|
1
|
<?xml version="1.0" encoding="UTF-8" ?>
|
|
2
|
<firewall name="/usr/share/era/modeles/4zones26v3.xml" netbios="1" qos="0" version="2.42">
|
|
3
|
<zones>
|
|
4
|
<zone interface="%%nom_zone_eth0" ip="%%adresse_ip_eth0" level="10" name="exterieur" netmask="%%adresse_netmask_eth0" network="%%adresse_network_eth0" />
|
|
5
|
<zone interface="lo" ip="127.0.0.1" level="100" name="bastion" netmask="255.255.255.255" network="0.0.0.0" />
|
|
6
|
<zone interface="%%nom_zone_eth1" ip="%%adresse_ip_eth1" level="50" name="admin" netmask="%%adresse_netmask_eth1" network="%%adresse_network_eth1" />
|
|
7
|
<zone interface="%%nom_zone_eth2" ip="%%adresse_ip_eth2" level="40" name="pedago" netmask="%%adresse_netmask_eth2" network="%%adresse_network_eth2" />
|
|
8
|
<zone interface="%%nom_zone_eth3" ip="%%adresse_ip_eth3" level="30" name="dmz" netmask="%%adresse_netmask_eth3" network="%%adresse_network_eth3" />
|
|
9
|
</zones>
|
|
10
|
<include>
|
|
11
|
## INCLUSIONS_STATIQUES
|
|
12
|
## EXT-DMZ: redirection des ports autorises sur les serveurs DMZ
|
|
13
|
## IP PUB 1 : serveur WWW
|
|
14
|
%if %%nb_ip_pub in ('1','2','3','4','5','6','7','8') and %%ip_pub1 != ''
|
|
15
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub1/32 -i %%nom_zone_eth0 -p tcp -m tcp -m multiport --dports 20:22,80,81,389,443,636,1723,4129,4200 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web1
|
|
16
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub1/32 -i %%nom_zone_eth0 -p tcp -m tcp -m multiport --dports 7070,8008,8090,8443,20100,44123,49300,49400,49500 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web1
|
|
17
|
/sbin/iptables -t filter -I ext-dmz -d %%ip_serveur_web1/32 -i %%nom_zone_eth0 -o %%nom_zone_eth3 -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
18
|
/sbin/iptables -t nat -I POSTROUTING -s %%ip_serveur_web1/32 -o %%nom_zone_eth0 -j SNAT --to-source %%adresse_ip_eth0
|
|
19
|
%end if
|
|
20
|
## IP PUB 2 : serveur NOTES
|
|
21
|
%if %%nb_ip_pub in ('2','3','4','5','6','7','8') and %%ip_pub2 != ''
|
|
22
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub2/32 -i %%nom_zone_eth0 -p tcp -m tcp -m multiport --dports 20:22,80,81,389,443,636,1723,4129,4200 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web2
|
|
23
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub2/32 -i %%nom_zone_eth0 -p tcp -m tcp -m multiport --dports 7070,8008,8090,8443,20100,44123,49300,49400,49500 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web2
|
|
24
|
/sbin/iptables -t filter -I ext-dmz -d %%ip_serveur_web2/32 -i %%nom_zone_eth0 -o %%nom_zone_eth3 -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
25
|
/sbin/iptables -t nat -I POSTROUTING -s %%ip_serveur_web2/32 -o %%nom_zone_eth0 -j SNAT --to-source %%adresse_ip_eth0
|
|
26
|
%end if
|
|
27
|
## IP PUB 3 : serveur COURRIER
|
|
28
|
%if %%nb_ip_pub in ('3','4','5','6','7','8') and %%ip_pub3 != ''
|
|
29
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub3/32 -i %%nom_zone_eth0 -p tcp -m tcp -m multiport --dports 20:22,25,80,81,110,143,389,443,585,636,995,1723,4129,4200 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web3
|
|
30
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub3/32 -i %%nom_zone_eth0 -p tcp -m tcp -m multiport --dports 7070,8008,8090,8443,20100,44123,49300,49400,49500 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web3
|
|
31
|
/sbin/iptables -t filter -I ext-dmz -d %%ip_serveur_web3/32 -i %%nom_zone_eth0 -o %%nom_zone_eth3 -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
32
|
/sbin/iptables -t nat -I POSTROUTING -s %%ip_serveur_web3/32 -o %%nom_zone_eth0 -j SNAT --to-source %%adresse_ip_eth0
|
|
33
|
%end if
|
|
34
|
## IP PUB 4 : serveur DISPO
|
|
35
|
%if %%nb_ip_pub in ('4','5','6','7','8') and %%ip_pub4 != ''
|
|
36
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub4/32 -i %%nom_zone_eth0 -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web4
|
|
37
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub4/32 -i %%nom_zone_eth0 -p udp -m udp -j DNAT --to-destination %%ip_serveur_web4
|
|
38
|
/sbin/iptables -t filter -I ext-dmz -d %%ip_serveur_web4/32 -i %%nom_zone_eth0 -o %%nom_zone_eth3 -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
39
|
/sbin/iptables -t filter -I ext-dmz -d %%ip_serveur_web4/32 -i %%nom_zone_eth0 -o %%nom_zone_eth3 -p udp -j ACCEPT
|
|
40
|
/sbin/iptables -t nat -I POSTROUTING -s %%ip_serveur_web4/32 -o %%nom_zone_eth0 -j SNAT --to-source %%adresse_ip_eth0
|
|
41
|
%end if
|
|
42
|
## IP PUB 5 :
|
|
43
|
%if %%nb_ip_pub in ('5','6','7','8') and %%ip_pub5 != ''
|
|
44
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub5/32 -i %%nom_zone_eth0 -p tcp -m tcp -m multiport --dports 20:22,80,81,389,443,636,1723,4129,4200 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web5
|
|
45
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub5/32 -i %%nom_zone_eth0 -p tcp -m tcp -m multiport --dports 7070,8008,8090,8443,20100,44123,49300,49400,49500 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web5
|
|
46
|
/sbin/iptables -t filter -I ext-dmz -d %%ip_serveur_web5/32 -i %%nom_zone_eth0 -o %%nom_zone_eth3 -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
47
|
/sbin/iptables -t nat -I POSTROUTING -s %%ip_serveur_web5/32 -o %%nom_zone_eth0 -j SNAT --to-source %%adresse_ip_eth0
|
|
48
|
%end if
|
|
49
|
## IP PUB 6 :
|
|
50
|
%if %%nb_ip_pub in ('6','7','8') and %%ip_pub6 != ''
|
|
51
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub6/32 -i %%nom_zone_eth0 -p tcp -m tcp -m multiport --dports 20:22,80,81,389,443,636,1723,4129,4200 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web6
|
|
52
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub6/32 -i %%nom_zone_eth0 -p tcp -m tcp -m multiport --dports 7070,8008,8090,8443,20100,44123,49300,49400,49500 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web6
|
|
53
|
/sbin/iptables -t filter -I ext-dmz -d %%ip_serveur_web6/32 -i %%nom_zone_eth0 -o %%nom_zone_eth3 -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
54
|
/sbin/iptables -t nat -I POSTROUTING -s %%ip_serveur_web6/32 -o %%nom_zone_eth0 -j SNAT --to-source %%adresse_ip_eth0
|
|
55
|
%end if
|
|
56
|
## IP PUB 7 :
|
|
57
|
%if %%nb_ip_pub in ('7','8') and %%ip_pub7 != ''
|
|
58
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub7/32 -i %%nom_zone_eth0 -p tcp -m tcp -m multiport --dports 20:22,25,80,81,110,143,389,443,585,636,995,1723,4129,4200 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web7
|
|
59
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub7/32 -i %%nom_zone_eth0 -p tcp -m tcp -m multiport --dports 7070,8008,8090,8443,20100,44123,49300,49400,49500 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web7
|
|
60
|
/sbin/iptables -t filter -I ext-dmz -d %%ip_serveur_web7/32 -i %%nom_zone_eth0 -o %%nom_zone_eth3 -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
61
|
/sbin/iptables -t nat -I POSTROUTING -s %%ip_serveur_web7/32 -o %%nom_zone_eth0 -j SNAT --to-source %%adresse_ip_eth0
|
|
62
|
%end if
|
|
63
|
## IP PUB 8 :
|
|
64
|
%if %%nb_ip_pub in ('8') and %%ip_pub8 != ''
|
|
65
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub8/32 -i %%nom_zone_eth0 -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web8
|
|
66
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub8/32 -i %%nom_zone_eth0 -p udp -m udp -j DNAT --to-destination %%ip_serveur_web8
|
|
67
|
/sbin/iptables -t filter -I ext-dmz -d %%ip_serveur_web8/32 -i %%nom_zone_eth0 -o %%nom_zone_eth3 -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
68
|
/sbin/iptables -t filter -I ext-dmz -d %%ip_serveur_web8/32 -i %%nom_zone_eth0 -o %%nom_zone_eth3 -p udp -j ACCEPT
|
|
69
|
/sbin/iptables -t nat -I POSTROUTING -s %%ip_serveur_web8/32 -o %%nom_zone_eth0 -j SNAT --to-source %%adresse_ip_eth0
|
|
70
|
%end if
|
|
71
|
|
|
72
|
## EXT-BAS: acces au serveur peda depuis le reseau rectorat
|
|
73
|
/sbin/iptables -t nat -I PREROUTING -s 195.83.225.0/24 -d %%adresse_ip_eth0/32 -i %%nom_zone_eth0 -p tcp -m tcp --dport 44123 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_pedago
|
|
74
|
/sbin/iptables -t filter -I ext-ped -s 195.83.225.0/24 -d %%ip_serveur_pedago/32 -i %%nom_zone_eth0 -p tcp -m state --state NEW -m tcp --dport 44123 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
75
|
|
|
76
|
## EXCEPTIONS au PROXY HTTP et HTTPS
|
|
77
|
## ADMIN : VPN OTP (195.83.226.53), GLPI (195.83.225.232) et HORIZON (172.31.0.0)
|
|
78
|
/sbin/iptables -t nat -I PREROUTING -i %%nom_zone_eth1 -p tcp -m tcp -m multiport --dports 80,443 --tcp-flags SYN,RST,ACK SYN -d 195.83.226.53/32 -j ACCEPT
|
|
79
|
/sbin/iptables -t nat -I PREROUTING -i %%nom_zone_eth1 -p tcp -m tcp -m multiport --dports 80,443 --tcp-flags SYN,RST,ACK SYN -d 195.83.225.232/32 -j ACCEPT
|
|
80
|
/sbin/iptables -t nat -I PREROUTING -i %%nom_zone_eth1 -p tcp -m tcp -m multiport --dports 80,443 --tcp-flags SYN,RST,ACK SYN -d 172.31.0.0/16 -j ACCEPT
|
|
81
|
## PEDA : VPN OTP (195.83.226.53), serveur GLPI (195.83.225.232) et client LEGERS
|
|
82
|
/sbin/iptables -t nat -I PREROUTING -i %%nom_zone_eth2 -p tcp -m tcp -m multiport --dports 80,443 --tcp-flags SYN,RST,ACK SYN -d 195.83.226.53/32 -j ACCEPT
|
|
83
|
/sbin/iptables -t nat -I PREROUTING -i %%nom_zone_eth2 -p tcp -m tcp -m multiport --dports 80,443 --tcp-flags SYN,RST,ACK SYN -d 195.83.225.232/32 -j ACCEPT
|
|
84
|
/sbin/iptables -t nat -I PREROUTING -i %%nom_zone_eth2 -p tcp -m tcp -m multiport --dports 80,443 --tcp-flags SYN,RST,ACK SYN -d 172.23.0.0/16 -j ACCEPT
|
|
85
|
## DMZ : pas de proxy pour domaine ac-montpellier (SSO pronote ENT)
|
|
86
|
/sbin/iptables -t nat -I PREROUTING -i %%nom_zone_eth3 -p tcp -m tcp -m multiport --dports 80,443 --tcp-flags SYN,RST,ACK SYN -d 195.83.225.0/24 -j ACCEPT
|
|
87
|
|
|
88
|
## pour NTOP
|
|
89
|
/sbin/iptables -t filter -I adm-bas -m state --state NEW -p tcp --dport 3000 --tcp-flags SYN,RST,ACK SYN -i %%nom_zone_eth1 -s %%adresse_network_eth1/%%adresse_netmask_eth2 -j ACCEPT
|
|
90
|
/sbin/iptables -t filter -I ped-bas -m state --state NEW -p tcp --dport 3000 --tcp-flags SYN,RST,ACK SYN -i %%nom_zone_eth2 -s %%adresse_network_eth2/30 -j ACCEPT
|
|
91
|
