crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[ipt,firewall6] Ajout blacklist pour carte etudiant et chambre invalide, on accepte les icmp NDP en output/input pour pouvoir envoyer des REJECT

Browse source 
Ignore-this: 58ba4a92e7be972ba8db8a4819df9174

darcs-hash:20121104152928-3a55a-5f42ca802a7c0016e5931dcdc1281f60a860da2d.gz
This commit is contained in:
Valentin Samir 2012-11-04 16:29:28 +01:00
parent c71900a5ba
commit 327689a051
3 changed files with 16 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

9
gestion/gen_confs/firewall6.py
View file

@ -88,6 +88,12 @@ def basic_fw():
''' Met en place un firewall de base commun à tous les serveurs'''
# On rejete les ra.
ip6tables.filter.input('-p icmpv6 -m icmp6 --icmpv6-type router-advertisement -j REJECT')
# On accepte NDP sauf les RA, sinon, les REJECT ne fonctionnent pas
for icmpv6 in ['neighbour-solicitation','neighbour-advertisement','redirect','router-solicitation']:
ip6tables.filter.input('-p icmpv6 -m icmp6 --icmpv6-type %s -j ACCEPT' % icmpv6)
ip6tables.filter.output('-p icmpv6 -m icmp6 --icmpv6-type %s -j ACCEPT' % icmpv6)
# On ne vérifie rien sur les ip qui ne sont pas dans notre prefix
ip6tables.filter.ieui64('! -s %s -j RETURN' % prefix['subnet'][0])
@ -138,7 +144,8 @@ def main_router():
# Alternative : flusher la table conntrack des entrées concernant cette
# machine.
blacklist(ip6tables)
ip6tables.filter.forward('-o %s -j BLACKLIST_SRC' % dev_ip6)
ip6tables.filter.forward('-i %s -j BLACKLIST_SRC' % dev_crans)
#~ ip6tables.filter.forward('-o %s -j BLACKLIST_SRC' % dev_ip6)
ip6tables.filter.forward('-i %s -j BLACKLIST_DST' % dev_ip6)
ip6tables.filter.tracker_torrent('-m string --algo kmp ! --string "info_hash=" -j ACCEPT')