crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[firewall6] Lisibilité

Browse source 
Ignore-this: f731deeafe8c377076893bfd108ebf75

darcs-hash:20110507164030-ffbb2-31cc00e9b596456a5f0be7d15b466ff2b4973c91.gz
This commit is contained in:
Nicolas Dandrimont 2011-05-07 18:40:30 +02:00
parent 7b206af71c
commit 3cb768bfaf
1 changed files with 11 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

32
gestion/gen_confs/firewall6.py
View file

@ -33,7 +33,7 @@ from ipt import *
ip6tables = Ip6tables()
def aide():
''' Affiche l'aide pour utiliser le script'''
""" Affiche l'aide pour utiliser le script"""
print """
Usage:
%(script)s start : Démarrage du firewall
@ -63,14 +63,12 @@ def ports(dev_ip6, dev_crans):
# ip6tables.filter.forward('-i %s -p tcp --dport ssh -m state --state NEW \
#-j ACCEPT' % dev_ip6)
for proto in open_ports.keys():
ip6tables.filter.forward('-i %s -p %s -m multiport --dports %s -j \
ACCEPT' % (dev_ip6, proto, open_ports[proto]))
ip6tables.filter.forward('-i %s -p %s -m multiport --dports %s -j ACCEPT' % (dev_ip6, proto, open_ports[proto]))
for type_machine in ['fil', 'fil-v6', 'wifi', 'wifi-v6']:
ip6tables.filter.forward('-i %s -d %s -j %s' % (dev_ip6,
prefix[dprefix[type_machine]][0], 'EXT' + re.sub('-', '',
type_machine.upper())))
eval('ip6tables.filter.ext' + re.sub('-', '', type_machine))('-j \
REJECT --reject-with icmp6-port-unreachable')
eval('ip6tables.filter.ext' + re.sub('-', '', type_machine))('-j REJECT --reject-with icmp6-port-unreachable')
# Port ouvert CRANS->EXT
ip6tables.filter.forward('-i %s -p udp -m multiport --dports 0:136,140:65535 -j ACCEPT' % dev_crans)
@ -81,8 +79,7 @@ REJECT --reject-with icmp6-port-unreachable')
ip6tables.filter.forward('-i %s -s %s -j %s' % (dev_crans,
prefix[dprefix[type_machine]][0], 'CRANS' + re.sub('-', '',
type_machine.upper())))
eval('ip6tables.filter.crans' + re.sub('-', '', type_machine))('-j \
REJECT --reject-with icmp6-port-unreachable')
eval('ip6tables.filter.crans' + re.sub('-', '', type_machine))('-j REJECT --reject-with icmp6-port-unreachable')
@ -90,8 +87,7 @@ REJECT --reject-with icmp6-port-unreachable')
def basic_fw():
''' Met en place un firewall de base commun à tous les serveurs'''
# On rejete les ra.
ip6tables.filter.input('-p icmpv6 -m icmp6 --icmpv6-type \
router-advertisement -j DROP')
ip6tables.filter.input('-p icmpv6 -m icmp6 --icmpv6-type router-advertisement -j DROP')
# On ne vérifie rien sur les ip qui ne sont pas dans notre prefix
ip6tables.filter.ieui64('! -s %s -j RETURN' % prefix['subnet'][0])
@ -137,8 +133,7 @@ def main_router():
ip6tables.filter.forward('-o %s -j BLACKLIST_SRC' % dev_ip6)
ip6tables.filter.forward('-i %s -j BLACKLIST_DST' % dev_ip6)
ip6tables.filter.forward('-m conntrack --ctstate RELATED,ESTABLISHED -j \
ACCEPT')
ip6tables.filter.forward('-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT')
# On filtre les réseaux non routable et aussi on accepte en entrée
# que les paquets dont la source n'est pas notre plage, pour éviter
@ -159,13 +154,11 @@ ACCEPT')
# Rien ne passe vers adm
# est ce que du local est gêné par le règle ?
ip6tables.filter.forward('-d %s -j REJECT --reject-with \
icmp6-addr-unreachable' % (prefix['adm'][0]))
ip6tables.filter.forward('-d %s -j REJECT --reject-with icmp6-addr-unreachable' % (prefix['adm'][0]))
# on accepte les ping
for icmpv6 in authorized_icmpv6:
ip6tables.filter.forward('-p icmpv6 -m icmp6 --icmpv6-type %s -j \
ACCEPT' % icmpv6)
ip6tables.filter.forward('-p icmpv6 -m icmp6 --icmpv6-type %s -j ACCEPT' % icmpv6)
ip6tables.filter.forward('-p icmpv6 -j DROP')
# cf https://www.sixxs.net/faq/connectivity/?faq=filters
@ -188,8 +181,7 @@ def wifi_router():
dev_wifi = iface6('wifi')
# Stop aux RA
ip6tables.filter.forward('-p icmpv6 -m icmp6 --icmpv6-type \
router-advertisement -j DROP')
ip6tables.filter.forward('-p icmpv6 -m icmp6 --icmpv6-type router-advertisement -j DROP')
# Un peu moche, mais il faut supprimer les dernière règles dans IEUI64
# avant de rajouter la règle pour les machines wifi.
@ -206,8 +198,7 @@ router-advertisement -j DROP')
% prefix[type_m][0])
ip6tables.filter.feui64('-j DROP')
ip6tables.filter.forward('-m conntrack --ctstate RELATED,ESTABLISHED -j \
ACCEPT')
ip6tables.filter.forward('-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT')
ip6tables.filter.forward('-j MAC')
ip6tables.filter.forward('-j FEUI64')
@ -224,8 +215,7 @@ def adherents_server():
dev_adm = iface6('adm')
# On fait attention à ce qui sort
ip6tables.filter.output('-i lo -j ACCEPT')
ip6tables.filter.output('-m conntrack --ctstate RELATED,ESTABLISHED -j \
ACCEPT')
ip6tables.filter.output('-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT')
ip6tables.filter.output('-i %s -j SRV_OUT_ADM', dev_adm)
# Chaîne SRV_OUT_ADM