/sbin/iptables -t filter -I ext-bas -m state --state NEW -p tcp --dport 3000 --tcp-flags SYN,RST,ACK SYN -i %%nom_zone_eth0 -s 195.83.225.0/255.255.255.0 -j ACCEPT
|
|
92
|
|
|
93
|
## Pour shinken
|
|
94
|
/sbin/iptables -t filter -I ext-bas -m state --state NEW -p tcp --dport 6556 --tcp-flags SYN,RST,ACK SYN -i %%nom_zone_eth0 -s 195.83.225.0/255.255.255.0 -j ACCEPT
|
|
95
|
|
|
96
|
## Regle pour starleaf BREEZE
|
|
97
|
## Pour admin
|
|
98
|
/sbin/iptables -t nat -I PREROUTING -i %%nom_zone_eth1 -p tcp -m tcp -m multiport --dports 80,443 --tcp-flags SYN,RST,ACK SYN -d 89.202.39.91/32 -j ACCEPT
|
|
99
|
/sbin/iptables -t nat -I PREROUTING -i %%nom_zone_eth1 -p tcp -m tcp -m multiport --dports 80,443 --tcp-flags SYN,RST,ACK SYN -d 80.231.134.47/32 -j ACCEPT
|
|
100
|
/sbin/iptables -t nat -I PREROUTING -i %%nom_zone_eth1 -p tcp -m tcp -m multiport --dports 80,443 --tcp-flags SYN,RST,ACK SYN -d 72.28.118.203/32 -j ACCEPT
|
|
101
|
## pour pedago
|
|
102
|
/sbin/iptables -t nat -I PREROUTING -i %%nom_zone_eth2 -p tcp -m tcp -m multiport --dports 80,443 --tcp-flags SYN,RST,ACK SYN -d 89.202.39.91/32 -j ACCEPT
|
|
103
|
/sbin/iptables -t nat -I PREROUTING -i %%nom_zone_eth2 -p tcp -m tcp -m multiport --dports 80,443 --tcp-flags SYN,RST,ACK SYN -d 80.231.134.47/32 -j ACCEPT
|
|
104
|
/sbin/iptables -t nat -I PREROUTING -i %%nom_zone_eth2 -p tcp -m tcp -m multiport --dports 80,443 --tcp-flags SYN,RST,ACK SYN -d 72.28.118.203/32 -j ACCEPT
|
|
105
|
|
|
106
|
## Plages horaires pour WIFI LORDI
|
|
107
|
%if %%plage_wifi == 'oui' and %%plage_wifi_debut != '' and %%plage_wifi_fin != '' and %%nom_zone_eth4 != '' and %%vlan_id_eth4[0] != ''
|
|
108
|
/sbin/iptables -I INPUT -i %%nom_zone_eth4.%%vlan_id_eth4[0] -m time --timestop %%plage_wifi_debut --timestart %%plage_wifi_fin --kerneltz -j DROP
|
|
109
|
%end if
|
|
110
|
|
|
111
|
## Regle pour EPLE participant PISA 2018
|
|
112
|
/sbin/iptables -t nat -I PREROUTING -d 54.93.92.194 -j ACCEPT
|
|
113
|
|
|
114
|
############################################
|
|
115
|
## Ajout de regles pour les COLLECTIVITES ##
|
|
116
|
|
|
117
|
## REGION ##
|
|
118
|
%if %%nom_domaine_local.startswith("lyc-") or %%nom_domaine_local.startswith("erea-")
|
|
119
|
## SNAT en IP %%nom_zone_eth2 de la zone pedago etendu si destination zone client leger (inventaire GLPI REGION) pour port 80 et 62354
|
|
120
|
/sbin/iptables -t filter -I ped-ext -s %%adresse_network_eth2/%%adresse_netmask_eth2 -d 172.23.0.0/18 -i %%nom_zone_eth2 -o %%nom_zone_eth0 -p tcp -m tcp --dport 62354 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
121
|
/sbin/iptables -t nat -I POSTROUTING -s %%adresse_network_eth2/%%adresse_netmask_eth2 -d 172.23.0.0/18 -o %%nom_zone_eth0 -p tcp -m tcp --dport 62354 --tcp-flags SYN,RST,ACK SYN -j SNAT --to-source %%adresse_ip_eth2
|
|
122
|
/sbin/iptables -t filter -I ped-ext -s %%adresse_network_eth2/%%adresse_netmask_eth2 -d 172.23.0.0/18 -i %%nom_zone_eth2 -o %%nom_zone_eth0 -p tcp -m tcp --dport 80 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
123
|
/sbin/iptables -t nat -I POSTROUTING -s %%adresse_network_eth2/%%adresse_netmask_eth2 -d 172.23.0.0/18 -o %%nom_zone_eth0 -p tcp -m tcp --dport 80 --tcp-flags SYN,RST,ACK SYN -j SNAT --to-source %%adresse_ip_eth2
|
|
124
|
## acces au serveur peda depuis le reseau Region (comme DANe)
|
|
125
|
/sbin/iptables -t nat -I PREROUTING -s 194.214.141.0/24 -d %%adresse_ip_eth0/32 -i %%nom_zone_eth0 -p tcp -m tcp --dport 44123 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_pedago
|
|
126
|
/sbin/iptables -t filter -I ext-ped -s 194.214.141.0/24 -d %%ip_serveur_pedago/32 -i %%nom_zone_eth0 -p tcp -m state --state NEW -m tcp --dport 44123 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
127
|
%end if
|
|
128
|
|
|
129
|
## CD11 ##
|
|
130
|
%if %%numero_etab.startswith("011") and %%nom_domaine_local.startswith("clg-")
|
|
131
|
## Acces RDP port 44123 sur serveur PEDA
|
|
132
|
/sbin/iptables -t nat -I PREROUTING -d %%adresse_ip_eth1/32 -p tcp -m tcp --dport 44123 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_pedago
|
|
133
|
/sbin/iptables -t filter -I ext-ped -s 192.168.225.0/24 -d %%ip_serveur_pedago/32 -i %%nom_zone_eth0 -p tcp -m state --state NEW -m tcp --dport 44123 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
134
|
/sbin/iptables -t filter -I ext-ped -s 10.11.200.0/24 -d %%ip_serveur_pedago/32 -i %%nom_zone_eth0 -p tcp -m state --state NEW -m tcp --dport 44123 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
135
|
## SNAT pour remontee via tunnel ADMIN des fluc TCP et UDP a destination de AMON-COGITIS
|
|
136
|
/sbin/iptables -t nat -I POSTROUTING -s %%adresse_network_eth2/%%adresse_netmask_eth2 -d 10.11.200.0/24 -j SNAT --to-source %%adresse_ip_eth1
|
|
137
|
/sbin/iptables -t nat -I POSTROUTING -s %%adresse_network_eth3/%%adresse_netmask_eth3 -d 10.11.200.0/24 -j SNAT --to-source %%adresse_ip_eth1
|
|
138
|
## autorisation ports TCP vers COGITIS
|
|
139
|
/sbin/iptables -t filter -I ped-adm -m state --state NEW -p tcp --tcp-flags SYN,RST,ACK SYN -m multiport --dports 80,161,162,443 -d 10.11.200.0/24 -j ACCEPT
|
|
140
|
## autorisation ports UDP vers COGITIS
|
|
141
|
/sbin/iptables -t filter -I ped-adm -p udp -m udp -m multiport --dports 135,161,162,445,514,24158 -d 10.11.200.0/24 -j ACCEPT
|
|
142
|
/sbin/iptables -t filter -I dmz-adm -p udp -m udp -m multiport --dports 135,161,162,445,514,24158 -d 10.11.200.0/24 -j ACCEPT
|
|
143
|
/sbin/iptables -t nat -I PREROUTING -d %%adresse_ip_eth1/32 -p udp -m udp --dport 24158 -j DNAT --to-destination %%ip_serveur_pedago
|
|
144
|
/sbin/iptables -t filter -I ext-ped -s 10.11.200.0/24 -d %%ip_serveur_pedago/32 -i %%nom_zone_eth0 -p udp -m state --state NEW -m udp --dport 24158 -j ACCEPT
|
|
145
|
## Remontee Inventaire (HTTPS) vers reseau COGITIS via tunnel ADMIN
|
|
146
|
## exception au proxy pour remontee vers reseau COGITIS
|
|
147
|
/sbin/iptables -t nat -I PREROUTING -p tcp -m tcp -m multiport --dports 80,443 --tcp-flags SYN,RST,ACK SYN -d 10.11.200.0/24 -j ACCEPT
|
|
148
|
%end if
|
|
149
|
|
|
150
|
## CD30 ##
|
|
151
|
%if %%numero_etab.startswith("030") and %%nom_domaine_local.startswith("clg-")
|
|
152
|
## EDUTICE
|
|
153
|
## les serveurs edutice peuvent sortir pour faire telemaintenance vers l'exterieur
|
|
154
|
/sbin/iptables -t nat -I POSTROUTING -s %%ip_serveur_pedago2/32 -d 91.121.175.129/32 -o %%nom_zone_eth0 -p udp -m udp --dport 1194 -j SNAT --to-source %%adresse_ip_eth0
|
|
155
|
/sbin/iptables -t nat -I POSTROUTING -s %%ip_serveur_antivirus/32 -d 91.121.175.129/32 -o %%nom_zone_eth0 -p udp -m udp --dport 1194 -j SNAT --to-source %%adresse_ip_eth0
|
|
156
|
/sbin/iptables -t filter -I ped-ext -s %%ip_serveur_antivirus/32 -d 91.121.175.129/32 -i %%nom_zone_eth2 -o %%nom_zone_eth0 -p udp -m udp --dport 1194 -j ACCEPT
|
|
157
|
/sbin/iptables -t filter -I ped-ext -s %%ip_serveur_pedago2/32 -d 91.121.175.129/32 -i %%nom_zone_eth2 -o %%nom_zone_eth0 -p udp -m udp --dport 1194 -j ACCEPT
|
|
158
|
## autoriser l'exterieur a faire du 8099 sur ip %%nom_zone_eth0 et renvoyer vers serveur pedago
|
|
159
|
/sbin/iptables -t nat -I PREROUTING -d %%adresse_ip_eth0/32 -i %%nom_zone_eth0 -p tcp -m tcp --dport 8099 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_pedago2:8080
|
|
160
|
/sbin/iptables -t filter -I ext-bas -d %%adresse_ip_eth0/32 -i %%nom_zone_eth0 -p tcp -m state --state NEW -m tcp --dport 8099 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
161
|
## ajout pour les AMON 2.3 pour acces NGINX owncloud
|
|
162
|
/sbin/iptables -t filter -I ext-bas -m state --state NEW -p tcp --dport 443 --tcp-flags SYN,RST,ACK SYN -i %%nom_zone_eth0 -j ACCEPT
|
|
163
|
%end if
|
|
164
|
|
|
165
|
## CD34 ##
|
|
166
|
%if %%numero_etab in ('0340109j','0340955d','0341366a','0342326u')
|
|
167
|
## acces CD34 au MDM tablettes via serveur PEDA
|
|
168
|
/sbin/iptables -t nat -I PREROUTING -s 212.51.190.239/32 -d %%adresse_ip_eth0/32 -i %%nom_zone_eth0 -p tcp -m tcp --dport 44123 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_pedago
|
|
169
|
/sbin/iptables -t filter -I ext-ped -s 212.51.190.239/32 -d %%ip_serveur_pedago/32 -i %%nom_zone_eth0 -p tcp -m state --state NEW -m tcp --dport 44123 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
|
|
170
|
%end if
|
|
171
|
|
|
172
|
|
|
173
|
###########################################
|
|
174
|
## Ajout de regles specifiques pour EPLE ##
|
|
175
|
|
|
176
|
## Specificite 0340042L - Lyc Mermoz MPL - plusieurs sous-reseaux
|
|
177
|
%if %%numero_etab == '0340042l'
|
|
178
|
/sbin/iptables -t nat -A POSTROUTING -s 10.134.0.0/16 -o %%nom_zone_eth0 -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j SNAT --to-source %%adresse_ip_eth0
|
|
179
|
/sbin/iptables -t nat -A POSTROUTING -s 10.134.0.0/16 -o %%nom_zone_eth0 -p udp -m udp -j SNAT --to-source %%adresse_ip_eth0
|
|
180
|
%end if
|
|
181
|
|
|
182
|
## Specificite 0340076Y - Lyc Curie Sete - port 14000 utilise par client PRONOTE
|
|
183
|
%if %%numero_etab == '0340076y'
|
|
184
|
/sbin/iptables -t nat -I PREROUTING -d %%ip_pub2/32 -i %%nom_zone_eth0 -p tcp -m tcp --dport 14000 --tcp-flags SYN,RST,ACK SYN -j DNAT --to-destination %%ip_serveur_web2
|
|
185
|
%end if
|
|
186
|
</include>
|
|
187
|
<services>
|
|
188
|
<service id="11" libelle="service 8500" name="8500" ports="8500" protocol="tcp" tcpwrapper="" />
|
|
189
|
<service id="46" libelle="Acces web aux agents Zéphir" name="agents_zephir" ports="8090" protocol="tcp" tcpwrapper="" />
|
|
190
|
<service id="6" libelle="serveur de noms" name="dns-tcp" ports="53" protocol="tcp" tcpwrapper="" />
|
|
191
|
<service id="7" libelle="serveur de noms" name="dns-udp" ports="53" protocol="udp" tcpwrapper="" />
|
|
192
|
<service id="36" libelle="ead" name="ead" ports="4200" protocol="tcp" tcpwrapper="" />
|
|
193
|
<service id="83" libelle="ead-server" name="ead-server" ports="4201" protocol="tcp" tcpwrapper="" />
|
|
194
|
<service id="84" libelle="ead-fichier" name="ead-fichier" ports="4202" protocol="tcp" tcpwrapper="" />
|
|
195
|
<service id="73" libelle="port EAD du Scribe avec reverse proxy" name="ead-scribe" ports="%%revprox_ead_port" protocol="tcp" tcpwrapper="" />
