crans/crans_bcfg2
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

modif de la configuration du vpn

Browse source 
darcs-hash:20080304101425-c41ad-4f97a48603ced904c058b497a7f933f72889b0ae.gz
This commit is contained in:
Jeremie Dimino 2008-03-04 11:14:25 +01:00
parent da3beef473
commit 71ea3f7535
20 changed files with 85 additions and 141 deletions
Download patch file Download diff file Expand all files Collapse all files

17
Bundler/openvpn.xml
View file

@ -3,17 +3,12 @@
<Service name="openvpn"/>
<ConfigFile name="/etc/default/openvpn"/>
<Group name="external">
<ConfigFile name="/etc/openvpn/main.conf"/>
<ConfigFile name="/etc/openvpn/rescue.conf"/>
<ConfigFile name="/etc/openvpn/main.up"/>
<ConfigFile name="/etc/openvpn/main.down"/>
<ConfigFile name="/etc/openvpn/rescue.up"/>
<ConfigFile name="/etc/openvpn/rescue.down"/>
<ConfigFile name="/etc/openvpn/komaz.conf"/>
<ConfigFile name="/etc/openvpn/freebox.conf"/>
</Group>
<Group name="connection-main">
<ConfigFile name="/etc/openvpn/external.conf"/>
</Group>
<Group name="connection-rescue">
<ConfigFile name="/etc/openvpn/external.conf"/>
<Group name="external" negate="true">
<ConfigFile name="/etc/openvpn/ovh.conf"/>
<ConfigFile name="/etc/openvpn/ovh.connect"/>
<ConfigFile name="/etc/openvpn/ovh.disconnect"/>
</Group>
</Bundle>

3
Cfg/etc/openvpn/main.down/info.xml
View file

@ -1,3 +0,0 @@
<FileInfo>
<Info owner='root' group='root' perms='0755'/>
</FileInfo>

11
Cfg/etc/openvpn/main.down/main.down
View file

@ -1,11 +0,0 @@
#!/bin/bash
#
# Fichier gere par BCfg2 avec le plugin Cfg
#
# Configuration des routes lorsque la connexion principale tombe
# La connexion principale est inactive => on passe par la connexion de
# secours. Si la connexion de secours est down ne marche pas ça
# changera rien mais de toutes facons on peut pas faire mieux...
route del -net 10.231.136.0 netmask 255.255.255.0 &> /dev/null
route add -net 10.231.136.0 netmask 255.255.255.0 dev tun-rescue

3
Cfg/etc/openvpn/main.up/info.xml
View file

@ -1,3 +0,0 @@
<FileInfo>
<Info owner='root' group='root' perms='0755'/>
</FileInfo>

10
Cfg/etc/openvpn/main.up/main.up
View file

@ -1,10 +0,0 @@
#!/bin/bash
#
# Fichier gere par BCfg2 avec le plugin Cfg
#
# Configuration des routes lorsque la connexion principale est
# disponible
# La connexion principale est active => on l'utilise
route del -net 10.231.136.0 netmask 255.255.255.0 &> /dev/null
route add -net 10.231.136.0 netmask 255.255.255.0 dev $dev

28
Cfg/etc/openvpn/ovh.conf/ovh.conf Normal file
View file

@ -0,0 +1,28 @@
# Fichier gere par BCfg2 avec le plugin Cfg
#
# Configuration du vpn entre komaz/titanic et ovh
daemon tun-ovh
dev tun-ovh
tls-server
ca /etc/ssl/certs/root.pem
cert /etc/ssl/certs/vpn.pem
tls-verify "/usr/share/openvpn/verify-cn ovh.vpn.crans.org"
key /etc/ssl/private/vpn.pem
log-append /var/log/openvpn/ovh.log
port 1194
# Du côté crans, le vpn reste toujours actif
keepalive 15 45
persist-tun
verb 3
dh /etc/openvpn/dh1024.pem
# Configuration du réseau lorsque ovh se connecte
client-connect /etc/openvpn/ovh.connect
client-disconnect /etc/openvpn/ovh.disconnect

3
Cfg/etc/openvpn/ovh.connect/info.xml Normal file
View file

@ -0,0 +1,3 @@
<FileInfo>
<Info owner='root' group='root' perms='0755' encoding='base64'/>
</FileInfo>

15
Cfg/etc/openvpn/ovh.connect/ovh.connect Executable file
View file

@ -0,0 +1,15 @@
#!/bin/bash
#
# Fichier gere par BCfg2 avec le plugin Cfg
#
# Configuration lorsque ovh se connecte via se point du reseau (komaz
# ou titanic)
iface=$(route -n|awk '$1 == "10.231.136.0" {print $8}')
my_ip=$(ip addr show dev $iface|awk '$1 == "inet" {sub("/.*", "", $2); print $2}')
ovh_ip=10.231.136.8
ip addr add $my_ip peer $ovh_ip/32 dev $iface
ip link set up dev $iface
ip neigh add proxy $ovh_ip dev $iface

3
Cfg/etc/openvpn/ovh.disconnect/info.xml Normal file
View file

@ -0,0 +1,3 @@
<FileInfo>
<Info owner='root' group='root' perms='0755' encoding='base64'/>
</FileInfo>

