You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
55 lines
871 B
55 lines
871 B
#! /sbin/nft -f
|
|
|
|
|
|
table inet firewall {
|
|
|
|
# Définition de la DMZ
|
|
|
|
set z_dmz {
|
|
type ipv4_addr;
|
|
flags interval
|
|
elements = {
|
|
# Si l'on souhaite ajouter des ranges d'ip c'est ici
|
|
193.48.225.224/27,
|
|
}
|
|
}
|
|
|
|
set dmz_allowed_tcp_in {
|
|
type ipv4_addr . inet_service
|
|
flags interval
|
|
elements = {
|
|
}
|
|
}
|
|
set dmz_allowed_tcp_out {
|
|
type ipv4_addr . inet_service
|
|
flags interval
|
|
elements = {
|
|
}
|
|
}
|
|
set dmz_allowed_udp_in {
|
|
type ipv4_addr . inet_service
|
|
flags interval
|
|
elements = {
|
|
}
|
|
}
|
|
set dmz_allowed_udp_out {
|
|
type ipv4_addr . inet_service
|
|
flags interval
|
|
elements = {
|
|
}
|
|
}
|
|
|
|
|
|
chain to_dmz {
|
|
ip daddr . tcp dport @dmz_allowed_tcp_in accept;
|
|
ip daddr . udp dport @dmz_allowed_udp_in accept;
|
|
drop;
|
|
}
|
|
|
|
chain from_dmz {
|
|
not ip saddr . tcp dport @dmz_allowed_tcp_out drop;
|
|
not ip saddr . udp dport @dmz_allowed_udp_out drop;
|
|
}
|
|
|
|
}
|
|
|
|
|