|
|
196
|
<service id="echo-reply" libelle="règle icmp echo-reply" name="echo-reply" ports="0" protocol="ICMP" tcpwrapper="" />
|
|
197
|
<service id="echo-request" libelle="règle icmp echo-request" name="echo-request" ports="0" protocol="ICMP" tcpwrapper="" />
|
|
198
|
<service id="45" libelle="Service Eole SSO" name="eole-sso" ports="%%eolesso_port" protocol="tcp" tcpwrapper="" />
|
|
199
|
<service id="79" libelle="Redirection du service EoleSSO" name="revprox-sso" ports="8443" protocol="tcp" tcpwrapper="" />
|
|
200
|
<service id="51" libelle="protocole pour ipsec" name="esp" ports="0" protocol="esp" tcpwrapper="" />
|
|
201
|
<service id="78" libelle="transfert de fichiers sur le port 21" name="ftp" ports="21" protocol="tcp" tcpwrapper="" />
|
|
202
|
<service id="26" libelle="transfert de fichiers" name="ftp-tcp" ports="20-21" protocol="tcp" tcpwrapper="" />
|
|
203
|
<service id="29" libelle="service ftps" name="ftps" ports="989-990" protocol="tcp" tcpwrapper="" />
|
|
204
|
<service id="3" libelle="serveur web" name="http" ports="80" protocol="tcp" tcpwrapper="" />
|
|
205
|
<service id="5" libelle="serveur web sécurisé" name="https" ports="443" protocol="tcp" tcpwrapper="" />
|
|
206
|
<service id="21" libelle="service imap" name="imap" ports="143" protocol="tcp" tcpwrapper="" />
|
|
207
|
<service id="23" libelle="service imap4-ssl" name="imap4-ssl" ports="993" protocol="tcp" tcpwrapper="" />
|
|
208
|
<service id="15" libelle="service irc" name="irc" ports="194" protocol="tcp" tcpwrapper="" />
|
|
209
|
<service id="16" libelle="service ircs" name="ircs" ports="994" protocol="tcp" tcpwrapper="" />
|
|
210
|
<service id="13" libelle="service ircu" name="ircu" ports="6665-6669" protocol="tcp" tcpwrapper="" />
|
|
211
|
<service id="53" libelle="protocole pour ipsec" name="isakmp_4500" ports="4500" protocol="udp" tcpwrapper="" />
|
|
212
|
<service id="52" libelle="protocol pour ipsec" name="isakmp_500" ports="500" protocol="udp" tcpwrapper="" />
|
|
213
|
<service id="22" libelle="service d'annuaire" name="ldap" ports="389" protocol="tcp" tcpwrapper="slapd" />
|
|
214
|
<service id="24" libelle="service ldaps" name="ldaps" ports="636" protocol="tcp" tcpwrapper="slapd" />
|
|
215
|
<service id="86" libelle="Connexion management for LTSP" name="ldm" ports="9571" protocol="tcp" tcpwrapper="" />
|
|
216
|
<service id="54" libelle="port d'accès à l'application lightsquid" name="lightsquid" ports="%%lightsquid_port" protocol="tcp" tcpwrapper="" />
|
|
217
|
<service id="72" libelle="ltspfsd" name="ltspfsd" ports="9220" protocol="tcp" tcpwrapper="" />
|
|
218
|
<service id="15" libelle="service mdqs" name="mdqs" ports="666" protocol="tcp" tcpwrapper="" />
|
|
219
|
<service id="17" libelle="service msnp" name="msnp" ports="1863" protocol="tcp" tcpwrapper="" />
|
|
220
|
<service id="71" libelle="nbd-client" name="nbd-client" ports="2000" protocol="tcp" tcpwrapper="" />
|
|
221
|
<service id="85" libelle="Server NBD for Eclair" name="nbd-server" ports="10809" protocol="tcp" tcpwrapper="" />
|
|
222
|
<service id="32" libelle="nouvelles" name="news" ports="2009" protocol="tcp" tcpwrapper="" />
|
|
223
|
<service id="30" libelle="service nntp" name="nntp" ports="119" protocol="tcp" tcpwrapper="" />
|
|
224
|
<service id="31" libelle="service nntps" name="nntps" ports="563" protocol="tcp" tcpwrapper="" />
|
|
225
|
<service id="43" libelle="Serveur d'authentification NuFw" name="nuauth" ports="4129" protocol="tcp" tcpwrapper="" />
|
|
226
|
<service id="28" libelle="service pftp" name="pftp" ports="662" protocol="tcp" tcpwrapper="" />
|
|
227
|
<service id="20" libelle="service pop" name="pop" ports="110" protocol="tcp" tcpwrapper="" />
|
|
228
|
<service id="25" libelle="service pop3s" name="pop3s" ports="995" protocol="tcp" tcpwrapper="" />
|
|
229
|
<service id="60" libelle="" name="portmap" ports="111" protocol="tcp" tcpwrapper="" />
|
|
230
|
<service id="61" libelle="" name="lockd" ports="4005" protocol="tcp" tcpwrapper="" />
|
|
231
|
<service id="62" libelle="" name="mountd" ports="4003" protocol="tcp" tcpwrapper="" />
|
|
232
|
<service id="48" libelle="administration posh" name="posh-admin" ports="7070" protocol="tcp" tcpwrapper="" />
|
|
233
|
<service id="4" libelle="service proxy" name="proxy" ports="3128" protocol="tcp" tcpwrapper="" />
|
|
234
|
<service id="12" libelle="proxy" name="proxy-8080" ports="8080" protocol="tcp" tcpwrapper="" />
|
|
235
|
<service id="70" libelle="pulseaudio" name="pulseaudio" ports="16001" protocol="tcp" tcpwrapper="" />
|
|
236
|
<service id="64" libelle="protocole RELP pour rsyslog" name="rsyslog_RELP" ports="20514" protocol="tcp" tcpwrapper="" />
|
|
237
|
<service id="65" libelle="protocole TCP pour rsyslog" name="rsyslog_TCP" ports="10514" protocol="tcp" tcpwrapper="" />
|
|
238
|
<service id="66" libelle="protocole UDP pour rsyslog" name="rsyslog_UDP" ports="514" protocol="udp" tcpwrapper="" />
|
|
239
|
<service id="38" libelle="samba tcp" name="samba-tcp" ports="137-139" protocol="tcp" tcpwrapper="" />
|
|
240
|
<service id="37" libelle="samba" name="samba-udp" ports="137-139" protocol="udp" tcpwrapper="" />
|
|
241
|
<service id="39" libelle="samba3" name="samba3" ports="445" protocol="tcp" tcpwrapper="" />
|
|
242
|
<service id="45" libelle="" name="scribe-controlevnc" ports="8789-8790" protocol="tcp" tcpwrapper="" />
|
|
243
|
<service id="36" libelle="service scribe sur les clients" name="scribe-service" ports="8788" protocol="tcp" tcpwrapper="" />
|
|
244
|
<service id="40" libelle="vnc 5800" name="scribe_vnc1" ports="5800" protocol="tcp" tcpwrapper="" />
|
|
245
|
<service id="41" libelle="vnc 5900" name="scribe_vnc2" ports="5900" protocol="tcp" tcpwrapper="" />
|
|
246
|
<service id="59" libelle="Serveur NFS" name="serveur_nfs" ports="2049" protocol="tcp" tcpwrapper="" />
|
|
247
|
<service id="27" libelle="service sftp" name="sftp" ports="115" protocol="tcp" tcpwrapper="" />
|
|
248
|
<service id="19" libelle="service mail" name="smtp" ports="25" protocol="tcp" tcpwrapper="" />
|
|
249
|
<service id="77" libelle="Service SMTP SSL" name="smtps" ports="465" protocol="tcp" tcpwrapper="" />
|
|
250
|
<service id="8" libelle="shell sécurisé" name="ssh" ports="22" protocol="tcp" tcpwrapper="sshd" />
|
|
251
|
<service id="58" libelle="serveur sympa internet" name="sympa-internet" ports="8787" protocol="tcp" tcpwrapper="" />
|
|
252
|
<service id="57" libelle="sympa domaine restreint" name="sympa-restreint" ports="8888" protocol="tcp" tcpwrapper="" />
|
|
253
|
<service id="18" libelle="service talk" name="talk" ports="517-518" protocol="tcp" tcpwrapper="" />
|
|
254
|
<service id="33" libelle="tous les ports en tcp" name="tcp" ports="0-65535" protocol="tcp" tcpwrapper="" />
|
|
255
|
<service id="tout" libelle="tous les services" name="tous" ports="0" protocol="TOUT" tcpwrapper="" />
|
|
256
|
<service id="34" libelle="tous les ports en udp" name="udp" ports="0-65535" protocol="udp" tcpwrapper="" />
|
|
257
|
<service id="9" libelle="appliquation web d'administration" name="webmin" ports="10000" protocol="tcp" tcpwrapper="" />
|
|
258
|
<service id="55" libelle="port 2eme instance de squid" name="proxy2" ports="%%proxy2_port" protocol="tcp" tcpwrapper="" />
|
|
259
|
<service id="56" libelle="serveur de temps" name="ntp" ports="123" protocol="udp" tcpwrapper="" />
|
|
260
|
<service id="63" libelle="Serveur jabber (XMPP)" name="xmpp" ports="5222" protocol="tcp" tcpwrapper="" />
|
|
261
|
<service id="81" libelle="Serveur jabber SSL (XMPP)" name="xmpp-ssl" ports="5223" protocol="tcp" tcpwrapper="" />
|
|
262
|
<service id="67" libelle="Proxy Cntlm" name="cntlm" ports="%%cntlm_port" protocol="tcp" tcpwrapper="" />
|
|
263
|
<service id="68" libelle="Accès à gen_config depuis l'extérieur en https" name="gen_config" ports="7000" protocol="tcp" tcpwrapper="" />
|
|
264
|
<service id="70" libelle="" name="radius" ports="1812" protocol="udp" tcpwrapper="" />
|
|
265
|
<service id="74" libelle="" name="radius-acct" ports="1813" protocol="udp" tcpwrapper="" />
|
|
266
|
<service id="75" libelle="Accès aux serveurs TFTP" name="tftpd-hpa" ports="69" protocol="udp" tcpwrapper="in.tftpd" />
|
|
267
|
<service id="76" libelle="Interface CUPS" name="cups" ports="631" protocol="tcp" tcpwrapper="" />
|
|
268
|
<service id="82" libelle="Service d'impression Raw" name="raw" ports="9100" protocol="tcp" tcpwrapper="" />
|
|
269
|
<service id="80" libelle="Accès à l'outil Gaspacho" name="gaspacho" ports="8080" protocol="tcp" tcpwrapper="" />
|
|
270
|
<groupe id="admin_amon" libelle="Port autorise pour l'administration distante d'Amon (ssh, ead, agents zephir)">
|
|
271
|
<service id="46" libelle="Acces web aux agents Zéphir" name="agents_zephir" ports="8090" protocol="tcp" tcpwrapper="" />
|
|
272
|
<service id="36" libelle="ead" name="ead" ports="4200" protocol="tcp" tcpwrapper="" />
|
|
273
|
<service id="54" libelle="port d'accès à l'application lightsquid" name="lightsquid" ports="%%lightsquid_port" protocol="tcp" tcpwrapper="" />
|
|
274
|
<service id="echo-request" libelle="règle icmp echo-request" name="echo-request" ports="0" protocol="ICMP" tcpwrapper="" />
|
|
275
|
</groupe>
|
|
276
|
<groupe id="ead_server" libelle="Ports autorises pour l'administration distante d'Amon (backend ead)">
|
|
277
|
<service id="83" libelle="ead-server" name="ead-server" ports="4201" protocol="tcp" tcpwrapper="" />
|
|
278
|
<service id="84" libelle="ead-fichier" name="ead-fichier" ports="4202" protocol="tcp" tcpwrapper="" />
|
|
279
|
</groupe>
|
|
280
|
<groupe id="dns" libelle="dns tcp et udp">
|
|
281
|
<service id="7" libelle="serveur de noms" name="dns-udp" ports="53" protocol="udp" tcpwrapper="" />
|
|
282
|
<service id="6" libelle="serveur de noms" name="dns-tcp" ports="53" protocol="tcp" tcpwrapper="" />
|
|
283
|
</groupe>
|
|
284
|
<groupe id="eclair-dmz" libelle="Eclair en DMZ">
|
|
285
|
<service id="72" libelle="ltspfsd" name="ltspfsd" ports="9220" protocol="tcp" tcpwrapper="" />
|
|
286
|
<service id="71" libelle="nbd-client" name="nbd-client" ports="2000" protocol="tcp" tcpwrapper="" />
|
|
287
|
