📦 Livrable 1 : Fichier .gns3

Topologie 2 sites avec pfSense et WireGuard pré-configuré.

{
  "name": "TP_VPN_SiteToSite",
  "version": "2.2.0",
  "topology": {
    "nodes": [
      {"node_id": "siteA-fw", "name": "pfSense_Paris", "node_type": "qemu", "x": 0, "y": 200, "properties": {"image": "pfSense-2.6.0.iso", "ram": 1024}},
      {"node_id": "siteB-fw", "name": "pfSense_Lyon", "node_type": "qemu", "x": 800, "y": 200, "properties": {"image": "pfSense-2.6.0.iso", "ram": 1024}},
      {"node_id": "siteA-pc1", "name": "ADMIN_Paris", "node_type": "vpcs", "x": -150, "y": 100, "properties": {"script": "ip 10.0.10.10/24 10.0.10.254"}},
      {"node_id": "siteA-pc2", "name": "USERS_Paris", "node_type": "vpcs", "x": -150, "y": 200, "properties": {"script": "ip 10.0.20.10/24 10.0.20.254"}},
      {"node_id": "siteB-pc1", "name": "ADMIN_Lyon", "node_type": "vpcs", "x": 950, "y": 100, "properties": {"script": "ip 10.1.10.10/24 10.1.10.254"}},
      {"node_id": "siteB-pc2", "name": "USERS_Lyon", "node_type": "vpcs", "x": 950, "y": 200, "properties": {"script": "ip 10.1.20.10/24 10.1.20.254"}},
      {"node_id": "switch-net", "name": "Cloud_Internet", "node_type": "ethernet_switch", "x": 400, "y": 200}
    ],
    "links": [
      {"nodes": [{"node_id": "siteA-fw","port":2},{"node_id": "switch-net","port":1}]},
      {"nodes": [{"node_id": "siteB-fw","port":2},{"node_id": "switch-net","port":2}]}
    ]
  }
}

🐍 Livrable 2 : Script Python

Testeur VPN : ping inter-sites, mesure débit/perte via iperf3, génération rapport.

Installation : pip install colorama iperf3

Utilisation : python3 vpn_tester.py --menu

#!/usr/bin/env python3
# vpn_tester.py - Testeur de VPN site-à-site

import subprocess, sys, argparse, time
from datetime import datetime
try:
    from colorama import init, Fore, Style
    init()
except:
    class Fore: RED=GREEN=YELLOW=CYAN=RESET=''

class VPNTester:
    def __init__(self):
        self.results = []
        self.config = {
            "tunnel_ip": "10.255.0.2",
            "remote_admin": "10.1.10.10",
            "tests": [
                {"name": "Test ping tunnel VPN", "ip": "10.255.0.2", "expected": "ALLOW"},
                {"name": "Test ping ADMIN Site A → Site B", "ip": "10.1.10.10", "expected": "ALLOW"},
                {"name": "Test ping USERS Site A → Site B", "ip": "10.1.20.10", "expected": "BLOCK"},
                {"name": "Test ping ADMIN Site B → Site A", "ip": "10.0.10.10", "expected": "ALLOW"}
            ]
        }
    
    def ping(self, ip, count=3):
        param = '-n' if sys.platform.lower().startswith('win') else '-c'
        try:
            r = subprocess.run(['ping', param, str(count), '-W', '2', ip], capture_output=True, text=True)
            success = r.returncode == 0
            # Extraire le temps moyen
            if success:
                import re
                match = re.search(r'time[= ]+(\d+(?:\.\d+)?)', r.stdout)
                latency = match.group(1) if match else "N/A"
            else:
                latency = "N/A"
            return success, latency
        except:
            return False, "N/A"
    