11
Cfg/etc/openvpn/ovh.disconnect/ovh.disconnect Executable file
View file

@ -0,0 +1,11 @@
#!/bin/bash
#
# Fichier gere par BCfg2 avec le plugin Cfg
#
# Configuration lorsque la connexion avec ovh est perdue
iface=$(route -n|awk '$1 == "10.231.136.0" {print $8}')
ovh_ip=10.231.136.8
ip neigh del proxy $ovh_ip dev $iface
ip link set down dev $iface

3
Cfg/etc/openvpn/rescue.down/info.xml
View file

@ -1,3 +0,0 @@
<FileInfo>
<Info owner='root' group='root' perms='0755'/>
</FileInfo>

10
Cfg/etc/openvpn/rescue.down/rescue.down
View file

@ -1,10 +0,0 @@
#!/bin/bash
#
# Fichier gere par BCfg2 avec le plugin Cfg
#
# Configuration des routes lorsque la connexion de secours tombe
# Si c'était la route actuelle, alors tant pis...
if [ "$(route -n|awk '$1 == "$ifconfig_remote" {print $8}')" = "$dev" ]; then
route del -net 10.231.136.0 netmask 255.255.255.0 &> /dev/null
fi

3
Cfg/etc/openvpn/rescue.up/info.xml
View file

@ -1,3 +0,0 @@
<FileInfo>
<Info owner='root' group='root' perms='0755'/>
</FileInfo>

11
Cfg/etc/openvpn/rescue.up/rescue.up
View file

@ -1,11 +0,0 @@
#!/bin/bash
#
# Fichier gere par BCfg2 avec le plugin Cfg
#
# Configuration des routes lorsque la connexion de secours est
# disponible
# Si on a déjà une route vers le vlan adm alors on ne fait rien
if [ -z "$(route -n|awk '$1 == "$ifconfig_remote" {print $8}')" ]; then
route add -net 10.231.136.0 netmask 255.255.255.0 dev $dev
fi

4
Python/etc/default/openvpn
View file

@ -3,6 +3,6 @@
header("Configuration des tunnels a lancer par defauts")
if has("external"):
@AUTOSTART = "main rescue"
@AUTOSTART="komaz"
else:
@AUTOSTART = "external"
@AUTOSTART="ovh"

30
Python/etc/openvpn/external.conf
View file

@ -1,30 +0,0 @@
# -*- coding: utf-8; mode: python -*-
include("ip")
header("Configuration du tunnel vers les serveurs a 'exterieur")
print """
daemon tun-ovh
dev tun-ovh
tls-server
ca /etc/ssl/certs/root.pem
cert /etc/ssl/certs/vpn.pem
tls-verify "/usr/share/openvpn/verify-cn ovh.vpn.crans.org"
key /etc/ssl/private/vpn.pem
log-append /var/log/openvpn/external.log
port 1194
ifconfig %s %s
ping-timer-rem
keepalive 10 60
persist-tun
verb 3
dh /etc/openvpn/dh1024.pem
""" % (admipof("komaz"), admipof("ovh"))

5
Python/etc/openvpn/freebox.conf Normal file
View file

@ -0,0 +1,5 @@
# -*- coding: utf-8; mode: python -*-
remote_vpn="titanic"
remote="freebox"
dump("template/openvpn")

4
Python/etc/openvpn/komaz.conf Normal file
View file

@ -0,0 +1,4 @@
# -*- coding: utf-8; mode: python -*-
remote="komaz"
dump("template/openvpn")

35
Python/etc/openvpn/rescue.conf
View file

@ -1,35 +0,0 @@
# -*- coding: utf-8; mode: python -*-
include("ip")
header("Configuration du tunnel vers la connexion principale")
print """
daemon tun-rescue
dev tun-rescue
tls-server
ca /etc/ssl/certs/root.pem
cert /etc/ssl/certs/vpn.pem
tls-verify "/usr/share/openvpn/verify-cn freebox.vpn.crans.org"
key /etc/ssl/private/vpn.pem
log-append /var/log/openvpn/rescue.log
port 1194
ifconfig %s %s
ping-timer-rem
keepalive 10 60
persist-tun
verb 3
dh /etc/openvpn/dh1024.pem
up /etc/openvpn/up
down /etc/openvpn/down
up-restart
remote %s
""" % (admipof("ovh"), admipof("komaz"), pubipof("freebox"))

17
Python/etc/openvpn/main.conf → etc/python/template/openvpn.py
View file

@ -1,8 +1,6 @@
# -*- coding: utf-8; mode: python -*-
include("ip")
header("Configuration du tunnel vers la connexion principale")
header("Configuration du tunnel entre %s et %s" %s (hostname, remote))
print """
daemon tun-main
@ -14,11 +12,12 @@ cert /etc/ssl/certs/vpn.pem
tls-verify "/usr/share/openvpn/verify-cn komaz.vpn.crans.org"
key /etc/ssl/private/vpn.pem
log-append /var/log/openvpn/main.log
log-append /var/log/openvpn/%s.log
port 1194
ifconfig %s %s
ifconfig %(local)s %(remote_vpn)s
route 10.231.136.0 255.255.255.0 vpn_gateway
ping-timer-rem
keepalive 10 60
@ -27,9 +26,9 @@ persist-tun
verb 3
dh /etc/openvpn/dh1024.pem
up /etc/openvpn/up
down /etc/openvpn/down
up-restart
remote %s
""" % (admipof("ovh"), admipof("komaz"), pubipof("komaz"))
""" % (remote,
admipof("ovh"),
admipof(remote_vpn or remote),
pubipof(remote))