<service id="70" libelle="pulseaudio" name="pulseaudio" ports="16001" protocol="tcp" tcpwrapper="" />
|
|
288
|
<service id="41" libelle="vnc 5900" name="scribe_vnc2" ports="5900" protocol="tcp" tcpwrapper="" />
|
|
289
|
</groupe>
|
|
290
|
<groupe id="gr_forum" libelle="interdire l'utilisation des forums">
|
|
291
|
<service id="30" libelle="service nntp" name="nntp" ports="119" protocol="tcp" tcpwrapper="" />
|
|
292
|
<service id="31" libelle="service nntps" name="nntps" ports="563" protocol="tcp" tcpwrapper="" />
|
|
293
|
<service id="32" libelle="nouvelles" name="news" ports="2009" protocol="tcp" tcpwrapper="" />
|
|
294
|
</groupe>
|
|
295
|
<groupe id="gr_ftp" libelle="">
|
|
296
|
<service id="26" libelle="transfert de fichiers" name="ftp-tcp" ports="20-21" protocol="tcp" tcpwrapper="" />
|
|
297
|
<service id="29" libelle="service ftps" name="ftps" ports="989-990" protocol="tcp" tcpwrapper="" />
|
|
298
|
<service id="28" libelle="service pftp" name="pftp" ports="662" protocol="tcp" tcpwrapper="" />
|
|
299
|
<service id="27" libelle="service sftp" name="sftp" ports="115" protocol="tcp" tcpwrapper="" />
|
|
300
|
</groupe>
|
|
301
|
<groupe id="gr_irc" libelle="interdire l'utilisation des dialogues en direct (icq)">
|
|
302
|
<service id="18" libelle="service talk" name="talk" ports="517-518" protocol="tcp" tcpwrapper="" />
|
|
303
|
<service id="17" libelle="service msnp" name="msnp" ports="1863" protocol="tcp" tcpwrapper="" />
|
|
304
|
<service id="15" libelle="service mdqs" name="mdqs" ports="666" protocol="tcp" tcpwrapper="" />
|
|
305
|
<service id="16" libelle="service ircs" name="ircs" ports="994" protocol="tcp" tcpwrapper="" />
|
|
306
|
<service id="15" libelle="service irc" name="irc" ports="194" protocol="tcp" tcpwrapper="" />
|
|
307
|
<service id="13" libelle="service ircu" name="ircu" ports="6665-6669" protocol="tcp" tcpwrapper="" />
|
|
308
|
</groupe>
|
|
309
|
<groupe id="gr_messagerie" libelle="interdire l'utilisation des dialogues en direct (icq)">
|
|
310
|
<service id="21" libelle="service imap" name="imap" ports="143" protocol="tcp" tcpwrapper="" />
|
|
311
|
<service id="23" libelle="service imap4-ssl" name="imap4-ssl" ports="993" protocol="tcp" tcpwrapper="" />
|
|
312
|
<service id="22" libelle="service d'annuaire" name="ldap" ports="389" protocol="tcp" tcpwrapper="slapd" />
|
|
313
|
<service id="24" libelle="service ldaps" name="ldaps" ports="636" protocol="tcp" tcpwrapper="slapd" />
|
|
314
|
<service id="20" libelle="service pop" name="pop" ports="110" protocol="tcp" tcpwrapper="" />
|
|
315
|
<service id="25" libelle="service pop3s" name="pop3s" ports="995" protocol="tcp" tcpwrapper="" />
|
|
316
|
<service id="19" libelle="service mail" name="smtp" ports="25" protocol="tcp" tcpwrapper="" />
|
|
317
|
<service id="77" libelle="Service SMTP SSL" name="smtps" ports="465" protocol="tcp" tcpwrapper="" />
|
|
318
|
</groupe>
|
|
319
|
<groupe id="gr_smtp" libelle="smtp et smtps">
|
|
320
|
<service id="19" libelle="service mail" name="smtp" ports="25" protocol="tcp" tcpwrapper="" />
|
|
321
|
<service id="77" libelle="Service SMTP SSL" name="smtps" ports="465" protocol="tcp" tcpwrapper="" />
|
|
322
|
</groupe>
|
|
323
|
<groupe id="gr_pop" libelle="pop3 et pop3s">
|
|
324
|
<service id="20" libelle="service pop" name="pop" ports="110" protocol="tcp" tcpwrapper="" />
|
|
325
|
<service id="25" libelle="service pop3s" name="pop3s" ports="995" protocol="tcp" tcpwrapper="" />
|
|
326
|
</groupe>
|
|
327
|
<groupe id="gr_imap" libelle="imap et imap-ssl">
|
|
328
|
<service id="21" libelle="service imap" name="imap" ports="143" protocol="tcp" tcpwrapper="" />
|
|
329
|
<service id="23" libelle="service imap4-ssl" name="imap4-ssl" ports="993" protocol="tcp" tcpwrapper="" />
|
|
330
|
</groupe>
|
|
331
|
<groupe id="gr_redirection" libelle="Protocoles a rediriger vers le proxy">
|
|
332
|
<service id="3" libelle="serveur web" name="http" ports="80" protocol="tcp" tcpwrapper="" />
|
|
333
|
<service id="4" libelle="service proxy" name="proxy" ports="3128" protocol="tcp" tcpwrapper="" />
|
|
334
|
<service id="12" libelle="proxy" name="proxy-8080" ports="8080" protocol="tcp" tcpwrapper="" />
|
|
335
|
<service id="5" libelle="serveur web sécurisé" name="https" ports="443" protocol="tcp" tcpwrapper="" />
|
|
336
|
</groupe>
|
|
337
|
<groupe id="gr_redirection_proxy" libelle="Protocoles proxy a rediriger vers le proxy">
|
|
338
|
<service id="4" libelle="service proxy" name="proxy" ports="3128" protocol="tcp" tcpwrapper="" />
|
|
339
|
<service id="12" libelle="proxy" name="proxy-8080" ports="8080" protocol="tcp" tcpwrapper="" />
|
|
340
|
</groupe>
|
|
341
|
<groupe id="gr_redirection_http" libelle="Protocoles http a rediriger vers le proxy">
|
|
342
|
<service id="3" libelle="serveur web" name="http" ports="80" protocol="tcp" tcpwrapper="" />
|
|
343
|
<service id="4" libelle="service proxy" name="proxy" ports="3128" protocol="tcp" tcpwrapper="" />
|
|
344
|
<service id="12" libelle="proxy" name="proxy-8080" ports="8080" protocol="tcp" tcpwrapper="" />
|
|
345
|
</groupe>
|
|
346
|
<groupe id="gr_redirection_https" libelle="Https a redifiger vers le proxy">
|
|
347
|
<service id="5" libelle="serveur web sécurisé" name="https" ports="443" protocol="tcp" tcpwrapper="" />
|
|
348
|
</groupe>
|
|
349
|
<groupe id="gr_restreint" libelle="on ferme tout sauf l'utilisation du web par le proxy">
|
|
350
|
<service id="33" libelle="tous les ports en tcp" name="tcp" ports="0-65535" protocol="tcp" tcpwrapper="" />
|
|
351
|
<service id="34" libelle="tous les ports en udp" name="udp" ports="0-65535" protocol="udp" tcpwrapper="" />
|
|
352
|
</groupe>
|
|
353
|
<groupe id="ipsec" libelle="Services utilises pas ipsec">
|
|
354
|
<service id="51" libelle="protocole pour ipsec" name="esp" ports="0" protocol="esp" tcpwrapper="" />
|
|
355
|
<service id="53" libelle="protocole pour ipsec" name="isakmp_4500" ports="4500" protocol="udp" tcpwrapper="" />
|
|
356
|
<service id="52" libelle="protocol pour ipsec" name="isakmp_500" ports="500" protocol="udp" tcpwrapper="" />
|
|
357
|
</groupe>
|
|
358
|
<groupe id="nfs" libelle="Serveur NFS + portmap">
|
|
359
|
<service id="60" libelle="" name="portmap" ports="111" protocol="tcp" tcpwrapper="" />
|
|
360
|
<service id="61" libelle="" name="lockd" ports="4005" protocol="tcp" tcpwrapper="" />
|
|
361
|
<service id="62" libelle="" name="mountd" ports="4003" protocol="tcp" tcpwrapper="" />
|
|
362
|
<service id="59" libelle="Serveur NFS" name="serveur_nfs" ports="2049" protocol="tcp" tcpwrapper="" />
|
|
363
|
</groupe>
|
|
364
|
<groupe id="samba" libelle="samba proto">
|
|
365
|
<service id="37" libelle="samba" name="samba-udp" ports="137-139" protocol="udp" tcpwrapper="" />
|
|
366
|
<service id="38" libelle="samba tcp" name="samba-tcp" ports="137-139" protocol="tcp" tcpwrapper="" />
|
|
367
|
<service id="39" libelle="samba3" name="samba3" ports="445" protocol="tcp" tcpwrapper="" />
|
|
368
|
</groupe>
|
|
369
|
<groupe id="scribe-dmz-pedago" libelle="service Scribe DMZ vers pedago">
|
|
370
|
<service id="38" libelle="samba tcp" name="samba-tcp" ports="137-139" protocol="tcp" tcpwrapper="" />
|
|
371
|
<service id="37" libelle="samba" name="samba-udp" ports="137-139" protocol="udp" tcpwrapper="" />
|
|
372
|
<service id="39" libelle="samba3" name="samba3" ports="445" protocol="tcp" tcpwrapper="" />
|
|
373
|
<service id="36" libelle="service scribe sur les clients" name="scribe-service" ports="8788" protocol="tcp" tcpwrapper="" />
|
|
374
|
<service id="40" libelle="vnc 5800" name="scribe_vnc1" ports="5800" protocol="tcp" tcpwrapper="" />
|
|
375
|
<service id="41" libelle="vnc 5900" name="scribe_vnc2" ports="5900" protocol="tcp" tcpwrapper="" />
|
|
376
|
<service id="76" libelle="Interface CUPS" name="cups" ports="631" protocol="tcp" tcpwrapper="" />
|
|
377
|
<service id="82" libelle="Service d'impression Raw" name="raw" ports="9100" protocol="tcp" tcpwrapper="" />
|
|
378
|
</groupe>
|
|
379
|
<groupe id="scribe-pedago-dmz" libelle="client scribe vers la DMZ">
|
|
380
|
<service id="22" libelle="service d'annuaire" name="ldap" ports="389" protocol="tcp" tcpwrapper="slapd" />
|
|
381
|
<service id="24" libelle="service ldaps" name="ldaps" ports="636" protocol="tcp" tcpwrapper="slapd" />
|
|
382
|
<service id="38" libelle="samba tcp" name="samba-tcp" ports="137-139" protocol="tcp" tcpwrapper="" />
|
|
383
|
<service id="37" libelle="samba" name="samba-udp" ports="137-139" protocol="udp" tcpwrapper="" />
|
|
384
|
<service id="39" libelle="samba3" name="samba3" ports="445" protocol="tcp" tcpwrapper="" />
|
|
385
|
<service id="45" libelle="" name="scribe-controlevnc" ports="8789-8790" protocol="tcp" tcpwrapper="" />
|
|
386
|
<service id="40" libelle="vnc 5800" name="scribe_vnc1" ports="5800" protocol="tcp" tcpwrapper="" />
|
|
387
|
<service id="41" libelle="vnc 5900" name="scribe_vnc2" ports="5900" protocol="tcp" tcpwrapper="" />
|
|
388
|
</groupe>
|
|
389
|
<groupe id="scribe-posh" libelle="Ouverture des ports pour l'utilisation de nginx pour Posh">
|
|
390
|
<service id="3" libelle="serveur web" name="http" ports="80" protocol="tcp" tcpwrapper="" />
|
|
391
|
<service id="5" libelle="serveur web sécurisé" name="https" ports="443" protocol="tcp" tcpwrapper="" />
|
|
392
|
<service id="48" libelle="administration posh" name="posh-admin" ports="7070" protocol="tcp" tcpwrapper="" />
|
|
393
|
</groupe>
|
|
394
|
<groupe id="scribe_ext" libelle="services extranet scribe ">
|
|
395
|
<service id="26" libelle="transfert de fichiers" name="ftp-tcp" ports="20-21" protocol="tcp" tcpwrapper="" />
|
|
396
|
<service id="5" libelle="serveur web sécurisé" name="https" ports="443" protocol="tcp" tcpwrapper="" />
|
|
397
|
</groupe>
|
|
398
|
<groupe id="sympa" libelle="serveur sympa">
|
|
399
|
<service id="58" libelle="serveur sympa internet" name="sympa-internet" ports="8787" protocol="tcp" tcpwrapper="" />
|
|
400
|
<service id="57" libelle="sympa domaine restreint" name="sympa-restreint" ports="8888" protocol="tcp" tcpwrapper="" />
|
|
401
|
</groupe>
|
|
402
|
<groupe id="vnc" libelle="vnc">
|
|
403
|
<service id="40" libelle="vnc 5800" name="scribe_vnc1" ports="5800" protocol="tcp" tcpwrapper="" />