    def iperf_test(self, server_ip, duration=5):
        """Test débit via iperf3 (nécessite serveur iperf3 sur la cible)"""
        try:
            result = subprocess.run(['iperf3', '-c', server_ip, '-t', str(duration)], capture_output=True, text=True, timeout=duration+5)
            if result.returncode == 0:
                import re
                match = re.search(r'([\d\.]+) (Mbits/sec|Gbits/sec|\wbits/sec)', result.stdout)
                if match:
                    return f"{match.group(1)} {match.group(2)}"
            return "N/A"
        except:
            return "N/A"
    
    def run(self):
        print(f"{Fore.CYAN}🔍 Test du tunnel VPN...{Fore.RESET}\n")
        print(f"📅 {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")
        
        for t in self.config["tests"]:
            success, latency = self.ping(t["ip"])
            passed = (success and t["expected"] == "ALLOW") or (not success and t["expected"] == "BLOCK")
            self.results.append({**t, "actual": success, "latency": latency, "passed": passed})
            status = f"{Fore.GREEN}✓{Fore.RESET}" if passed else f"{Fore.RED}✗{Fore.RESET}"
            result_text = f"{latency}ms" if success else "TIMEOUT"
            print(f"{status} {t['name']}: {result_text} (attendu: {t['expected']})")
        
        # Test débit
        print(f"\n{Fore.CYAN}📊 Test de débit (iperf3)...{Fore.RESET}")
        bandwidth = self.iperf_test(self.config["tunnel_ip"])
        print(f"   Débit tunnel VPN: {bandwidth}")
        
        return self.results
    
    def html_report(self, filename="vpn_report.html"):
        passed = sum(1 for r in self.results if r['passed'])
        total = len(self.results)
        score = (passed/total)*100 if total>0 else 0
        html = f"""

📊 Rapport VPN Site-à-Site
Date: {datetime.now()}
Score: {score:.1f}% ({passed}/{total})
"""
        for r in self.results:
            html += f""
            html += f""
        html += "
Test
IP
Attendu
Réel
Latence
Statut
{r['name']}
{r['ip']}
{r['expected']}
{'SUCCÈS' if r['actual'] else 'ÉCHEC'}
{r['latency']}
{'✅ OK' if r['passed'] else '❌ ÉCHEC'}
Généré par VPN Tester | CyberRéseau Pro

"
        with open(filename, 'w', encoding='utf-8') as f:
            f.write(html)
        print(f"{Fore.GREEN}📄 Rapport généré: {filename}{Fore.RESET}")
    
    def menu(self):
        while True:
            print(f"\n{Fore.CYAN}════════════════════════════════════════╗{Fore.RESET}")
            print(f"{Fore.CYAN}           TESTEUR VPN SITE-À-SITE{Fore.RESET}")
            print(f"{Fore.CYAN}════════════════════════════════════════╝{Fore.RESET}")
            print("1. 🔍 Lancer les tests")
            print("2. 📄 Générer rapport HTML")
            print("3. 🚪 Quitter")
            choice = input(f"{Fore.YELLOW}Votre choix : {Fore.RESET}")
            if choice == '1': self.run()
            elif choice == '2':
                if self.results: self.html_report()
                else: print("Lancez d'abord les tests")
            elif choice == '3': break

if __name__ == "__main__":
    tester = VPNTester()
    if len(sys.argv) > 1 and '--menu' in sys.argv:
        tester.menu()
    else:
        tester.run()
        tester.html_report()

🔧 Livrable 3 : Script Bash

Diagnostic VPN : état tunnel, logs, performances, checklist.

