Cours 10 — Firewalls & Proxy

Durée : 6 séances | Niveau : Avancé

---

1. Introduction aux Firewalls

1.1 Définition et rôle

Un firewall est un système de sécurité réseau qui filtre le trafic entrant et sortant selon des règles prédéfinies.

1.2 Types de firewalls

Diagramme en cours de génération...

1.3 Comparatif

---

2. iptables / nftables

2.1 iptables — Architecture

Diagramme en cours de génération...

Tables : filter, nat, mangle, raw, security

Chaînes : PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING

2.2 Règles iptables essentielles

# Politique par défaut
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Stateful - autoriser connexions établies
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# SSH
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT

# HTTP/HTTPS
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT

# Rate limiting
iptables -A INPUT -p tcp --syn -m limit --limit 10/s --limit-burst 20 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP

# Protection contre les scans
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

2.3 nftables (successeur d'iptables)

# Familles d'adresses : ip, ip6, inet, arp, bridge
# Tables, chains, rules

# Exemple nftables
sudo nft add table inet filter
sudo nft add chain inet filter input { type filter hook input priority 0\; policy drop\; }
sudo nft add rule inet filter input ct state established,related accept
sudo nft add rule inet filter input tcp dport { 22, 80, 443 } accept
sudo nft add rule inet filter input iif lo accept

Avantages nftables :

• Syntaxe unifiée (ipv4 + ipv6)
• Performances améliorées
• Debugging plus facile
• Atomic rule replacement

---

3. AWS Security Groups / Network ACL

3.1 Security Groups (Stateful)

Diagramme en cours de génération...

Caractéristiques :

• Stateful (réponse automatique autorisée)
• Permissives uniquement (pas de deny explicite)
• Au niveau de l'ENI (Elastic Network Interface)
• Support des references à d'autres SGs

# CloudFormation Security Group
WebSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: "Web server SG"
    SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: 0.0.0.0/0
      - IpProtocol: tcp
        FromPort: 22
        SourceSecurityGroupId: !Ref BastionSG

3.2 Network ACL (Stateless)

Caractéristiques :

• Stateless (règles entrée + sortie nécessaires)
• Supporte Allow et Deny
• Au niveau du subnet
• Ordre numérique des règles (première règle match = appliquée)

Diagramme en cours de génération...

{
  "NetworkAclEntry": {
    "RuleNumber": 100,
    "Protocol": "6",
    "RuleAction": "allow",
    "Egress": false,
    "CidrBlock": "0.0.0.0/0",
    "PortRange": { "From": 80, "To": 80 }
  }
}

---

4. Reverse Proxy

4.1 Qu'est-ce qu'un reverse proxy ?

Un reverse proxy se place devant les serveurs backend et agit comme intermédiaire pour les clients.

Diagramme en cours de génération...

Fonctions :

• Load balancing
• TLS termination
• Cache
• Compression
• Authentication
• Rate limiting
• WAF

4.2 Nginx

# /etc/nginx/nginx.conf
upstream backend {
    least_conn;
    server 10.0.1.10:3000 weight=3;
    server 10.0.1.11:3000 weight=2;
    server 10.0.1.12:3000 backup;
}

server {
    listen 443 ssl http2;
    server_name app.example.com;

    ssl_certificate /etc/letsencrypt/live/app.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;

    location / {
        proxy_pass http://backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Rate limiting
        limit_req zone=api burst=20 nodelay;
    }

    location /api/ {
        proxy_pass http://backend;
        # WAF rules
        modsecurity on;
        modsecurity_rules_file /etc/nginx/modsec/main.conf;
    }

    location /static/ {
        root /var/www/static;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }
}

4.3 HAProxy

global
    daemon
    maxconn 4096
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384
    ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11

defaults
    log global
    mode http
    option httplog
    option dontlognull
    timeout connect 5000ms
    timeout client 50000ms
    timeout server 50000ms

frontend www-in
    bind *:80
    bind *:443 ssl crt /etc/haproxy/certs/app.example.com.pem
    http-request redirect scheme https unless { ssl_fc }

    # Rate limiting
    stick-table type ip size 100k expire 30s store http_req_rate(10s)
    http-request track-sc0 src
    http-request deny deny_status 429 if { sc_http_req_rate(0) gt 100 }

    default_backend web-servers

backend web-servers
    balance roundrobin
    option httpchk GET /health
    server web1 10.0.1.10:3000 check weight 3
    server web2 10.0.1.11:3000 check weight 2
    server web3 10.0.1.12:3000 check backup

4.4 Envoy Proxy

Envoy est un proxy de couche 7 hautement performant, conçu pour les architectures modernes (service mesh).

# envoy.yaml
static_resources:
  listeners:
    - name: listener_0
      address:
        socket_address: { address: 0.0.0.0, port_value: 8080 }
      filter_chains:
        - filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: ingress_http
                route_config:
                  name: local_route
                  virtual_hosts:
                    - name: backend
                      domains: ["*"]
                      routes:
                        - match: { prefix: "/api/" }
                          route: { cluster: api_service }
                        - match: { prefix: "/" }
                          route: { cluster: web_service }
                http_filters:
                  - name: envoy.filters.http.router
  clusters:
    - name: web_service
      type: STRICT_DNS
      lb_policy: ROUND_ROBIN
      load_assignment:
        cluster_name: web_service
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address: { address: web1, port_value: 3000 }
    - name: api_service
      type: STRICT_DNS
      lb_policy: LEAST_REQUEST
      load_assignment:
        cluster_name: api_service
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address: { address: api1, port_value: 8080 }

4.5 Traefik

Traefik est un reverse proxy moderne avec auto-discovery, conçu pour les conteneurs et l'orchestration.

