Edge01 Configuration Week 8 - 5huckle/OFFICIALTECHJOURNAL GitHub Wiki

set firewall all-ping 'enable' set firewall name DMZ-to-LAN default-action 'drop' set firewall name DMZ-to-LAN enable-default-log set firewall name DMZ-to-LAN rule 1 action 'accept' set firewall name DMZ-to-LAN rule 1 state established 'enable' set firewall name DMZ-to-LAN rule 10 action 'accept' set firewall name DMZ-to-LAN rule 10 description 'udp/1514 allowed to log01' set firewall name DMZ-to-LAN rule 10 destination address '172.16.200.10' set firewall name DMZ-to-LAN rule 10 destination port '1514' set firewall name DMZ-to-LAN rule 10 protocol 'udp' set firewall name DMZ-to-LAN rule 20 action 'accept' set firewall name DMZ-to-LAN rule 20 description 'icmp to log from jump' set firewall name DMZ-to-LAN rule 20 destination address '172.16.200.10' set firewall name DMZ-to-LAN rule 20 protocol 'icmp' set firewall name DMZ-to-LAN rule 20 source address '172.16.50.4' set firewall name DMZ-to-WAN default-action 'drop' set firewall name DMZ-to-WAN enable-default-log set firewall name DMZ-to-WAN rule 5 action 'accept' set firewall name DMZ-to-WAN rule 5 state established 'enable' set firewall name DMZ-to-WAN rule 10 action 'accept' set firewall name DMZ-to-WAN rule 10 description 'DMZ-->WAN access' set firewall name DMZ-to-WAN rule 10 destination port '123' set firewall name DMZ-to-WAN rule 10 protocol 'udp' set firewall name DMZ-to-WAN rule 20 action 'accept' set firewall name DMZ-to-WAN rule 20 description 'Internet access for nginx' set firewall name DMZ-to-WAN rule 20 destination port '80' set firewall name DMZ-to-WAN rule 20 protocol 'tcp' set firewall name DMZ-to-WAN rule 20 source address '172.16.50.5' set firewall name LAN-to-DMZ default-action 'drop' set firewall name LAN-to-DMZ enable-default-log set firewall name LAN-to-DMZ rule 1 action 'accept' set firewall name LAN-to-DMZ rule 5 action 'accept' set firewall name LAN-to-DMZ rule 5 state established 'enable' set firewall name LAN-to-DMZ rule 10 action 'accept' set firewall name LAN-to-DMZ rule 10 description 'internet access to nginx' set firewall name LAN-to-DMZ rule 10 destination address '172.16.50.5' set firewall name LAN-to-DMZ rule 10 destination port '80' set firewall name LAN-to-DMZ rule 10 protocol 'tcp' set firewall name LAN-to-DMZ rule 20 action 'accept' set firewall name LAN-to-DMZ rule 20 destination port '22' set firewall name LAN-to-DMZ rule 20 protocol 'tcp' set firewall name LAN-to-DMZ rule 20 source address '172.16.200.11' set firewall name LAN-to-DMz rule 10 action 'accept' set firewall name LAN-to-DMz rule 10 destination address '172.16.50.5' set firewall name LAN-to-DMz rule 10 destination port '80' set firewall name LAN-to-DMz rule 10 protocol 'tcp' set firewall name LAN-to-WAN default-action 'drop' set firewall name LAN-to-WAN enable-default-log set firewall name LAN-to-WAN rule 1 action 'accept' set firewall name WAN-to-DMZ default-action 'drop' set firewall name WAN-to-DMZ enable-default-log set firewall name WAN-to-DMZ rule 1 action 'accept' set firewall name WAN-to-DMZ rule 1 state established 'enable' set firewall name WAN-to-DMZ rule 10 action 'accept' set firewall name WAN-to-DMZ rule 10 description 'WAN access to nginx' set firewall name WAN-to-DMZ rule 10 destination address '172.16.50.5' set firewall name WAN-to-DMZ rule 10 destination port '80' set firewall name WAN-to-DMZ rule 10 protocol 'tcp' set firewall name