[config,firewall] Routage de l'intranet et du wiki sur le vlan accueil

Ignore-this: 945ca164eeedf63ae960bc5a4321040

darcs-hash:20120901105646-3a55a-05e04aa63ffacc1fd37cbf064132d3414aaaf596.gz
This commit is contained in:
Valentin Samir 2012-09-01 12:56:46 +02:00
parent 9670b80322
commit 2c92618905
2 changed files with 22 additions and 3 deletions

View file

@ -37,7 +37,7 @@ from ldap_crans import AssociationCrans, Machine, MachineWifi, BorneWifi
from affich_tools import *
from commands import getstatusoutput
from iptools import AddrInNet, NetSubnets, IpSubnet
from config import NETs, mac_komaz, mac_wifi, mac_titanic, mac_g, conf_fw, p2p, vlans, debit_max_radin, adm_users
from config import NETs, mac_komaz, mac_wifi, mac_titanic, mac_g, conf_fw, p2p, vlans, debit_max_radin, adm_users, accueil_route
from ipset import IpsetError, Ipset
from lc_ldap import lc_ldap
syslog.openlog('firewall')
@ -1354,6 +1354,14 @@ class firewall_vert(firewall_crans) :
class firewall_sable(firewall_redisdead):
"""Comme pour rouge, avec le proxy transparent en plus"""
def filter_table_tweaks(self) :
iptables("-P INPUT ACCEPT")
iptables("-P FORWARD DROP")
for ip in accueil_route.keys():
for port in accueil_route[ip]:
iptables("-A FORWARD -p tcp -d %s --dport %s -j ACCEPT" % (ip,port))
iptables("-A FORWARD -p tcp -s %s --sport %s -j ACCEPT" % (ip,port))
def mangle_table(self):
iptables("-t mangle -F PREROUTING")
@ -1375,6 +1383,12 @@ class firewall_sable(firewall_redisdead):
if_accueil = "eth0.%d" % vlans["accueil"]
if_isolement = "eth0.%d" % vlans["isolement"]
#intranet et wiki pour le vlan accueil
for ip in accueil_route.keys():
for port in accueil_route[ip]:
iptables("-t nat -A PREROUTING -i eth0.7 -p tcp -d %s --dport %s -j ACCEPT" % (ip,port))
iptables("-t nat -A POSTROUTING -p tcp -s %s -d %s --dport %s -j MASQUERADE" % (NETs['accueil'][0],ip,port))
# Proxy transparent pour le wifi
iptables("-t nat -A PREROUTING -i %s -p tcp --dport 80" %if_defaut +
" -d ! 138.231.136.0/24 -j DNAT --to-destination" +