|
|
404
|
<service id="41" libelle="vnc 5900" name="scribe_vnc2" ports="5900" protocol="tcp" tcpwrapper="" />
|
|
405
|
</groupe>
|
|
406
|
<groupe id="gr_radius" libelle="Serveur radius (UDP)">
|
|
407
|
<service id="70" libelle="" name="radius" ports="1812" protocol="udp" tcpwrapper="" />
|
|
408
|
<service id="74" libelle="" name="radius-acct" ports="1813" protocol="udp" tcpwrapper="" />
|
|
409
|
</groupe>
|
|
410
|
<groupe id="amonecole-eclair" libelle="LTSP services">
|
|
411
|
<service id="86" libelle="Connexion management for LTSP" name="ldm" ports="9571" protocol="tcp" tcpwrapper="" />
|
|
412
|
<service id="85" libelle="Server NBD for Eclair" name="nbd-server" ports="10809" protocol="tcp" tcpwrapper="" />
|
|
413
|
<service id="8" libelle="shell sécurisé" name="ssh" ports="22" protocol="tcp" tcpwrapper="sshd" />
|
|
414
|
</groupe>
|
|
415
|
<groupe id="amonecole-eclair-partage" libelle="Services in partage container for Eclair">
|
|
416
|
<service id="75" libelle="Accès aux serveurs TFTP" name="tftpd-hpa" ports="69" protocol="udp" tcpwrapper="in.tftpd" />
|
|
417
|
</groupe>
|
|
418
|
</services><extremites>
|
|
419
|
<extremite container="" interface="" libelle="Zone entière" name="exterieur" netmask="%%adresse_netmask_eth0" subnet="1" type="" zone="exterieur">
|
|
420
|
<ip address="%%adresse_ip_eth0" />
|
|
421
|
</extremite>
|
|
422
|
<extremite container="" interface="" libelle="zone restreinte" name="exterieur_restreint" netmask="%%adresse_netmask_eth0" subnet="1" type="" zone="exterieur">
|
|
423
|
<ip address="%%adresse_network_eth0" />
|
|
424
|
</extremite>
|
|
425
|
<extremite container="" interface="" libelle="reseau autorise a se connecter a ssh" name="exterieur_ssh" netmask="%%netmask_ssh_eth0" subnet="1" type="" zone="exterieur">
|
|
426
|
<ip address="%%ip_ssh_eth0" />
|
|
427
|
</extremite>
|
|
428
|
<extremite container="" interface="" libelle="Zone entière" name="bastion" netmask="255.255.255.255" subnet="1" type="" zone="bastion">
|
|
429
|
<ip address="127.0.0.1" />
|
|
430
|
</extremite>
|
|
431
|
<extremite container="" interface="eth0" libelle="Bastion sur la zone exterieur" name="bastion_exterieur" netmask="255.255.255.255" subnet="0" type="normal" zone="bastion">
|
|
432
|
<ip address="%%adresse_ip_eth0" />
|
|
433
|
</extremite>
|
|
434
|
<extremite container="" interface="" libelle="reseau autorise a administrer depuis l'exterieur" name="exterieur_admin" netmask="%%netmask_admin_eth0" subnet="1" type="" zone="exterieur">
|
|
435
|
<ip address="%%ip_admin_eth0" />
|
|
436
|
</extremite>
|
|
437
|
<extremite container="" interface="" libelle="reseau autorise a acceder au backend EAD depuis l'exterieur" name="exterieur_backend_ead" netmask="%%netmask_frontend_ead_distant_eth0" subnet="1" type="" zone="exterieur">
|
|
438
|
<ip address="%%ip_frontend_ead_distant_eth0" />
|
|
439
|
</extremite>
|
|
440
|
<extremite container="" interface="" libelle="IP de bastion sur la zone exterieur" name="exterieur_bastion" netmask="255.255.255.255" subnet="0" type="" zone="exterieur">
|
|
441
|
<ip address="%%adresse_ip_eth0" />
|
|
442
|
</extremite>
|
|
443
|
<extremite container="internet" interface="containers" libelle="conteneur internet" name="internet" netmask="255.255.255.255" subnet="0" type="conteneur" zone="bastion">
|
|
444
|
<ip address="%%container_ip_internet" />
|
|
445
|
</extremite>
|
|
446
|
<extremite container="" interface="" libelle="adresse du bastion sur le reseau admin" name="admin_bastion" netmask="255.255.255.255" subnet="0" type="" zone="exterieur">
|
|
447
|
<ip address="%%adresse_ip_eth1" />
|
|
448
|
</extremite>
|
|
449
|
<extremite container="" interface="" libelle="zone restreinte" name="admin_restreint" netmask="%%adresse_netmask_eth1" subnet="1" type="" zone="admin">
|
|
450
|
<ip address="%%adresse_network_eth1" />
|
|
451
|
</extremite>
|
|
452
|
<extremite container="" interface="" libelle="reseau autorise a se connecter a ssh depuis le reseau administratif" name="admin_ssh" netmask="%%netmask_ssh_eth1" subnet="1" type="" zone="admin">
|
|
453
|
<ip address="%%ip_ssh_eth1" />
|
|
454
|
</extremite>
|
|
455
|
<extremite container="" interface="" libelle="Zone entière" name="admin" netmask="%%adresse_netmask_eth1" subnet="1" type="" zone="admin">
|
|
456
|
<ip address="%%adresse_ip_eth1" />
|
|
457
|
</extremite>
|
|
458
|
<extremite container="" interface="" libelle="reseau autorise a administrer depuis le reseau administratif" name="admin_admin" netmask="%%netmask_admin_eth1" subnet="1" type="" zone="admin">
|
|
459
|
<ip address="%%ip_admin_eth1" />
|
|
460
|
</extremite>
|
|
461
|
<extremite container="" interface="" libelle="reseau autorise a acceder au backend EAD depuis le reseau administratif" name="admin_backend_ead" netmask="%%netmask_frontend_ead_distant_eth1" subnet="1" type="" zone="admin">
|
|
462
|
<ip address="%%ip_frontend_ead_distant_eth1" />
|
|
463
|
</extremite>
|
|
464
|
<extremite container="internet" interface="eth1" libelle="eth1 dans le conteneur internet" name="internet_eth1" netmask="255.255.255.255" subnet="0" type="conteneur" zone="bastion">
|
|
465
|
<ip address="%%adresse_ip_eth1_proxy_link" />
|
|
466
|
</extremite>
|
|
467
|
<extremite container="" interface="" libelle="reseau autorise a se connecter a ssh depuis le reseau pedagogique" name="pedago_ssh" netmask="%%netmask_ssh_eth2" subnet="1" type="" zone="pedago">
|
|
468
|
<ip address="%%ip_ssh_eth2" />
|
|
469
|
</extremite>
|
|
470
|
<extremite container="" interface="" libelle="" name="pedago_bastion" netmask="255.255.255.255" subnet="0" type="" zone="exterieur">
|
|
471
|
<ip address="%%adresse_ip_eth2" />
|
|
472
|
</extremite>
|
|
473
|
<extremite container="" interface="" libelle="zone restreinte" name="pedago_restreint" netmask="%%adresse_netmask_eth2" subnet="1" type="" zone="pedago">
|
|
474
|
<ip address="%%adresse_network_eth2" />
|
|
475
|
</extremite>
|
|
476
|
<extremite container="" interface="" libelle="Zone entière" name="pedago" netmask="%%adresse_netmask_eth2" subnet="1" type="" zone="pedago">
|
|
477
|
<ip address="%%adresse_ip_eth2" />
|
|
478
|
</extremite>
|
|
479
|
<extremite container="" interface="" libelle="reseau autorise a administrer depuis le reseau pedagogique" name="pedago_admin" netmask="%%netmask_admin_eth2" subnet="1" type="" zone="pedago">
|
|
480
|
<ip address="%%ip_admin_eth2" />
|
|
481
|
</extremite>
|
|
482
|
<extremite container="" interface="" libelle="reseau autorise a acceder au backend EAD depuis le reseau pedagogique" name="pedago_backend_ead" netmask="%%netmask_frontend_ead_distant_eth2" subnet="1" type="" zone="pedago">
|
|
483
|
<ip address="%%ip_frontend_ead_distant_eth2" />
|
|
484
|
</extremite>
|
|
485
|
<extremite container="internet" interface="eth2" libelle="eth2 dans le conteneur internet" name="internet_eth2" netmask="255.255.255.255" subnet="0" type="conteneur" zone="bastion">
|
|
486
|
<ip address="%%adresse_ip_eth2_proxy_link" />
|
|
487
|
</extremite>
|
|
488
|
<extremite container="" interface="" libelle="clients de l'agrégateur de logs en udp" name="clients_udp_rsyslog" netmask="%%netmask_client_logs_udp" subnet="0" type="" zone="exterieur">
|
|
489
|
<ip address="%%adresses_ip_clients_logs_udp" />
|
|
490
|
</extremite>
|
|
491
|
<extremite container="" interface="" libelle="clients de l'agrégateur de logs en tcp" name="clients_tcp_rsyslog" netmask="%%netmask_client_logs_tcp" subnet="0" type="" zone="exterieur">
|
|
492
|
<ip address="%%adresses_ip_clients_logs_tcp" />
|
|
493
|
</extremite>
|
|
494
|
<extremite container="" interface="" libelle="clients de l'agrégateur de logs en relp" name="clients_relp_rsyslog" netmask="%%netmask_client_logs_relp" subnet="0" type="" zone="exterieur">
|
|
495
|
<ip address="%%adresses_ip_clients_logs_relp" />
|
|
496
|
</extremite>
|
|
497
|
<extremite container="" interface="" libelle="serveur scribe sur DMZ" name="serveur_scribe_dmz" netmask="255.255.255.255" subnet="0" type="" zone="dmz">
|
|
498
|
<ip address="%%ip_serveur_scribe_dmz" />
|
|
499
|
</extremite>
|
|
500
|
<extremite container="" interface="" libelle="Zone entière" name="dmz" netmask="%%adresse_netmask_eth3" subnet="1" type="" zone="dmz">
|
|
501
|
<ip address="%%adresse_ip_eth3" />
|
|
502
|
</extremite>
|
|
503
|
<extremite container="" interface="" libelle="zone restreinte" name="dmz_restreint" netmask="%%adresse_netmask_eth3" subnet="1" type="" zone="dmz">
|
|
504
|
<ip address="%%adresse_network_eth3" />
|
|
505
|
</extremite>
|
|
506
|
<extremite container="" interface="" libelle="reseau autorise a se connecter a ssh depuis la dmz" name="dmz_ssh" netmask="%%netmask_ssh_eth3" subnet="1" type="" zone="dmz">
|
|
507
|
<ip address="%%ip_ssh_eth3" />
|
|
508
|
</extremite>
|
|
509
|
<extremite container="" interface="" libelle="reseau autorise a administrer depuis la dmz" name="dmz_admin" netmask="%%netmask_admin_eth3" subnet="1" type="" zone="dmz">
|
|
510
|
<ip address="%%ip_admin_eth3" />
|
|
511
|
</extremite>
|
|
512
|
<extremite container="" interface="" libelle="reseau autorise a acceder au backend EAD depuis la dmz" name="dmz_backend_ead" netmask="%%netmask_frontend_ead_distant_eth3" subnet="1" type="" zone="dmz">
|
|
513
|
<ip address="%%ip_frontend_ead_distant_eth3" />
|
|
514
|
</extremite>
|
|
515
|
</extremites><ranges>
|
|
516
|
</ranges><user_groups>
|
|
517
|
</user_groups><applications>
|
|
518
|
</applications><qosclasses download="" upload="">
|
|
519
|
</qosclasses><flux-list>
|
|
520
|
<flux zoneA="bastion" zoneB="exterieur">
|
|
521
|
<montantes default_policy="0">
|
|
522
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="ouverture de posh a travers de nginx" priority="1" serv_inv="0" service="scribe-posh" src_inv="0" tag="ActiverNGINX">
|
|
523
|
<source name="exterieur" />
|
|
524
|
<destination name="bastion" />
|
|
525
|
</directive>
|
|
526
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="ouverture de l'EAD Scribe a travers de nginx" priority="2" serv_inv="0" service="ead-scribe" src_inv="0" tag="ead_scribe">
|
|
527
|
<source name="exterieur" />
|
|
528
|
<destination name="bastion" />
|
