diff --git a/DMZ.sh b/DMZ.sh index 252e151..75d7ede 100644 --- a/DMZ.sh +++ b/DMZ.sh @@ -31,7 +31,7 @@ sudo add default gw $routerIp sudo ip addr add $dns dev enp0s8 sudo ip addr add $mail dev enp0s8 sudo ip addr add $vpn_gw dev enp0s8 -sudo ip addr add $ww dev enp0s8 +sudo ip addr add $www dev enp0s8 sudo ip addr add $smtp dev enp0s8 # netcart diff --git a/INTERNAL.sh b/INTERNAL.sh index 960488a..c984ddb 100644 --- a/INTERNAL.sh +++ b/INTERNAL.sh @@ -18,7 +18,7 @@ sudo systemctl enable iptables sudo iptables -F sudo ifconfig enp0s8 $ip netmask $mask24 sudo ip route add 23.214.219.128/25 via $routerIp -sudo add default gw $routerIp +sudo route add default gw $routerIp # aliasing sudo ip addr add $ftp dev enp0s8 sudo ip addr add $datastore dev enp0s8 diff --git a/INTERNET.sh b/INTERNET.sh new file mode 100644 index 0000000..bf69423 --- /dev/null +++ b/INTERNET.sh @@ -0,0 +1,15 @@ +ip=87.248.214.98 +dns2=87.248.214.99 +eden=87.248.214.100 +mask24=255.255.255.0 +routerIp=87.248.214.97 +sudo yum install iptables-services -y +sudo systemctl stop firewalld +sudo systemctl disable firewalld +sudo systemctl mask firewalld +sudo systemctl enable iptables +sudo iptables -F +sudo ifconfig enp0s8 $ip netmask $mask24 +sudo add default gw $routerIp +sudo ip addr add $dns2 dev enp0s8 +sudo ip addr add $eden dev enp0s8 \ No newline at end of file diff --git a/ROUTER.sh b/ROUTER.sh index 46875ee..ee82729 100644 --- a/ROUTER.sh +++ b/ROUTER.sh @@ -65,32 +65,32 @@ sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p udp --sport 5 sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.130 -p udp --sport 53 -j ACCEPT #CORRECT AND TESTED WILL ACTIVATE WHEN YOU SEND FROM ENP0S9 to ENP0S8 sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT #THIS IS IMPORTANT AND MIGHT FUCK US #The dns and dns2 servers should be able to synchronize the contents of DNS zones. (protocol tcp port 53) -sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p tcp --sport 53 -j ACCEPT #NEED to test !! +sudo iptables -A FORWARD -i enp0s8 -o enp0s10 -s 23.214.219.130 -p tcp --sport 53 -j ACCEPT #NEED to test! #SMTP connections to the smtp server and returns -sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.131 -p tcp --sport 587 -j ACCEPT #Doesnt work because we didnt change the dmz file +sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.131 -p tcp --sport 587 -j ACCEPT #TESTED #sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -p tcp --dport 587 -m state --state ESTABLISHED,RELATED -j ACCEPT #POP and IMAP connections to the www server -sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.134 -p tcp --sport 143 -j ACCEPT #Changed -sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.134 -p tcp --sport 110 -j ACCEPT #Changed +sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.134 -p tcp --sport 143 -j ACCEPT #TESTED +sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.134 -p tcp --sport 110 -j ACCEPT #TESTED #HTTP and HTTPS connectins -sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.132 -p tcp --sport 80 -j ACCEPT #Changed -sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.132 -p tcp --sport 443 -j ACCEPT #Changed +sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.132 -p tcp --sport 80 -j ACCEPT #TESTED THROUGH NETCAT +sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.132 -p tcp --sport 443 -j ACCEPT #TESTED THROUGH NETCAT #sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -p tcp --dport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT #sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -p tcp --dport 443 -m state --state ESTABLISHED,RELATED -j ACCEPT #OpenVPN connections to the vpn-gw server -sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.133 -p udp --sport 1194 -j ACCEPT #Changed +sudo iptables -A FORWARD -i enp0s9 -o enp0s8 -d 23.214.219.133 -p udp --sport 1194 -j ACCEPT #NEDDS testing #sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -p udp --dport 1194 -j ACCEPT #VPN clients connected to the gateway vpn-gw ???? vpn should be able to acess ftp e datastore -sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -s 23.214.219.133 -d 192.168.10.2 -j ACCEPT -sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -s 23.214.219.133 -d 192.168.10.3 -j ACCEPT +sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -s 23.214.219.133 -d 192.168.10.2 -j ACCEPT #NEDDS testing +sudo iptables -A FORWARD -i enp0s8 -o enp0s9 -s 23.214.219.133 -d 192.168.10.3 -j ACCEPT #NEDDS testing #FTP da internet WORRIED sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.2 -p tcp --sport 21 -j ACCEPT #Changed sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 20 -j ACCEPT #MIGHT BE NEEDED #SSH CONNECTIONS datastore server but only from eden or dn2 -sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $dns2 -p tcp --sport 22 -j ACCEPT +sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $dns2 -p tcp --sport 22 -j ACCEPT #Need to check and make diferent ip addresses sudo iptables -A FORWARD -i enp0s10 -o enp0s9 -d 192.168.10.3 -s $eden -p tcp --sport 22 -j ACCEPT #enp0s9 to internet DNS, http, https, ssh, FTP(SERVERS??????(WHO INVITED THIS GUY)) -sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p udp --sport 53 -j ACCEPT -sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 80 -j ACCEPT -sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 443 -j ACCEPT +sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p udp --sport 53 -j ACCEPT #TESTED +sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 80 -j ACCEPT #TESTED +sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 443 -j ACCEPT #TESTED sudo iptables -A FORWARD -i enp0s9 -o enp0s10 -p tcp --sport 21 -j ACCEPT #MIGHT NOT BE ENOUGH