coimbrap
/
projet_serveur_krkn
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Correction NGINX

original/refs/heads/master
Pierre Coimbra 2019-10-28 14:09:01 +01:00 committed by Pierre Coimbra
parent ecfba11c05
commit 345649d47d
No known key found for this signature in database
GPG Key ID: F9C449C78F6FAEE6
1 changed files with 19 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
infra/shorewall/shorewall_beta.md
View File

@ -31,14 +31,14 @@ Définition de la politique globale du pare-feu
``` ```
#SOURCE DEST POLICY LOGLEVEL RATE CONNLIMIT #SOURCE DEST POLICY LOGLEVEL RATE CONNLIMIT
$FW net ACCEPT $FW net ACCEPT
$FW coro ACCEPT $FW coro ACCEPT
krkn net ACCEPT krkn net ACCEPT
ext net ACCEPT ext net ACCEPT
ext krkn DROP info ext krkn DROP info
net all DROP info net all DROP info
all all REJECT info all all REJECT info
``` ```
@ -54,37 +54,34 @@ Définition des exceptions aux règles définies dans le fichier policy
?SECTION NEW ?SECTION NEW
Invalid(DROP) net all tcp Invalid(DROP) net all tcp
DNS(ACCEPT) $FW net DNS(ACCEPT) $FW net
Ping(ACCEPT) all $FW Ping(ACCEPT) all $FW
SSH(ACCEPT) net all SSH(ACCEPT) net all
ACCEPT $FW krkn icmp ACCEPT $FW krkn icmp
ACCEPT $FW ext icmp ACCEPT $FW ext icmp
ACCEPT $FW net icmp ACCEPT $FW net icmp
ACCEPT krkn ext icmp ACCEPT krkn ext icmp
#Interface web proxmox #Interface web proxmox
ACCEPT krkn:10.10.0.3 $FW tcp 8006,5902 ACCEPT krkn:10.10.0.3 $FW tcp 8006,5902
ACCEPT net $FW tcp 8006 ACCEPT net $FW tcp 8006
#DNAT pour le proxy Nginx
DNAT net krkn:10.10.0.3 tcp 80,443
``` ```
### /etc/shorewall/snat ### /etc/shorewall/snat
Configuration SNAT permettant de faire du "masquerading", ainsi les paquets qui sortent des CT LXC ont comme IP source, l'IP de l'interface externe _eth0_. Configuration SNAT permettant de faire du "masquerading", ainsi les paquets qui sortent des CT LXC ont comme IP source, l'IP de l'interface externe _eth0_.
``` ```
#ACTION SOURCE DEST #ACTION SOURCE DEST
MASQUERADE vmbr1 vmbr0 MASQUERADE vmbr1 vmbr0
MASQUERADE vmbr2 vmbr0 MASQUERADE vmbr2 vmbr0
``` ```
### /etc/shorewall/zones ### /etc/shorewall/zones
Définition des zones et de leur type. Définition des zones et de leur type.
``` ```
#ZONE TYPE #ZONE TYPE
fw firewall fw firewall
net ipv4 net ipv4
krkn ipv4 krkn ipv4
ext ipv4 ext ipv4
coro ipv4 coro ipv4
``` ```