|
529
|
</directive>
|
|
530
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="ssh exterieur vers Amon" priority="3" serv_inv="0" service="ssh" src_inv="0" tag="SSHDepuisEth0">
|
|
531
|
<source name="exterieur_ssh" />
|
|
532
|
<destination name="bastion" />
|
|
533
|
</directive>
|
|
534
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="administration exterieure vers Amon" priority="4" serv_inv="0" service="admin_amon" src_inv="0" tag="AdminDepuisEth0">
|
|
535
|
<source name="exterieur_admin" />
|
|
536
|
<destination name="bastion" />
|
|
537
|
</directive>
|
|
538
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="Acces backend EAD exterieure vers Amon" priority="5" serv_inv="0" service="ead_server" src_inv="0" tag="BackendEADDepuisEth0">
|
|
539
|
<source name="exterieur_backend_ead" />
|
|
540
|
<destination name="bastion" />
|
|
541
|
</directive>
|
|
542
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="administration exterieure vers Amon" priority="6" serv_inv="0" service="lightsquid" src_inv="0" tag="lightsquid0">
|
|
543
|
<source name="exterieur_admin" />
|
|
544
|
<destination name="bastion" />
|
|
545
|
</directive>
|
|
546
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="pas de description" priority="7" serv_inv="0" service="eole-sso" src_inv="0" tag="eole_sso">
|
|
547
|
<source name="exterieur" />
|
|
548
|
<destination name="bastion" />
|
|
549
|
</directive>
|
|
550
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="redirection du service EoleSSO par le proxy inverse" priority="8" serv_inv="0" service="revprox-sso" src_inv="0" tag="revprox_sso">
|
|
551
|
<source name="exterieur" />
|
|
552
|
<destination name="bastion" />
|
|
553
|
</directive>
|
|
554
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="Autoriser ipsec" priority="9" serv_inv="0" service="ipsec" src_inv="0">
|
|
555
|
<source name="exterieur" />
|
|
556
|
<destination name="bastion" />
|
|
557
|
</directive>
|
|
558
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="gen_config exterieur vers Amon" priority="10" serv_inv="0" service="gen_config" src_inv="0" tag="SSHDepuisEth0">
|
|
559
|
<source name="exterieur_ssh" />
|
|
560
|
<destination name="bastion" />
|
|
561
|
</directive>
|
|
562
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="pas de description" priority="11" serv_inv="0" service="rsyslog_RELP" src_inv="0" tag="ClientRsyslogRELP">
|
|
563
|
<source name="clients_relp_rsyslog" />
|
|
564
|
<destination name="bastion" />
|
|
565
|
</directive>
|
|
566
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="pas de description" priority="12" serv_inv="0" service="rsyslog_TCP" src_inv="0" tag="ClientRsyslogTCP">
|
|
567
|
<source name="clients_tcp_rsyslog" />
|
|
568
|
<destination name="bastion" />
|
|
569
|
</directive>
|
|
570
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="pas de description" priority="13" serv_inv="0" service="rsyslog_UDP" src_inv="0" tag="ClientRsyslogUDP">
|
|
571
|
<source name="clients_udp_rsyslog" />
|
|
572
|
<destination name="bastion" />
|
|
573
|
</directive>
|
|
574
|
</montantes>
|
|
575
|
<descendantes default_policy="1">
|
|
576
|
</descendantes>
|
|
577
|
</flux>
|
|
578
|
<flux zoneA="exterieur" zoneB="admin">
|
|
579
|
<montantes default_policy="0">
|
|
580
|
</montantes>
|
|
581
|
<descendantes default_policy="1">
|
|
582
|
<directive accept="0" action="16" attrs="0" dest_inv="0" ipsec="0" libelle="pas de description" nat_extr="exterieur_bastion" nat_port="0" priority="1" serv_inv="0" service="tous" src_inv="0">
|
|
583
|
<source name="admin_restreint" />
|
|
584
|
<destination name="exterieur" />
|
|
585
|
</directive>
|
|
586
|
<directive accept="0" action="4" attrs="17" dest_inv="0" ipsec="0" libelle="Redirection des flux http avec proxy alternatif" nat_port="3128" priority="2" serv_inv="0" service="gr_redirection_proxy" src_inv="0" tag="ProxyBypass1">
|
|
587
|
<source name="admin" />
|
|
588
|
<destination name="exterieur" />
|
|
589
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth1/%%calc_classe(%%proxy_bypass_src_netmask_eth1)" ip="" name="" src="1" />
|
|
590
|
<exception dest="1" eolvar="%%proxy_bypass_network_eth1/%%calc_classe(%%proxy_bypass_netmask_eth1)" ip="" name="" src="0" />
|
|
591
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth1" ip="" name="" src="0" />
|
|
592
|
</directive>
|
|
593
|
<directive accept="0" action="4" attrs="17" dest_inv="1" ipsec="0" libelle="Redirection des flux http sans proxy vers une page d'erreur" nat_port="81" priority="3" serv_inv="0" service="http" src_inv="0" tag="ProxyBypass1">
|
|
594
|
<source name="admin" />
|
|
595
|
<destination name="exterieur_bastion" />
|
|
596
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth1/%%calc_classe(%%proxy_bypass_src_netmask_eth1)" ip="" name="" src="1" />
|
|
597
|
<exception dest="1" eolvar="%%proxy_bypass_network_eth1/%%calc_classe(%%proxy_bypass_netmask_eth1)" ip="" name="" src="0" />
|
|
598
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth1" ip="" name="" src="0" />
|
|
599
|
</directive>
|
|
600
|
<directive accept="0" action="4" attrs="17" dest_inv="0" ipsec="0" libelle="Redirection des flux https sans proxy vers une page d'erreur" nat_port="82" priority="4" serv_inv="0" service="gr_redirection_https" src_inv="0" tag="ProxyBypass1">
|
|
601
|
<source name="admin" />
|
|
602
|
<destination name="exterieur" />
|
|
603
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth1/%%calc_classe(%%proxy_bypass_src_netmask_eth1)" ip="" name="" src="1" />
|
|
604
|
<exception dest="1" eolvar="%%proxy_bypass_network_eth1/%%calc_classe(%%proxy_bypass_netmask_eth1)" ip="" name="" src="0" />
|
|
605
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth1" ip="" name="" src="0" />
|
|
606
|
</directive>
|
|
607
|
<directive accept="0" action="4" attrs="17" dest_inv="0" ipsec="0" libelle="Redirection des flux http avec proxy alternatif" nat_port="3128" priority="5" serv_inv="0" service="gr_redirection_proxy" src_inv="0" tag="ForceProxy1">
|
|
608
|
<source name="admin" />
|
|
609
|
<destination name="exterieur" />
|
|
610
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth1/%%calc_classe(%%proxy_bypass_src_netmask_eth1)" ip="" name="" src="1" />
|
|
611
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth1" ip="" name="" src="0" />
|
|
612
|
</directive>
|
|
613
|
<directive accept="0" action="4" attrs="17" dest_inv="1" ipsec="0" libelle="Redirection des flux http sans proxy vers une page d'erreur" nat_port="81" priority="6" serv_inv="0" service="http" src_inv="0" tag="ForceProxy1">
|
|
614
|
<source name="admin" />
|
|
615
|
<destination name="exterieur_bastion" />
|
|
616
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth1/%%calc_classe(%%proxy_bypass_src_netmask_eth1)" ip="" name="" src="1" />
|
|
617
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth1" ip="" name="" src="0" />
|
|
618
|
</directive>
|
|
619
|
<directive accept="0" action="4" attrs="17" dest_inv="0" ipsec="0" libelle="Redirection des flux https sans proxy vers une page d'erreur" nat_port="82" priority="7" serv_inv="0" service="gr_redirection_https" src_inv="0" tag="ForceProxy1">
|
|
620
|
<source name="admin" />
|
|
621
|
<destination name="exterieur" />
|
|
622
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth1/%%calc_classe(%%proxy_bypass_src_netmask_eth1)" ip="" name="" src="1" />
|
|
623
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth1" ip="" name="" src="0" />
|
|
624
|
</directive>
|
|
625
|
</descendantes>
|
|
626
|
</flux>
|
|
627
|
<flux zoneA="bastion" zoneB="admin">
|
|
628
|
<montantes default_policy="0">
|
|
629
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="ssh admin vers Amon" priority="1" serv_inv="0" service="ssh" src_inv="0" tag="SSHDepuisEth1">
|
|
630
|
<source name="admin_ssh" />
|
|
631
|
<destination name="bastion" />
|
|
632
|
</directive>
|
|
633
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="administration admin vers Amon" priority="2" serv_inv="0" service="admin_amon" src_inv="0" tag="AdminDepuisEth1">
|
|
634
|
<source name="admin_admin" />
|
|
635
|
<destination name="bastion" />
|
|
636
|
</directive>
|
|
637
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="Acces backend EAD admin vers Amon" priority="3" serv_inv="0" service="ead_server" src_inv="0" tag="BackendEADDepuisEth1">
|
|
638
|
<source name="admin_backend_ead" />
|
|
639
|
<destination name="bastion" />
|
|
640
|
</directive>
|
|
641
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="pas de description" priority="4" serv_inv="0" service="dns-tcp" src_inv="0">
|
|
642
|
<source name="admin" />
|
|
643
|
<destination name="internet_eth1" />
|
|
644
|
</directive>
|
|
645
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="pas de description" priority="5" serv_inv="0" service="dns-udp" src_inv="0">
|
|
646
|
<source name="admin" />
|
|
647
|
<destination name="internet_eth1" />
|
|
648
|
</directive>
|
|
649
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="autoriser l'acces a Nuauth" priority="6" serv_inv="0" service="nuauth" src_inv="0" tag="auth_nufw">
|
|
650
|
<source name="admin" />
|
|
651
|
<destination name="bastion" />
|
|
652
|
</directive>
|
|
653
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="pas de description" priority="7" serv_inv="0" service="eole-sso" src_inv="0" tag="eole_sso">
|
|
654
|
<source name="admin" />
|
|
655
|
<destination name="bastion" />
|
|
656
|
</directive>
|
|
657
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="pas de description" priority="8" serv_inv="0" service="proxy" src_inv="0">
|
|
658
|
<source name="admin" />
|
|
659
|
<destination name="internet_eth1" />
|
|
660
|
</directive>
|
|
661
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="pas de description" priority="9" serv_inv="0" service="proxy2" src_inv="0" tag="Activer squid2">
|
|
662
|
<source name="admin" />
|
|
663
|
<destination name="internet_eth1" />
|
|
664
|
</directive>
|
|
665
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="pas de description" priority="10" serv_inv="0" service="cntlm" src_inv="0" tag="cntlm">
|
|
666
|
<source name="admin" />
|
|
