📦 Livrable 1 : Fichier .gns3

Topologie pfSense + switch L3 + 4 VLANs. À importer via File → Import portable project.

{
  "name": "TP_Firewall_VLANs",
  "version": "2.2.0",
  "topology": {
    "nodes": [
      {"node_id": "sw1", "name": "Switch_VLAN", "node_type": "ethernet_switch", "x": 0, "y": 200, "properties": {"ethernet_ports": 24}},
      {"node_id": "fw", "name": "pfSense_Firewall", "node_type": "qemu", "x": 400, "y": 200, "properties": {"image": "pfSense-2.6.0.iso", "ram": 1024}},
      {"node_id": "pc1", "name": "PC_ADMIN", "node_type": "vpcs", "x": -150, "y": 100, "properties": {"script": "ip 10.0.10.10/24 10.0.10.254"}},
      {"node_id": "pc2", "name": "PC_USERS", "node_type": "vpcs", "x": -150, "y": 200, "properties": {"script": "ip 10.0.20.10/24 10.0.20.254"}},
      {"node_id": "pc3", "name": "PC_GUEST", "node_type": "vpcs", "x": -150, "y": 300, "properties": {"script": "ip 10.0.30.10/24 10.0.30.254"}},
      {"node_id": "pc4", "name": "DMZ_Server", "node_type": "vpcs", "x": 200, "y": 350, "properties": {"script": "ip 10.0.40.10/24 10.0.40.254"}}
    ],
    "links": [
      {"nodes": [{"node_id": "pc1","port":0},{"node_id": "sw1","adapter":0,"port":1}]},
      {"nodes": [{"node_id": "pc2","port":0},{"node_id": "sw1","adapter":0,"port":2}]},
      {"nodes": [{"node_id": "pc3","port":0},{"node_id": "sw1","adapter":0,"port":3}]},
      {"nodes": [{"node_id": "pc4","port":0},{"node_id": "sw1","adapter":0,"port":4}]},
      {"nodes": [{"node_id": "sw1","adapter":0,"port":24},{"node_id": "fw","adapter":0,"port":0}]}
    ]
  }
}

🐍 Livrable 2 : Script Python

Testeur automatique des règles firewall (ping/tcp, génération rapport HTML).

Installation : pip install colorama

Utilisation : python3 firewall_tester.py --menu

#!/usr/bin/env python3
# firewall_tester.py - Testeur de règles firewall

import subprocess, sys, argparse
from datetime import datetime
try:
    from colorama import init, Fore, Style
    init()
except:
    class Fore: RED=GREEN=YELLOW=CYAN=RESET=''

class FirewallTester:
    def __init__(self):
        self.results = []
        self.config = {
            "tests": [
                {"src": "10.0.10.10", "src_name": "ADMIN", "dst": "10.0.20.10", "dst_name": "USERS", "expected": "ALLOW"},
                {"src": "10.0.10.10", "src_name": "ADMIN", "dst": "10.0.30.10", "dst_name": "GUEST", "expected": "BLOCK"},
                {"src": "10.0.20.10", "src_name": "USERS", "dst": "10.0.10.10", "dst_name": "ADMIN", "expected": "BLOCK"},
                {"src": "10.0.30.10", "src_name": "GUEST", "dst": "10.0.10.10", "dst_name": "ADMIN", "expected": "BLOCK"},
                {"src": "10.0.30.10", "src_name": "GUEST", "dst": "10.0.40.10", "dst_name": "DMZ", "port": 80, "expected": "ALLOW"},
                {"src": "10.0.30.10", "src_name": "GUEST", "dst": "8.8.8.8", "dst_name": "INTERNET", "expected": "ALLOW"}
            ]
        }
    
    def ping(self, ip):
        param = '-n' if sys.platform.lower().startswith('win') else '-c'
        try:
            r = subprocess.run(['ping', param, '2', '-W', '2', ip], capture_output=True)
            return r.returncode == 0
        except:
            return False
    
    def test_tcp(self, ip, port):
        try:
            import socket
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.settimeout(2)
            s.connect((ip, port))
            s.close()
            return True
        except:
            return False
    
    def run(self):
        print(f"{Fore.CYAN}🔍 Test des règles firewall...{Fore.RESET}\n")
        for t in self.config["tests"]:
            if "port" in t:
                result = self.test_tcp(t["dst"], t["port"])
            else:
                result = self.ping(t["dst"])
            passed = (result and t["expected"]=="ALLOW") or (not result and t["expected"]=="BLOCK")
            self.results.append({**t, "actual": "ALLOW" if result else "BLOCK", "passed": passed})
            status = f"{Fore.GREEN}✓{Fore.RESET}" if passed else f"{Fore.RED}✗{Fore.RESET}"
            print(f"{status} {t['src_name']} → {t['dst_name']}: attendu={t['expected']} réel={self.results[-1]['actual']}")
        return self.results
    
    def html_report(self, filename="firewall_report.html"):
        passed = sum(1 for r in self.results if r['passed'])
        total = len(self.results)
        score = (passed/total)*100 if total>0 else 0
        html = f"""

📊 Rapport Firewall
Date: {datetime.now()}
Score: {score:.1f}% ({passed}/{total})
"""
        for r in self.results:
            html += f""
            html += f""
        html += "
Source
Destination
Attendu
Réel
Statut
{r['src_name']}
{r['dst_name']}
{r['expected']}
{r['actual']}
{'✅ OK' if r['passed'] else '❌ ÉCHEC'}
Généré par Firewall Tester | CyberRéseau Pro