Utilisation : chmod +x diagnostic_vpn.sh && ./diagnostic_vpn.sh --all

#!/bin/bash
RAPPORT="vpn_diag_$(date +%Y%m%d_%H%M%S).txt"
GREEN='\033[0;32m'; RED='\033[0;31m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; NC='\033[0m'

log() { echo -e "$1" | tee -a "$RAPPORT"; }
log_header() { echo ""; log "${CYAN}═══════════════════════════════════════${NC}"; log "$1"; log "${CYAN}═══════════════════════════════════════${NC}"; }

check_wireguard() {
    log_header "État WireGuard"
    if command -v wg &>/dev/null; then
        wg show | tee -a "$RAPPORT"
    else
        log "WireGuard non installé"
    fi
}

check_ipsec() {
    log_header "État IPsec"
    if command -v ipsec &>/dev/null; then
        ipsec statusall 2>/dev/null | head -30 | tee -a "$RAPPORT"
    else
        log "IPsec non installé"
    fi
}

test_connectivity() {
    log_header "Tests de connectivité VPN"
    local tests=(
        "Tunnel VPN:10.255.0.2"
        "ADMIN Site B:10.1.10.10"
        "USERS Site B:10.1.20.10"
    )
    for test in "${tests[@]}"; do
        name="${test%:*}"
        ip="${test#*:}"
        if ping -c 2 -W 2 "$ip" &>/dev/null; then
            log "${GREEN}✅ $name: SUCCÈS${NC}"
        else
            log "${RED}❌ $name: ÉCHEC${NC}"
        fi
    done
}

check_routes() {
    log_header "Routes VPN"
    ip route show | grep -E "10\.|wg|tun" | tee -a "$RAPPORT"
}

check_mtu() {
    log_header "Vérification MTU"
    log "=== MTU actuel ==="
    ip link show wg0 2>/dev/null | grep mtu | tee -a "$RAPPORT"
    log ""
    log "=== Test MTU optimal ==="
    for mtu in 1500 1450 1420 1400; do
        if ping -M do -s $(($mtu - 28)) -c 1 -W 1 10.255.0.2 &>/dev/null 2>&1; then
            log "${GREEN}✓ MTU $mtu fonctionne${NC}"
            break
        else
            log "✗ MTU $mtu échoue"
        fi
    done
}

checklist() {
    log_header "CHECKLIST VPN SITE-À-SITE"
    cat >> "$RAPPORT" << 'EOF'
□ 1. WireGuard/IPsec installé sur les deux sites
□ 2. Clés publiques échangées entre sites
□ 3. Fichier de configuration complet
□ 4. Port UDP 51820 ouvert sur les firewalls
□ 5. Tunnel actif (wg show / ipsec statusall)
□ 6. Routage statique configuré (route add)
□ 7. IP forwarding activé (sysctl net.ipv4.ip_forward=1)
□ 8. Règles iptables acceptent le trafic VPN
□ 9. Ping inter-sites fonctionnel
□ 10. MTU correctement ajusté si nécessaire
EOF
    cat "$RAPPORT" | tail -15
}

auto_mode() {
    log_header "DIAGNOSTIC VPN AUTOMATIQUE"
    check_wireguard
    check_ipsec
    check_routes
    test_connectivity
    check_mtu
    checklist
    echo -e "${GREEN}✓ Rapport sauvegardé: $RAPPORT${NC}"
}

show_menu() {
    echo ""; echo -e "${CYAN}═══════════════════════════════════════${NC}"
    echo -e "         DIAGNOSTIC VPN SITE-À-SITE"
    echo -e "${CYAN}═══════════════════════════════════════${NC}"
    echo "1. 🔍 Diagnostic complet"
    echo "2. 🔐 Vérifier WireGuard/IPsec"
    echo "3. 🌐 Tester connectivité"
    echo "4. 📋 Afficher checklist"
    echo "5. 🚪 Quitter"
    echo -n "Votre choix : "
}

if [ "$1" == "--all" ] || [ "$1" == "-a" ]; then
    auto_mode
else
    while true; do
        show_menu; read choice
        case $choice in
            1) auto_mode ;;
            2) check_wireguard; check_ipsec ;;
            3) test_connectivity ;;
            4) checklist ;;
            5) echo -e "${GREEN}Au revoir !${NC}"; exit 0 ;;
            *) echo -e "${RED}Choix invalide${NC}" ;;
        esac
    done
fi