667
|
<destination name="internet_eth1" />
|
|
668
|
</directive>
|
|
669
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="gen_config admin vers Amon" priority="11" serv_inv="0" service="gen_config" src_inv="0" tag="SSHDepuisEth1">
|
|
670
|
<source name="admin_ssh" />
|
|
671
|
<destination name="bastion" />
|
|
672
|
</directive>
|
|
673
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="raduis admin vers Amon" priority="12" serv_inv="0" service="gr_radius" src_inv="0" tag="ActiverRadiuseth1">
|
|
674
|
<source name="admin" />
|
|
675
|
<destination name="bastion" />
|
|
676
|
</directive>
|
|
677
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="Autorisation reverse proxy + WPAD" priority="13" serv_inv="0" service="http" src_inv="0">
|
|
678
|
<source name="admin" />
|
|
679
|
<destination name="bastion_exterieur" />
|
|
680
|
</directive>
|
|
681
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="Autoriser ntp depuis admin" priority="14" serv_inv="0" service="ntp" src_inv="0">
|
|
682
|
<source name="admin" />
|
|
683
|
<destination name="bastion" />
|
|
684
|
</directive>
|
|
685
|
</montantes>
|
|
686
|
<descendantes default_policy="1">
|
|
687
|
</descendantes>
|
|
688
|
</flux>
|
|
689
|
<flux zoneA="exterieur" zoneB="pedago">
|
|
690
|
<montantes default_policy="0">
|
|
691
|
</montantes>
|
|
692
|
<descendantes default_policy="1">
|
|
693
|
<directive accept="0" action="16" attrs="0" dest_inv="0" ipsec="0" libelle="pas de description" nat_extr="exterieur_bastion" nat_port="0" priority="1" serv_inv="0" service="tous" src_inv="0">
|
|
694
|
<source name="pedago_restreint" />
|
|
695
|
<destination name="exterieur" />
|
|
696
|
</directive>
|
|
697
|
<directive accept="0" action="1" attrs="1" dest_inv="0" ipsec="0" libelle="pedago -> exterieur : interdire les protocoles de news, forums ..." priority="2" serv_inv="0" service="gr_forum" src_inv="0" tag="Interdiction des forums">
|
|
698
|
<source name="pedago" />
|
|
699
|
<destination name="exterieur" />
|
|
700
|
</directive>
|
|
701
|
<directive accept="0" action="1" attrs="1" dest_inv="0" ipsec="0" libelle="Interdire les connexions FTP" priority="3" serv_inv="0" service="gr_ftp" src_inv="0" tag="Interdire les connexions FTP">
|
|
702
|
<source name="pedago" />
|
|
703
|
<destination name="exterieur" />
|
|
704
|
</directive>
|
|
705
|
<directive accept="0" action="1" attrs="1" dest_inv="0" ipsec="0" libelle="pedago -> exterieur : interdire les protocoles de discussion en ligne (irc ...)" priority="4" serv_inv="0" service="gr_irc" src_inv="0" tag="Interdire l'utilisation des dialogues en direct">
|
|
706
|
<source name="pedago" />
|
|
707
|
<destination name="exterieur" />
|
|
708
|
</directive>
|
|
709
|
<directive accept="0" action="1" attrs="1" dest_inv="0" ipsec="0" libelle="pedago -> exterieur : interdire les protocoles de messagerie (pop, imap ...)" priority="5" serv_inv="0" service="gr_messagerie" src_inv="0" tag="Interdiction des protocoles de messagerie">
|
|
710
|
<source name="pedago" />
|
|
711
|
<destination name="exterieur" />
|
|
712
|
</directive>
|
|
713
|
<directive accept="0" action="1" attrs="1" dest_inv="0" ipsec="0" libelle="pedago -> exterieur : tout interdire (sauf le web via le proxy)" priority="6" serv_inv="0" service="gr_restreint" src_inv="0" tag="Internet restreint">
|
|
714
|
<source name="pedago" />
|
|
715
|
<destination name="exterieur" />
|
|
716
|
</directive>
|
|
717
|
<directive accept="0" action="4" attrs="17" dest_inv="0" ipsec="0" libelle="Redirection des flux http avec proxy alternatif" nat_port="3128" priority="7" serv_inv="0" service="gr_redirection_proxy" src_inv="0" tag="ProxyBypass2">
|
|
718
|
<source name="pedago" />
|
|
719
|
<destination name="exterieur" />
|
|
720
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth2/%%calc_classe(%%proxy_bypass_src_netmask_eth2)" ip="" name="" src="1" />
|
|
721
|
<exception dest="1" eolvar="%%proxy_bypass_network_eth2/%%calc_classe(%%proxy_bypass_netmask_eth2)" ip="" name="" src="0" />
|
|
722
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth2" ip="" name="" src="0" />
|
|
723
|
</directive>
|
|
724
|
<directive accept="0" action="4" attrs="17" dest_inv="1" ipsec="0" libelle="Redirection des flux http sans proxy" nat_port="81" priority="8" serv_inv="0" service="http" src_inv="0" tag="ProxyBypass2">
|
|
725
|
<source name="pedago" />
|
|
726
|
<destination name="exterieur_bastion" />
|
|
727
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth2/%%calc_classe(%%proxy_bypass_src_netmask_eth2)" ip="" name="" src="1" />
|
|
728
|
<exception dest="1" eolvar="%%proxy_bypass_network_eth2/%%calc_classe(%%proxy_bypass_netmask_eth2)" ip="" name="" src="0" />
|
|
729
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth2" ip="" name="" src="0" />
|
|
730
|
</directive>
|
|
731
|
<directive accept="0" action="4" attrs="17" dest_inv="0" ipsec="0" libelle="Redirection des flux https sans proxy vers une page d'erreur" nat_port="82" priority="9" serv_inv="0" service="gr_redirection_https" src_inv="0" tag="ProxyBypass2">
|
|
732
|
<source name="pedago" />
|
|
733
|
<destination name="exterieur" />
|
|
734
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth2/%%calc_classe(%%proxy_bypass_src_netmask_eth2)" ip="" name="" src="1" />
|
|
735
|
<exception dest="1" eolvar="%%proxy_bypass_network_eth2/%%calc_classe(%%proxy_bypass_netmask_eth2)" ip="" name="" src="0" />
|
|
736
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth2" ip="" name="" src="0" />
|
|
737
|
</directive>
|
|
738
|
<directive accept="0" action="4" attrs="17" dest_inv="0" ipsec="0" libelle="Redirection des flux http avec proxy alternatif" nat_port="3128" priority="10" serv_inv="0" service="gr_redirection_proxy" src_inv="0" tag="ForceProxy2">
|
|
739
|
<source name="pedago" />
|
|
740
|
<destination name="exterieur" />
|
|
741
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth2/%%calc_classe(%%proxy_bypass_src_netmask_eth2)" ip="" name="" src="1" />
|
|
742
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth2" ip="" name="" src="0" />
|
|
743
|
</directive>
|
|
744
|
<directive accept="0" action="4" attrs="17" dest_inv="1" ipsec="0" libelle="Redirection des flux http sans proxy vers une page d'erreur" nat_port="81" priority="11" serv_inv="0" service="http" src_inv="0" tag="ForceProxy2">
|
|
745
|
<source name="pedago" />
|
|
746
|
<destination name="exterieur_bastion" />
|
|
747
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth2/%%calc_classe(%%proxy_bypass_src_netmask_eth2)" ip="" name="" src="1" />
|
|
748
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth2" ip="" name="" src="0" />
|
|
749
|
</directive>
|
|
750
|
<directive accept="0" action="4" attrs="17" dest_inv="0" ipsec="0" libelle="Redirection des flux https sans proxy vers une page d'erreur" nat_port="82" priority="12" serv_inv="0" service="gr_redirection_https" src_inv="0" tag="ForceProxy2">
|
|
751
|
<source name="pedago" />
|
|
752
|
<destination name="exterieur" />
|
|
753
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth2/%%calc_classe(%%proxy_bypass_src_netmask_eth2)" ip="" name="" src="1" />
|
|
754
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth2" ip="" name="" src="0" />
|
|
755
|
</directive>
|
|
756
|
</descendantes>
|
|
757
|
</flux>
|
|
758
|
<flux zoneA="admin" zoneB="pedago">
|
|
759
|
<montantes default_policy="0">
|
|
760
|
</montantes>
|
|
761
|
<descendantes default_policy="1">
|
|
762
|
</descendantes>
|
|
763
|
</flux>
|
|
764
|
<flux zoneA="bastion" zoneB="pedago">
|
|
765
|
<montantes default_policy="0">
|
|
766
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="ssh pedago vers Amon" priority="1" serv_inv="0" service="ssh" src_inv="0" tag="SSHDepuisEth2">
|
|
767
|
<source name="pedago_ssh" />
|
|
768
|
<destination name="bastion" />
|
|
769
|
</directive>
|
|
770
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="administration pedago vers Amon" priority="2" serv_inv="0" service="admin_amon" src_inv="0" tag="AdminDepuisEth2">
|
|
771
|
<source name="pedago_admin" />
|
|
772
|
<destination name="bastion" />
|
|
773
|
</directive>
|
|
774
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="administration pedago vers Amon" priority="3" serv_inv="0" service="lightsquid" src_inv="0" tag="lightsquid2">
|
|
775
|
<source name="pedago_admin" />
|
|
776
|
<destination name="bastion" />
|
|
777
|
</directive>
|
|
778
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="pas de description" priority="4" serv_inv="0" service="dns-tcp" src_inv="0">
|
|
779
|
<source name="pedago" />
|
|
780
|
<destination name="internet_eth2" />
|
|
781
|
</directive>
|
|
782
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="pas de description" priority="5" serv_inv="0" service="dns-udp" src_inv="0">
|
|
783
|
<source name="pedago" />
|
|
784
|
<destination name="internet_eth2" />
|
|
785
|
</directive>
|
|
786
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="autoriser l'acces a Nuauth" priority="6" serv_inv="0" service="nuauth" src_inv="0" tag="auth_nufw">
|
|
787
|
<source name="pedago" />
|
|
788
|
<destination name="bastion" />
|
|
789
|
</directive>
|
|
790
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="pas de description" priority="7" serv_inv="0" service="eole-sso" src_inv="0" tag="eole_sso">
|
|
791
|
<source name="pedago" />
|
|
792
|
<destination name="bastion" />
|
|
793
|
</directive>
|
|
794
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="pas de description" priority="8" serv_inv="0" service="proxy" src_inv="0">
|
|
795
|
<source name="pedago" />
|
|
796
|
<destination name="internet_eth2" />
|
|
797
|
</directive>
|
|
798
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="pas de description" priority="9" serv_inv="0" service="proxy2" src_inv="0" tag="Activer squid2">
|
|
799
|
<source name="pedago" />
|
|
800
|
<destination name="internet_eth2" />
|
|
801
|
</directive>
|
|
802
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="pas de description" priority="10" serv_inv="0" service="cntlm" src_inv="0" tag="cntlm">
|
|
803
|
<source name="pedago" />
|
|
804
|
<destination name="internet_eth2" />
|
|
805
|
