crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[firewall4/komaz] On ne laisse pas passer l'icmp vers les réseaux non routables

Browse source
This commit is contained in:
Valentin Samir 2013-12-14 00:10:42 +01:00
parent 4e33352623
commit 171912a1e0
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
gestion/gen_confs/firewall4/komaz.py
View file

@ -96,6 +96,7 @@ class firewall(base.firewall_routeur):
chain = 'FORWARD' chain = 'FORWARD'
self.flush(table, chain) self.flush(table, chain)
self.add(table, chain, '-i lo -j ACCEPT') self.add(table, chain, '-i lo -j ACCEPT')
self.add(table, chain, '-j %s' % self.reseaux_non_routable(table, fill_ipset=True))
self.add(table, chain, '-p icmp -j ACCEPT') self.add(table, chain, '-p icmp -j ACCEPT')
self.add(table, chain, '-j %s' % self.admin_vlan(table)) self.add(table, chain, '-j %s' % self.admin_vlan(table))
self.add(table, chain, '-j %s' % blacklist_soft_chain) self.add(table, chain, '-j %s' % blacklist_soft_chain)
@ -103,7 +104,6 @@ class firewall(base.firewall_routeur):
self.add(table, chain, '-o %s -j %s' % (dev['out'], blacklist_hard_chain)) self.add(table, chain, '-o %s -j %s' % (dev['out'], blacklist_hard_chain))
self.add(table, chain, '-m state --state RELATED,ESTABLISHED -j ACCEPT') self.add(table, chain, '-m state --state RELATED,ESTABLISHED -j ACCEPT')
self.add(table, chain, '-j %s' % self.tunnel_6in4(table)) self.add(table, chain, '-j %s' % self.tunnel_6in4(table))
self.add(table, chain, '-j %s' % self.reseaux_non_routable(table, fill_ipset=True))
for net in base.config.NETs['all'] + base.config.NETs['adm'] + base.config.NETs['personnel-ens']: for net in base.config.NETs['all'] + base.config.NETs['adm'] + base.config.NETs['personnel-ens']:
self.add(table, chain, '-s %s -j %s' % (net, mac_ip_chain)) self.add(table, chain, '-s %s -j %s' % (net, mac_ip_chain))
self.add(table, chain, '-j %s' % self.connexion_secours(table)) self.add(table, chain, '-j %s' % self.connexion_secours(table))