="scribe-pedago" libelle="service scribe privdmz vers peda">
|
|
119
|
<service name="samba-tcp" protocol="tcp" ports="137-139" id="38" libelle="samba tcp" />
|
|
120
|
<service name="samba-udp" protocol="udp" ports="137-139" id="37" libelle="samba" />
|
|
121
|
<service name="samba3" protocol="tcp" ports="445" id="39" libelle="samba3" />
|
|
122
|
<service name="scribe-service" protocol="tcp" ports="8788" id="36" libelle="service scribe sur les clients" />
|
|
123
|
<service name="scribe_vnc1" protocol="tcp" ports="5800" id="40" libelle="vnc 5800" />
|
|
124
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" />
|
|
125
|
</groupe>
|
|
126
|
<groupe id="scribe_ext" libelle="services extranet scribe ">
|
|
127
|
<service name="ftp-tcp" protocol="tcp" ports="20-21" id="26" libelle="transfert de fichiers" />
|
|
128
|
<service name="https" protocol="tcp" ports="443" id="5" libelle="web sécurisé" />
|
|
129
|
</groupe>
|
|
130
|
<groupe id="vnc" libelle="vnc">
|
|
131
|
<service name="scribe_vnc1" protocol="tcp" ports="5800" id="40" libelle="vnc 5800" />
|
|
132
|
<service name="scribe_vnc2" protocol="tcp" ports="5900" id="41" libelle="vnc 5900" />
|
|
133
|
</groupe>
|
|
134
|
</services>
|
|
135
|
<qosclasses upload="" download="">
|
|
136
|
</qosclasses>
|
|
137
|
<extremites>
|
|
138
|
<extremite zone="admin" name="admin_restreint" libelle="zone restreinte" netmask="%%adresse_netmask_eth1" subnet="1">
|
|
139
|
<ip address="%%adresse_network_eth1"/>
|
|
140
|
</extremite>
|
|
141
|
<extremite zone="exterieur" name="exterieur" libelle="entire zone" netmask="0.0.0.0" subnet="1">
|
|
142
|
<ip address="0.0.0.0"/>
|
|
143
|
</extremite>
|
|
144
|
<extremite zone="pubdmz" name="pubdmz_restreint" libelle="zone restreinte" netmask="%%adresse_netmask_eth4" subnet="1">
|
|
145
|
<ip address="%%adresse_network_eth4"/>
|
|
146
|
</extremite>
|
|
147
|
<extremite zone="exterieur" name="exterieur_restreint" libelle="zone restreinte exterieur" netmask="%%adresse_netmask_eth0" subnet="1">
|
|
148
|
<ip address="%%adresse_network_eth0"/>
|
|
149
|
</extremite>
|
|
150
|
<extremite zone="pubdmz" name="tout_pubdmz" libelle="" netmask="0.0.0.0" subnet="1">
|
|
151
|
<ip address="0.0.0.0"/>
|
|
152
|
</extremite>
|
|
153
|
<extremite zone="pubdmz" name="pubdmz" libelle="entire zone" netmask="%%adresse_netmask_eth4" subnet="1">
|
|
154
|
<ip address="%%adresse_ip_eth4"/>
|
|
155
|
</extremite>
|
|
156
|
<extremite zone="exterieur" name="admin_exterieur" libelle="reseau autorise a administrer depuis l'exterieur" netmask="%%netmask_ssh_eth0" subnet="1">
|
|
157
|
<ip address="%%ip_ssh_eth0"/>
|
|
158
|
</extremite>
|
|
159
|
<extremite zone="pubdmz" name="admin_pubdmz" libelle="reseau autorise a administrer depuis la DMZ publique" netmask="%%netmask_ssh_eth4" subnet="1">
|
|
160
|
<ip address="%%ip_ssh_eth4"/>
|
|
161
|
</extremite>
|
|
162
|
<extremite zone="privdmz" name="serveur_scribe_privdmz" libelle="serveur scribe sur DMZ" netmask="255.255.255.255" subnet="0">
|
|
163
|
<ip address="%%ip_serveur_scribe_privdmz"/>
|
|
164
|
</extremite>
|
|
165
|
<extremite zone="pedago" name="pedago_restreint" libelle="zone restreinte" netmask="%%adresse_netmask_eth2" subnet="1">
|
|
166
|
<ip address="%%adresse_network_eth2"/>
|
|
167
|
</extremite>
|
|
168
|
<extremite zone="pedago" name="tout_pedago" libelle="Zone entiere pedago" netmask="0.0.0.0" subnet="1">
|
|
169
|
<ip address="0.0.0.0"/>
|
|
170
|
</extremite>
|
|
171
|
<extremite zone="admin" name="admin_admin" libelle="reseau autorise a administrer depuis le reseau administratif" netmask="%%netmask_ssh_eth1" subnet="1">
|
|
172
|
<ip address="%%ip_ssh_eth1"/>
|
|
173
|
</extremite>
|
|
174
|
<extremite zone="admin" name="admin" libelle="entire zone" netmask="%%adresse_netmask_eth1" subnet="1">
|
|
175
|