WAN-to-DMZ rule 20 action 'accept' set firewall name WAN-to-DMZ rule 20 description 'WAN-->jumpbox access' set firewall name WAN-to-DMZ rule 20 destination address '172.16.50.4' set firewall name WAN-to-DMZ rule 20 destination port '22' set firewall name WAN-to-DMZ rule 20 protocol 'tcp' set firewall name WAN-to-LAN default-action 'drop' set firewall name WAN-to-LAN enable-default-log set firewall name WAN-to-LAN rule 1 action 'accept' set firewall name WAN-to-LAN rule 1 state established 'enable' set interfaces ethernet eth0 address '10.0.17.134/24' set interfaces ethernet eth0 description 'WAN' set interfaces ethernet eth1 address '172.16.50.2/29' set interfaces ethernet eth1 description 'DMZ' set interfaces ethernet eth2 address '172.16.150.2/24' set interfaces ethernet eth2 description 'LAN' set nat destination rule 10 description 'Forwarding from traveler to nginx' set nat destination rule 10 destination port '80' set nat destination rule 10 inbound-interface 'eth0' set nat destination rule 10 protocol 'tcp' set nat destination rule 10 translation address '172.16.50.5' set nat destination rule 20 description '--> Jump' set nat destination rule 20 destination port '22' set nat destination rule 20 inbound-interface 'eth0' set nat destination rule 20 protocol 'tcp' set nat destination rule 20 translation address '172.16.50.4' set nat destination rule 20 translation port '22' set nat source rule 10 description 'NAT FROM DMZ TO WAN' set nat source rule 10 outbound-interface 'eth0' set nat source rule 10 source address '172.16.50.0/29' set nat source rule 10 translation address 'masquerade' set nat source rule 20 description 'NAT FROM LAN TO WAN' set nat source rule 20 outbound-interface 'eth0' set nat source rule 20 source address '172.16.150.0/24' set nat source rule 20 translation address 'masquerade' set nat source rule 30 description 'Allows NAT from MGMT' set nat source rule 30 outbound-interface 'eth0' set nat source rule 30 source address '172.16.200.0/28' set nat source rule 30 translation address 'masquerade' set protocols rip interface eth2 set protocols rip network '172.16.50.0/29' set protocols static route 0.0.0.0/0 next-hop 10.0.17.2 set service dns forwarding allow-from '172.16.50.0/29' set service dns forwarding allow-from '172.16.150.0/24' set service dns forwarding allow-from '172.16.200.0/28' set service dns forwarding listen-address '172.16.150.2' set service dns forwarding listen-address '172.16.50.2' set service dns forwarding system set service ssh listen-address '0.0.0.0' set service ssh listen-address '172.16.150.2' set service ssh listen-address '10.0.17.134' set system host-name 'edge01-jibreel' set system name-server '10.0.17.2' set system syslog host 172.16.200.10 facility authpriv level 'info' set system syslog host 172.16.200.10 facility kern level 'debug' set system syslog host 172.16.200.10 format octet-counted set system syslog host 172.16.200.10 port '1514' set zone-policy zone DMZ from LAN firewall name 'LAN-to-DMZ' set zone-policy zone DMZ from WAN firewall name 'WAN-to-DMZ' set zone-policy zone DMZ interface 'eth1' set zone-policy zone LAN from DMZ firewall name 'DMZ-to-LAN' set zone-policy zone LAN from WAN firewall name 'WAN-to-LAN' set zone-policy zone LAN interface 'eth2' set zone-policy zone WAN from DMZ firewall name 'DMZ-to-WAN' set zone-policy zone WAN from LAN firewall name 'LAN-to-WAN' set zone-policy zone WAN interface 'eth0'