</directive>
|
|
806
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="gen_config pedago vers Amon" priority="11" serv_inv="0" service="gen_config" src_inv="0" tag="SSHDepuisEth2">
|
|
807
|
<source name="pedago_ssh" />
|
|
808
|
<destination name="bastion" />
|
|
809
|
</directive>
|
|
810
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="Acces backend EAD pedago vers Amon" priority="12" serv_inv="0" service="ead_server" src_inv="0" tag="BackendEADDepuisEth2">
|
|
811
|
<source name="pedago_backend_ead" />
|
|
812
|
<destination name="bastion" />
|
|
813
|
</directive>
|
|
814
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="raduis admin vers Amon" priority="13" serv_inv="0" service="gr_radius" src_inv="0" tag="ActiverRadiuseth2">
|
|
815
|
<source name="pedago" />
|
|
816
|
<destination name="bastion" />
|
|
817
|
</directive>
|
|
818
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="Autorisation reverse proxy + WPAD" priority="14" serv_inv="0" service="http" src_inv="0">
|
|
819
|
<source name="pedago" />
|
|
820
|
<destination name="bastion_exterieur" />
|
|
821
|
</directive>
|
|
822
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="Autoriser ntp depuis pedago" priority="15" serv_inv="0" service="ntp" src_inv="0">
|
|
823
|
<source name="pedago" />
|
|
824
|
<destination name="bastion" />
|
|
825
|
</directive>
|
|
826
|
</montantes>
|
|
827
|
<descendantes default_policy="1">
|
|
828
|
</descendantes>
|
|
829
|
</flux>
|
|
830
|
<flux zoneA="exterieur" zoneB="dmz">
|
|
831
|
<montantes default_policy="0">
|
|
832
|
</montantes>
|
|
833
|
<descendantes default_policy="1">
|
|
834
|
<directive accept="0" action="4" attrs="17" dest_inv="0" ipsec="0" libelle="Redirection des flux http avec proxy alternatif" nat_port="3128" priority="1" serv_inv="0" service="gr_redirection_proxy" src_inv="0" tag="ProxyBypass3">
|
|
835
|
<source name="dmz" />
|
|
836
|
<destination name="exterieur" />
|
|
837
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth3/%%calc_classe(%%proxy_bypass_src_netmask_eth3)" ip="" name="" src="1" />
|
|
838
|
<exception dest="1" eolvar="%%proxy_bypass_network_eth3/%%calc_classe(%%proxy_bypass_netmask_eth3)" ip="" name="" src="0" />
|
|
839
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth3" ip="" name="" src="0" />
|
|
840
|
</directive>
|
|
841
|
<directive accept="0" action="4" attrs="17" dest_inv="1" ipsec="0" libelle="Redirection des flux http sans proxy vers une page d'erreur" nat_port="81" priority="2" serv_inv="0" service="http" src_inv="0" tag="ProxyBypass3">
|
|
842
|
<source name="dmz" />
|
|
843
|
<destination name="exterieur_bastion" />
|
|
844
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth3/%%calc_classe(%%proxy_bypass_src_netmask_eth3)" ip="" name="" src="1" />
|
|
845
|
<exception dest="1" eolvar="%%proxy_bypass_network_eth3/%%calc_classe(%%proxy_bypass_netmask_eth3)" ip="" name="" src="0" />
|
|
846
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth3" ip="" name="" src="0" />
|
|
847
|
</directive>
|
|
848
|
<directive accept="0" action="4" attrs="17" dest_inv="0" ipsec="0" libelle="Redirection des flux https sans proxy vers une page d'erreur" nat_port="82" priority="3" serv_inv="0" service="gr_redirection_https" src_inv="0" tag="ProxyBypass3">
|
|
849
|
<source name="dmz" />
|
|
850
|
<destination name="exterieur" />
|
|
851
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth3/%%calc_classe(%%proxy_bypass_src_netmask_eth3)" ip="" name="" src="1" />
|
|
852
|
<exception dest="1" eolvar="%%proxy_bypass_network_eth3/%%calc_classe(%%proxy_bypass_netmask_eth3)" ip="" name="" src="0" />
|
|
853
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth3" ip="" name="" src="0" />
|
|
854
|
</directive>
|
|
855
|
<directive accept="0" action="4" attrs="17" dest_inv="0" ipsec="0" libelle="Redirection des flux http avec proxy alternatif" nat_port="3128" priority="4" serv_inv="0" service="gr_redirection_proxy" src_inv="0" tag="ForceProxy3">
|
|
856
|
<source name="dmz" />
|
|
857
|
<destination name="exterieur" />
|
|
858
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth3/%%calc_classe(%%proxy_bypass_src_netmask_eth3)" ip="" name="" src="1" />
|
|
859
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth3" ip="" name="" src="0" />
|
|
860
|
</directive>
|
|
861
|
<directive accept="0" action="4" attrs="17" dest_inv="1" ipsec="0" libelle="Redirection des flux http sans proxy vers une page d'erreur" nat_port="81" priority="5" serv_inv="0" service="http" src_inv="0" tag="ForceProxy3">
|
|
862
|
<source name="dmz" />
|
|
863
|
<destination name="exterieur_bastion" />
|
|
864
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth3/%%calc_classe(%%proxy_bypass_src_netmask_eth3)" ip="" name="" src="1" />
|
|
865
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth3" ip="" name="" src="0" />
|
|
866
|
</directive>
|
|
867
|
<directive accept="0" action="4" attrs="17" dest_inv="0" ipsec="0" libelle="Redirection des flux https sans proxy vers une page d'erreur" nat_port="82" priority="6" serv_inv="0" service="gr_redirection_https" src_inv="0" tag="ForceProxy3">
|
|
868
|
<source name="dmz" />
|
|
869
|
<destination name="exterieur" />
|
|
870
|
<exception dest="0" eolvar="%%proxy_bypass_src_network_eth3/%%calc_classe(%%proxy_bypass_src_netmask_eth3)" ip="" name="" src="1" />
|
|
871
|
<exception dest="1" eolvar="%%proxy_bypass_domain_eth3" ip="" name="" src="0" />
|
|
872
|
</directive>
|
|
873
|
<directive accept="0" action="16" attrs="17" dest_inv="0" ipsec="0" libelle="autoriser scribe a sortir sur Internet" nat_extr="exterieur_bastion" nat_port="0" priority="7" serv_inv="0" service="tous" src_inv="0" tag="ScribeDMZ">
|
|
874
|
<source name="serveur_scribe_dmz" />
|
|
875
|
<destination name="exterieur" />
|
|
876
|
</directive>
|
|
877
|
</descendantes>
|
|
878
|
</flux>
|
|
879
|
<flux zoneA="admin" zoneB="dmz">
|
|
880
|
<montantes default_policy="0">
|
|
881
|
</montantes>
|
|
882
|
<descendantes default_policy="1">
|
|
883
|
</descendantes>
|
|
884
|
</flux>
|
|
885
|
<flux zoneA="bastion" zoneB="dmz">
|
|
886
|
<montantes default_policy="0">
|
|
887
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="Autorisation reverse proxy + WPAD" priority="1" serv_inv="0" service="http" src_inv="0">
|
|
888
|
<source name="dmz" />
|
|
889
|
<destination name="bastion_exterieur" />
|
|
890
|
</directive>
|
|
891
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="ssh dmz vers Amon" priority="2" serv_inv="0" service="ssh" src_inv="0" tag="SSHDepuisEth3">
|
|
892
|
<source name="dmz_ssh" />
|
|
893
|
<destination name="bastion" />
|
|
894
|
</directive>
|
|
895
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="administration dmz vers Amon" priority="3" serv_inv="0" service="admin_amon" src_inv="0" tag="AdminDepuisEth3">
|
|
896
|
<source name="dmz_admin" />
|
|
897
|
<destination name="bastion" />
|
|
898
|
</directive>
|
|
899
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="Acces backend EAD dmz vers Amon" priority="4" serv_inv="0" service="ead_server" src_inv="0" tag="BackendEADDepuisEth3">
|
|
900
|
<source name="dmz_backend_ead" />
|
|
901
|
<destination name="bastion" />
|
|
902
|
</directive>
|
|
903
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="administration dmz vers Amon" priority="5" serv_inv="0" service="lightsquid" src_inv="0" tag="lightsquid3">
|
|
904
|
<source name="dmz_admin" />
|
|
905
|
<destination name="bastion" />
|
|
906
|
</directive>
|
|
907
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="pas de description" priority="6" serv_inv="0" service="dns-tcp" src_inv="0">
|
|
908
|
<source name="dmz" />
|
|
909
|
<destination name="internet" />
|
|
910
|
</directive>
|
|
911
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="pas de description" priority="7" serv_inv="0" service="dns-udp" src_inv="0">
|
|
912
|
<source name="dmz" />
|
|
913
|
<destination name="internet" />
|
|
914
|
</directive>
|
|
915
|
|
|
916
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="pas de description" priority="8" serv_inv="0" service="eole-sso" src_inv="0" tag="eole_sso">
|
|
917
|
<source name="dmz" />
|
|
918
|
<destination name="bastion" />
|
|
919
|
</directive>
|
|
920
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="pas de description" priority="9" serv_inv="0" service="proxy" src_inv="0">
|
|
921
|
<source name="dmz" />
|
|
922
|
<destination name="internet" />
|
|
923
|
</directive>
|
|
924
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="pas de description" priority="10" serv_inv="0" service="proxy2" src_inv="0" tag="Activer squid2">
|
|
925
|
<source name="dmz" />
|
|
926
|
<destination name="internet" />
|
|
927
|
</directive>
|
|
928
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="pas de description" priority="11" serv_inv="0" service="cntlm" src_inv="0" tag="cntlm">
|
|
929
|
<source name="dmz" />
|
|
930
|
<destination name="internet" />
|
|
931
|
</directive>
|
|
932
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="gen_config dmz vers Amon" priority="12" serv_inv="0" service="gen_config" src_inv="0" tag="SSHDepuisEth3">
|
|
933
|
<source name="dmz_ssh" />
|
|
934
|
<destination name="bastion" />
|
|
935
|
</directive>
|
|
936
|
<directive accept="0" action="2" attrs="0" dest_inv="0" ipsec="0" libelle="Autoriser ntp depuis dmz" priority="13" serv_inv="0" service="ntp" src_inv="0">
|
|
937
|
<source name="dmz" />
|
|
938
|
<destination name="bastion" />
|
|
939
|
</directive>
|
|
940
|
</montantes>
|
|
941
|
<descendantes default_policy="1">
|
|
942
|
</descendantes>
|
|
943
|
</flux>
|
|
944
|
<flux zoneA="pedago" zoneB="dmz">
|
|
945
|
<montantes default_policy="0">
|
|
946
|
<directive accept="0" action="2" attrs="17" dest_inv="0" ipsec="0" libelle="autoriser scribe a se connecter au reseau pedago" priority="1" serv_inv="0" service="scribe-dmz-pedago" src_inv="0" tag="ScribeDMZ">
|
|
947
|
<source name="serveur_scribe_dmz" />
|
|
948
|
<destination name="pedago" />
|
|
949
|
</directive>
|
|
950
|
</montantes>
|
|
951
|
<descendantes default_policy="1">
|
|
952
|
</descendantes>
|
|
953
|
</flux>
|
|
954
|
</flux-list></firewall>
|