<ip address="%%adresse_ip_eth1"/>
|
|
176
|
</extremite>
|
|
177
|
<extremite zone="privdmz" name="tout_privdmz" libelle="zone entiere DMZ" netmask="0.0.0.0" subnet="1">
|
|
178
|
<ip address="0.0.0.0"/>
|
|
179
|
</extremite>
|
|
180
|
<extremite zone="privdmz" name="privdmz" libelle="entire zone" netmask="%%adresse_netmask_eth3" subnet="1">
|
|
181
|
<ip address="%%adresse_ip_eth3"/>
|
|
182
|
</extremite>
|
|
183
|
<extremite zone="pedago" name="pedago" libelle="entire zone" netmask="%%adresse_netmask_eth2" subnet="1">
|
|
184
|
<ip address="%%adresse_ip_eth2"/>
|
|
185
|
</extremite>
|
|
186
|
<extremite zone="admin" name="tout_admin" libelle="zone entiere" netmask="0.0.0.0" subnet="1">
|
|
187
|
<ip address="0.0.0.0"/>
|
|
188
|
</extremite>
|
|
189
|
<extremite zone="bastion" name="bastion" libelle="entire zone" netmask="255.255.255.255" subnet="1">
|
|
190
|
<ip address="127.0.0.1"/>
|
|
191
|
</extremite>
|
|
192
|
<extremite zone="privdmz" name="admin_privdmz" libelle="reseau autorise a administrer depuis la DMZ" netmask="%%netmask_ssh_eth3" subnet="1">
|
|
193
|
<ip address="%%ip_ssh_eth3"/>
|
|
194
|
</extremite>
|
|
195
|
<extremite zone="privdmz" name="privdmz_restreint" libelle="zone restreinte" netmask="%%adresse_netmask_eth3" subnet="1">
|
|
196
|
<ip address="%%adresse_network_eth3"/>
|
|
197
|
</extremite>
|
|
198
|
<extremite zone="exterieur" name="exterieur_bastion" libelle="l'ip du bastion" netmask="255.255.255.255" subnet="0">
|
|
199
|
<ip address="%%adresse_ip_eth0"/>
|
|
200
|
</extremite>
|
|
201
|
<extremite zone="pedago" name="admin_pedago" libelle="reseau autorise a administrer depuis le reseau pedagogique" netmask="%%netmask_ssh_eth2" subnet="1">
|
|
202
|
<ip address="%%ip_ssh_eth2"/>
|
|
203
|
</extremite>
|
|
204
|
</extremites>
|
|
205
|
<ranges>
|
|
206
|
</ranges>
|
|
207
|
<user_groups>
|
|
208
|
<user_group name="professeurs" id="10001"/>
|
|
209
|
<user_group name="élèves" id="10002"/>
|
|
210
|
</user_groups>
|
|
211
|
<flux-list>
|
|
212
|
<flux zoneA="exterieur" zoneB="bastion">
|
|
213
|
<montantes>
|
|
214
|
<directive service="admin_amon" priority="1" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="administration Amon exterieure" >
|
|
215
|
<source name="admin_exterieur"/>
|
|
216
|
<destination name="bastion"/>
|
|
217
|
</directive>
|
|
218
|
<directive service="sso" priority="2" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
219
|
<source name="exterieur"/>
|
|
220
|
<destination name="bastion"/>
|
|
221
|
</directive>
|
|
222
|
</montantes>
|
|
223
|
<descendantes>
|
|
224
|
</descendantes>
|
|
225
|
</flux>
|
|
226
|
<flux zoneA="exterieur" zoneB="privdmz">
|
|
227
|
<montantes>
|
|
228
|
</montantes>
|
|
229
|
<descendantes>
|
|
230
|
</descendantes>
|
|
231
|
</flux>
|
|
232
|
<flux zoneA="bastion" zoneB="privdmz">
|
|
233
|
<montantes>
|
|
234
|
<directive service="admin_amon" priority="1" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="autoriser l'administration depuis la DMZ" >
|
|
235
|
<source name="admin_privdmz"/>
|
|
236
|
<destination name="bastion"/>
|
|
237
|
</directive>
|
|
238
|
<directive service="dns" priority="2" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="requetes DNS" >
|
|
239
|
<source name="privdmz"/>
|
|
240
|
<destination name="bastion"/>
|
|
241
|
</directive>
|
|
242
|
<directive service="proxy" priority="3" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
243
|
<source name="privdmz"/>
|
|
244
|
<destination name="bastion"/>
|
|
245
|
</directive>
|
|
246
|
<directive service="sso" priority="4" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
247
|
<source name="privdmz"/>
|
|
248
|
<destination name="bastion"/>
|
|
249
|
</directive>
|
|
250
|
</montantes>
|
|
251
|
<descendantes>
|
|
252
|
</descendantes>
|
|
253
|
</flux>
|
|
254
|
