vasco/FSI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

More rules, funny coment

Browse Source
This commit is contained in:
jelly Tomas
2026-03-16 14:32:08 +00:00
parent 52c398d0eb
commit b2e4ab0e22
1 changed files with 80 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

143
ROUTER.sh
View File

@@ -1,63 +1,80 @@
# NETWORKS: # NETWORKS:
# DMZ: 23.214.219.128/25 # DMZ: 23.214.219.128/25
# Internal: 192.168.10.0/24 # Internal: 192.168.10.0/24
# #
# MACHINES: # MACHINES:
# DNS2: 192.137.16.75 # DNS2: 192.137.16.75
# EDEN 193.138.212.1 # EDEN 193.138.212.1
dns2="192.137.16.75" dns2="192.137.16.75"
eden="193.138.212.1" eden="193.138.212.1"
# ============================== # ==============================
# Router 1 # Router 1
# INTERFACES: # INTERFACES:
# - Internet: 87.248.214.97 # - Internet: 87.248.214.97
# - DMZ: 23.214.219.254 # - DMZ: 23.214.219.254
# - Internal: 192.168.10.254 # - Internal: 192.168.10.254
# ============================== # ==============================
# ============================== # ==============================
# DMZ /25 # DMZ /25
# IP: # IP:
# - dns : 23.214.219.129 # - dns : 23.214.219.129
# - dns2 : 23.214.219.130 # - dns2 : 23.214.219.130
# - smtp : 23.214.219.131 # - smtp : 23.214.219.131
# - www : 23.214.219.132 # - www : 23.214.219.132
# - vpn-gw: 23.214.219.133 # - vpn-gw: 23.214.219.133
# ============================== # ==============================
# ============================== # ==============================
# Internal # Internal
# IP: # IP:
# ftp: 192.168.10.1 # ftp: 192.168.10.1
# datastore : 192.168.10.2 # datastore : 192.168.10.2
# DHCP Client : 192.168.10.3-5 # DHCP Client : 192.168.10.3-5
# ============================== # ==============================
sudo ifconfig enp0s8 23.214.219.254 netmask 255.255.255.128 sudo ifconfig enp0s8 23.214.219.254 netmask 255.255.255.128
sudo ifconfig enp0s9 192.168.10.254 netmask 255.255.255.128 sudo ifconfig enp0s9 192.168.10.254 netmask 255.255.255.0
sudo ifconfig enp0s3 87.248.214.97 netmask 255.255.255.0 sudo ifconfig enp0s3 87.248.214.97 netmask 255.255.255.0
sudo iptables -F sudo iptables -F
sudo iptables -t nat -F sudo iptables -t nat -F
sudo iptables -t mangle -F sudo iptables -t mangle -F
sudo sysctl -w net.ipv4.ip_forward=1 sudo sysctl -w net.ipv4.ip_forward=1
iptables -P INPUT DROP iptables -P INPUT DROP
iptables -P FORWARD DROP iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT iptables -P OUTPUT ACCEPT
sudo iptables -A INPUT -i lo -j ACCEPT sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT sudo iptables -A OUTPUT -o lo -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE sudo iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE
#DNS name resolution requests sent to outside servers and want a response: #DNS name resolution requests sent to outside servers and want a response:TODO:INPUT
sudo iptables -A FORWARD -i enp0s3 -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT sudo iptables -A FORWARD -i enp0s3 -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
#SSH connections to the router system that originate from the inside and want an answer:É preciso outra regra uma para a port enp0s9 e o ip do vpn #SSH connections to the router system that originate from the inside and want an answer:TODO:INPUT
sudo iptables -A FORWARD -i enp0s9 -o enp0s3 -p tcp --dport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT sudo iptables -A FORWARD -i enp0s3 -o enp0s9 -p tcp --dport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A FORWARD -o enp0s3 -d 23.214.219.133 -p tcp --dport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT sudo iptables -A FORWARD -i enp0s3 -d 23.214.219.133 -p tcp --dport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT
#The dns server should be able to resolve names using the internet (and others???) #The dns server should be able to resolve names using the internet (and others???)
sudo iptables -A FORWARD -i enp0s8 -o enp0s3 -s 23.214.219.129 -p udp --dport 53 -j ACCEPT sudo iptables -A FORWARD -i enp0s8 -o enp0s3 -s 23.214.219.129 -p udp --dport 53 -j ACCEPT
sudo iptables -A FORWARD -i enp0s8 -o enp0s3 -s 23.214.219.130 -p udp --dport 53 -j ACCEPT #The internal network should be able to send and recieve dns name resolutions to the dns server (1!)
# Apartir daqui foi só para testar se as conecções funcionavam sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.129 -p udp --dport 53 -j ACCEPT
sudo iptables -A FORWARD -i enp0s8 -s 23.214.219.129 -p tcp --sport 22 sudo iptables -A FORWARD -i enp0s8 -i enp0s9 -p udp --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Unsure these will work #The dns and dns2 servers should be able to synchronize the contents of DNS zones. (protocol tcp port 53)
sudo iptables -A FORWARD -i enp0s9 -s 23.214.219.131 sudo iptables -A FORWARD -i enp0s8 -o enp0s3 -d 193.137.16.75 -p tcp --dport 53 -j ACCEPT
sudo iptables -A FORWARD -i enp0s3 -o enp0s8 -d 23.214.219.129 -p tcp --dport 53 -j ACCEPT
#SMTP connections to the smtp server and returns
sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.131 -p tcp --dport 587 -j ACCEPT
sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -p tcp --dport 587 -m state --state ESTABLISHED,RELATED -j ACCEPT
#POP and IMAP connections to the www server
sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.132 -p tcp --dport 80 -j ACCEPT
sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.132 -p tcp --dport 443 -j ACCEPT
sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -p tcp --dport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -p tcp --dport 443 -m state --state ESTABLISHED,RELATED -j ACCEPT
#OpenVPN connections to the vpn-gw server
sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.133 -p udp --dport 1194 -j ACCEPT
sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -p udp --dport 1194 -j ACCEPT
#VPN clients connected to the gateway vpn-gw ???? vpn should be able to acess ftp e datastore
# Apartir daqui foi só para testar se as conecções funcionavam
sudo iptables -A FORWARD -i enp0s8 -s 23.214.219.129 -p tcp --sport 22
# Unsure these will work
sudo iptables -A FORWARD -i enp0s9 -d 23.214.219.131