# docker-compose.yml avec Traefik
version: '3.8'
services:
  traefik:
    image: traefik:v3.0
    command:
      - "--providers.docker=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.email=admin@example.com"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "./letsencrypt:/letsencrypt"

  app:
    image: myapp:latest
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app.rule=Host(`app.example.com`)"
      - "traefik.http.routers.app.entrypoints=websecure"
      - "traefik.http.routers.app.tls.certresolver=letsencrypt"
      - "traefik.http.services.app.loadbalancer.server.port=3000"

---

5. Load Balancing

5.1 Algorithmes de load balancing

Diagramme en cours de génération...

5.2 AWS ALB (Application Load Balancer)

# CloudFormation ALB
ALB:
  Type: AWS::ElasticLoadBalancingV2::LoadBalancer
  Properties:
    Type: application
    Scheme: internet-facing
    SecurityGroups:
      - !Ref ALBSecurityGroup
    Subnets:
      - !Ref PublicSubnet1
      - !Ref PublicSubnet2

ALBListener:
  Type: AWS::ElasticLoadBalancingV2::Listener
  Properties:
    LoadBalancerArn: !Ref ALB
    Port: 443
    Protocol: HTTPS
    Certificates:
      - CertificateArn: !Ref CertificateArn
    DefaultActions:
      - Type: forward
        TargetGroupArn: !Ref WebTargetGroup

WebTargetGroup:
  Type: AWS::ElasticLoadBalancingV2::TargetGroup
  Properties:
    Port: 80
    Protocol: HTTP
    TargetType: ip
    VpcId: !Ref VPC
    HealthCheckPath: /health
    HealthCheckIntervalSeconds: 30
    Matcher:
      HttpCode: "200"

5.3 AWS NLB (Network Load Balancer)

NLB:
  Type: AWS::ElasticLoadBalancingV2::LoadBalancer
  Properties:
    Type: network
    Scheme: internet-facing
    Subnets:
      - !Ref PublicSubnet1
      - !Ref PublicSubnet2

NLBListener:
  Type: AWS::ElasticLoadBalancingV2::Listener
  Properties:
    LoadBalancerArn: !Ref NLB
    Port: 443
    Protocol: TLS
    Certificates:
      - CertificateArn: !Ref CertificateArn
    DefaultActions:
      - Type: forward
        TargetGroupArn: !Ref TCPTargetGroup

TCPTargetGroup:
  Type: AWS::ElasticLoadBalancingV2::TargetGroup
  Properties:
    Port: 443
    Protocol: TLS
    TargetType: ip
    VpcId: !Ref VPC
    HealthCheckProtocol: TCP

---

6. DDoS Mitigation

6.1 Stratégies de mitigation

Diagramme en cours de génération...

6.2 Rate limiting avancé

# Nginx - Multi-level rate limiting
limit_req_zone $binary_remote_addr zone=global:10m rate=100r/s;
limit_req_zone $http_x_forwarded_for zone=perip:10m rate=10r/s;
limit_req_zone $server_name zone=perdomain:10m rate=500r/s;

server {
    location / {
        limit_req zone=global burst=200;
        limit_req zone=perip burst=20 nodelay;
        limit_req zone=perdomain burst=1000 nodelay;
        proxy_pass http://backend;
    }

    location /api/login {
        limit_req zone=login:10m rate=2r/s burst=5;
        proxy_pass http://backend;
    }
}

6.3 AWS Shield

# AWS Shield Advanced
ShieldProtection:
  Type: AWS::Shield::Protection
  Properties:
    ResourceArn: !GetAtt ALB.LoadBalancerArn
    Name: ALB-Shield-Protection

ShieldSubscription:
  Type: AWS::Shield::Subscription
  Properties:
    AutoRenew: Enabled

6.4 BGP Flowspec

route DDoS-MITIGATION {
    match {
        source 203.0.113.0/24;
        protocol tcp;
        destination-port 80;
        packet-length gt 500;
    }
    then {
        rate-limit 0;
    }
}

---

7. WAF — OWASP CRS

7.1 ModSecurity avec CRS

# /etc/nginx/modsec/main.conf
SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess On
SecResponseBodyMimeType text/plain text/html text/xml application/json

# Include CRS
Include /etc/nginx/modsec/crs/crs-setup.conf
Include /etc/nginx/modsec/crs/rules/*.conf

# Custom rule
SecRule REQUEST_URI "@contains /admin" \
    "id:1000,phase:1,t:lowercase,deny,status:403,msg:'Admin area blocked'"

7.2 Paranoia levels

---

8. Bonnes pratiques

8.1 Checklist Firewall

• Politique par défaut : DROP tout
• Règles stateful pour les connexions établies
• Principe du moindre privilège
• Logging des règles de drop
• Revue régulière des règles
• Tests de pénétration réguliers

8.2 Checklist Reverse Proxy

• TLS termination avec certificats valides
• HTTP → HTTPS redirection
• Security headers (HSTS, CSP, X-Frame-Options)
• Rate limiting configuré
• Health checks sur les backends
• Logging des requêtes

8.3 Checklist Load Balancer

• Algorithme adapté au cas d'usage
• Health checks configurés
• Sticky sessions si nécessaire
• Cross-zone load balancing
• Désactivation des serveurs défaillants
• Monitoring des métriques

---

Résumé

Diagramme en cours de génération...