<flux zoneA="exterieur" zoneB="pedago">
|
|
255
|
<montantes>
|
|
256
|
</montantes>
|
|
257
|
<descendantes>
|
|
258
|
<directive service="tous" priority="1" action="16" attrs="0" nat_extr="exterieur_bastion" nat_port="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
259
|
<source name="pedago_restreint"/>
|
|
260
|
<destination name="exterieur"/>
|
|
261
|
</directive>
|
|
262
|
<directive tag="Interdiction des forums" service="gr_forum" priority="2" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="pedago -> exterieur : interdire les protocoles de news, forums ..." >
|
|
263
|
<source name="pedago"/>
|
|
264
|
<destination name="exterieur"/>
|
|
265
|
</directive>
|
|
266
|
<directive tag="Interdire les connexions FTP" service="gr_ftp" priority="3" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="Interdire les connexions FTP" >
|
|
267
|
<source name="pedago"/>
|
|
268
|
<destination name="exterieur"/>
|
|
269
|
</directive>
|
|
270
|
<directive tag="Interdire l'utilisation des dialogues en direct" service="gr_irc" priority="4" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="pedago -> exterieur : interdire les protocoles de discussion en ligne (irc ...)" >
|
|
271
|
<source name="pedago"/>
|
|
272
|
<destination name="exterieur"/>
|
|
273
|
</directive>
|
|
274
|
<directive tag="Interdiction des protocoles de messagerie" service="gr_messagerie" priority="5" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="pedago -> exterieur : interdire les protocoles de messagerie (pop, imap ...)" >
|
|
275
|
<source name="pedago"/>
|
|
276
|
<destination name="exterieur"/>
|
|
277
|
</directive>
|
|
278
|
<directive tag="Internet restreint" service="gr_restreint" priority="6" action="1" attrs="1" src_inv="0" dest_inv="0" serv_inv="0" libelle="pedago -> exterieur : tout interdire (sauf le web via le proxy)" >
|
|
279
|
<source name="pedago"/>
|
|
280
|
<destination name="exterieur"/>
|
|
281
|
</directive>
|
|
282
|
<directive service="gr_redirection" priority="7" action="4" attrs="0" nat_port="3128" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
283
|
<source name="pedago"/>
|
|
284
|
<destination name="exterieur"/>
|
|
285
|
</directive>
|
|
286
|
</descendantes>
|
|
287
|
</flux>
|
|
288
|
<flux zoneA="privdmz" zoneB="pedago">
|
|
289
|
<montantes>
|
|
290
|
</montantes>
|
|
291
|
<descendantes>
|
|
292
|
</descendantes>
|
|
293
|
</flux>
|
|
294
|
<flux zoneA="bastion" zoneB="pedago">
|
|
295
|
<montantes>
|
|
296
|
<directive service="admin_amon" priority="1" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser l'administration d'Amon depuis le reseau pedagogique" >
|
|
297
|
<source name="admin_pedago"/>
|
|
298
|
<destination name="bastion"/>
|
|
299
|
</directive>
|
|
300
|
<directive service="dns" priority="2" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
301
|
<source name="pedago"/>
|
|
302
|
<destination name="bastion"/>
|
|
303
|
</directive>
|
|
304
|
<directive service="proxy" priority="3" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
305
|
<source name="pedago"/>
|
|
306
|
<destination name="bastion"/>
|
|
307
|
</directive>
|
|
308
|
<directive tag="auth_nufw" service="nuauth" priority="4" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser les connexions au port 4129 (NuAuth) depuis pedago" >
|
|
309
|
<source name="tout_pedago"/>
|
|
310
|
<destination name="bastion"/>
|
|
311
|
</directive>
|
|
312
|
<directive service="sso" priority="5" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
313
|
<source name="pedago"/>
|
|
314
|
<destination name="bastion"/>
|
|
315
|
</directive>
|
|
316
|
</montantes>
|
|
317
|
<descendantes>
|
|
318
|
</descendantes>
|
|
319
|
</flux>
|
|
320
|
<flux zoneA="exterieur" zoneB="admin">
|
|
321
|
<montantes>
|
|
322
|
</montantes>
|
|
323
|
<descendantes>
