coimbrap
/
projet_serveur_krkn
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Correction NGINX

master
Pierre Coimbra 2019-10-28 14:09:01 +01:00
parent 4fca032aaf
commit de3793ec1f
No known key found for this signature in database
GPG Key ID: F9C449C78F6FAEE6
1 changed files with 19 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
infra/shorewall/shorewall_beta.md
View File

@ -31,14 +31,14 @@ Définition de la politique globale du pare-feu
```
#SOURCE DEST POLICY LOGLEVEL RATE CONNLIMIT
$FW net ACCEPT
$FW coro ACCEPT
krkn net ACCEPT
ext net ACCEPT
$FW net ACCEPT
$FW coro ACCEPT
krkn net ACCEPT
ext net ACCEPT
ext krkn DROP info
net all DROP info
all all REJECT info
ext krkn DROP info
net all DROP info
all all REJECT info
```
@ -54,37 +54,34 @@ Définition des exceptions aux règles définies dans le fichier policy
?SECTION NEW
Invalid(DROP) net all tcp
DNS(ACCEPT) $FW net
Ping(ACCEPT) all $FW
SSH(ACCEPT) net all
DNS(ACCEPT) $FW net
Ping(ACCEPT) all $FW
SSH(ACCEPT) net all
ACCEPT $FW krkn icmp
ACCEPT $FW krkn icmp
ACCEPT $FW ext icmp
ACCEPT $FW net icmp
ACCEPT krkn ext icmp
ACCEPT krkn ext icmp
#Interface web proxmox
ACCEPT krkn:10.10.0.3 $FW tcp 8006,5902
ACCEPT net $FW tcp 8006
#DNAT pour le proxy Nginx
DNAT net krkn:10.10.0.3 tcp 80,443
ACCEPT krkn:10.10.0.3 $FW tcp 8006,5902
ACCEPT net $FW tcp 8006
```
### /etc/shorewall/snat
Configuration SNAT permettant de faire du "masquerading", ainsi les paquets qui sortent des CT LXC ont comme IP source, l'IP de l'interface externe _eth0_.
```
#ACTION SOURCE DEST
MASQUERADE vmbr1 vmbr0
MASQUERADE vmbr2 vmbr0
MASQUERADE vmbr1 vmbr0
MASQUERADE vmbr2 vmbr0
```
### /etc/shorewall/zones
Définition des zones et de leur type.
```
#ZONE TYPE
fw firewall
net ipv4
fw firewall
net ipv4
krkn ipv4
ext ipv4
ext ipv4
coro ipv4
```