"
        with open(filename, 'w', encoding='utf-8') as f:
            f.write(html)
        print(f"{Fore.GREEN}📄 Rapport généré: {filename}{Fore.RESET}")
    
    def menu(self):
        while True:
            print(f"\n{Fore.CYAN}════════════════════════════════════════╗{Fore.RESET}")
            print(f"{Fore.CYAN}          TESTEUR FIREWALL{Fore.RESET}")
            print(f"{Fore.CYAN}════════════════════════════════════════╝{Fore.RESET}")
            print("1. 🔍 Lancer les tests")
            print("2. 📄 Générer rapport HTML")
            print("3. 🚪 Quitter")
            choice = input(f"{Fore.YELLOW}Votre choix : {Fore.RESET}")
            if choice == '1': self.run()
            elif choice == '2':
                if self.results: self.html_report()
                else: print("Lancez d'abord les tests")
            elif choice == '3': break

if __name__ == "__main__":
    tester = FirewallTester()
    if len(sys.argv) > 1 and '--menu' in sys.argv:
        tester.menu()
    else:
        tester.run()
        tester.html_report()

🔧 Livrable 3 : Script Bash

Diagnostic automatique des règles firewall, logs et connectivité.

Utilisation : chmod +x diagnostic_firewall.sh && ./diagnostic_firewall.sh --all

#!/bin/bash
RAPPORT="firewall_diag_$(date +%Y%m%d_%H%M%S).txt"
GREEN='\033[0;32m'; RED='\033[0;31m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; NC='\033[0m'

log() { echo -e "$1" | tee -a "$RAPPORT"; }
log_header() { echo ""; log "${CYAN}═══════════════════════════════════════${NC}"; log "$1"; log "${CYAN}═══════════════════════════════════════${NC}"; }

check_iptables() {
    log_header "Règles iptables"
    iptables -L -v -n | tee -a "$RAPPORT"
    log "\n--- Règles NAT ---"
    iptables -t nat -L -v -n | tee -a "$RAPPORT"
}

test_rules() {
    log_header "Tests de connectivité"
    local tests=(
        "ADMIN:10.0.10.10:USERS:10.0.20.10:ALLOW"
        "ADMIN:10.0.10.10:GUEST:10.0.30.10:BLOCK"
        "USERS:10.0.20.10:ADMIN:10.0.10.10:BLOCK"
        "GUEST:10.0.30.10:ADMIN:10.0.10.10:BLOCK"
        "GUEST:10.0.30.10:DMZ:10.0.40.10:ALLOW"
        "GUEST:10.0.30.10:INTERNET:8.8.8.8:ALLOW"
    )
    for test in "${tests[@]}"; do
        IFS=':' read -r src_name src_ip dst_name dst_ip expected <<< "$test"
        if ping -c 1 -W 1 "$dst_ip" &>/dev/null; then
            actual="ALLOW"
        else
            actual="BLOCK"
        fi
        if [ "$actual" = "$expected" ]; then
            log "${GREEN}✓ $src_name → $dst_name: $actual (attendu: $expected)${NC}"
        else
            log "${RED}✗ $src_name → $dst_name: $actual (attendu: $expected)${NC}"
        fi
    done
}

checklist() {
    log_header "CHECKLIST FIREWALL"
    cat >> "$RAPPORT" << 'EOF'
□ 1. VLANs créés sur le switch (show vlan brief)
□ 2. Ports dans les bons VLANs
□ 3. Trunk vers firewall configuré
□ 4. Interfaces VLAN créées sur le firewall
□ 5. IPs des VLANs configurées
□ 6. Règles de filtrage définies dans le bon ordre
□ 7. Routage inter-VLAN activé
□ 8. Tests de connectivité intra-VLAN OK
□ 9. Tests inter-VLAN conformes aux règles
□ 10. Logs firewall actifs et consultables
EOF
    cat "$RAPPORT" | tail -15
}

auto_mode() {
    log_header "DIAGNOSTIC FIREWALL AUTOMATIQUE"
    check_iptables
    test_rules
    checklist
    echo -e "${GREEN}✓ Rapport sauvegardé: $RAPPORT${NC}"
}

show_menu() {
    echo ""; echo -e "${CYAN}═══════════════════════════════════════${NC}"
    echo -e "         DIAGNOSTIC FIREWALL"
    echo -e "${CYAN}═══════════════════════════════════════${NC}"
    echo "1. 🔍 Diagnostic complet"
    echo "2. 🔥 Vérifier règles iptables"
    echo "3. 🌐 Tester la connectivité"
    echo "4. 📋 Afficher checklist"
    echo "5. 🚪 Quitter"
    echo -n "Votre choix : "
}

if [ "$1" == "--all" ] || [ "$1" == "-a" ]; then
    auto_mode
else
    while true; do
        show_menu; read choice
        case $choice in
            1) auto_mode ;;
            2) check_iptables | tee -a "$RAPPORT" ;;
            3) test_rules | tee -a "$RAPPORT" ;;
            4) checklist ;;
            5) echo -e "${GREEN}Au revoir !${NC}"; exit 0 ;;
            *) echo -e "${RED}Choix invalide${NC}" ;;
        esac
    done
fi