|
|
324
|
<directive service="tous" priority="1" action="16" attrs="0" nat_extr="exterieur_bastion" nat_port="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
325
|
<source name="admin_restreint"/>
|
|
326
|
<destination name="exterieur"/>
|
|
327
|
</directive>
|
|
328
|
<directive service="gr_redirection" priority="2" action="4" attrs="0" nat_port="3128" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
329
|
<source name="admin"/>
|
|
330
|
<destination name="exterieur"/>
|
|
331
|
</directive>
|
|
332
|
</descendantes>
|
|
333
|
</flux>
|
|
334
|
<flux zoneA="privdmz" zoneB="admin">
|
|
335
|
<montantes>
|
|
336
|
</montantes>
|
|
337
|
<descendantes>
|
|
338
|
</descendantes>
|
|
339
|
</flux>
|
|
340
|
<flux zoneA="pedago" zoneB="admin">
|
|
341
|
<montantes>
|
|
342
|
</montantes>
|
|
343
|
<descendantes>
|
|
344
|
</descendantes>
|
|
345
|
</flux>
|
|
346
|
<flux zoneA="bastion" zoneB="admin">
|
|
347
|
<montantes>
|
|
348
|
<directive service="admin_amon" priority="1" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
349
|
<source name="admin_admin"/>
|
|
350
|
<destination name="bastion"/>
|
|
351
|
</directive>
|
|
352
|
<directive service="dns" priority="2" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
353
|
<source name="admin"/>
|
|
354
|
<destination name="bastion"/>
|
|
355
|
</directive>
|
|
356
|
<directive service="proxy" priority="3" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
357
|
<source name="admin"/>
|
|
358
|
<destination name="bastion"/>
|
|
359
|
</directive>
|
|
360
|
<directive tag="auth_nufw" service="nuauth" priority="4" action="2" attrs="17" src_inv="0" dest_inv="0" serv_inv="0" libelle="Autoriser les connexions au port 4129 (NuAuth) depuis admin" >
|
|
361
|
<source name="tout_admin"/>
|
|
362
|
<destination name="bastion"/>
|
|
363
|
</directive>
|
|
364
|
<directive service="sso" priority="5" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
365
|
<source name="admin"/>
|
|
366
|
<destination name="bastion"/>
|
|
367
|
</directive>
|
|
368
|
</montantes>
|
|
369
|
<descendantes>
|
|
370
|
</descendantes>
|
|
371
|
</flux>
|
|
372
|
<flux zoneA="exterieur" zoneB="pubdmz">
|
|
373
|
<montantes>
|
|
374
|
</montantes>
|
|
375
|
<descendantes>
|
|
376
|
</descendantes>
|
|
377
|
</flux>
|
|
378
|
<flux zoneA="privdmz" zoneB="pubdmz">
|
|
379
|
<montantes>
|
|
380
|
</montantes>
|
|
381
|
<descendantes>
|
|
382
|
</descendantes>
|
|
383
|
</flux>
|
|
384
|
<flux zoneA="pedago" zoneB="pubdmz">
|
|
385
|
<montantes>
|
|
386
|
</montantes>
|
|
387
|
<descendantes>
|
|
388
|
</descendantes>
|
|
389
|
</flux>
|
|
390
|
<flux zoneA="admin" zoneB="pubdmz">
|
|
391
|
<montantes>
|
|
392
|
</montantes>
|
|
393
|
<descendantes>
|
|
394
|
</descendantes>
|
|
395
|
</flux>
|
|
396
|
<flux zoneA="bastion" zoneB="pubdmz">
|
|
397
|
<montantes>
|
|
398
|
<directive service="admin_amon" priority="1" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
399
|
<source name="admin_pubdmz"/>
|
|
400
|
<destination name="bastion"/>
|
|
401
|
</directive>
|
|
402
|
<directive service="dns" priority="2" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
403
|
<source name="pubdmz"/>
|
|
404
|
<destination name="bastion"/>
|
|
405
|
</directive>
|
|
406
|
<directive service="proxy" priority="3" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
407
|
<source name="pubdmz"/>
|
|
408
|
<destination name="bastion"/>
|
|
409
|
</directive>
|
|
410
|
<directive service="sso" priority="4" action="2" attrs="0" src_inv="0" dest_inv="0" serv_inv="0" libelle="pas de description" >
|
|
411
|
<source name="pubdmz"/>
|
|
412
|
<destination name="bastion"/>
|
|
413
|
</directive>
|
|
414
|
</montantes>
|
|
415
|
<descendantes>
|
|
416
|
</descendantes>
|
|
417
|
</flux>
|
|
418
|
</flux-list>
|
|
419
|
</firewall>
|