crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[config,firewall_new] On bloque quand on est deconnecté pour virus, on route quelques ip crans depuis le vlan isolement (par exemple, le PXE)

Browse source 
Ignore-this: 1a6f7b2339214b76f71968a0096f5e73

darcs-hash:20121122171458-3a55a-6bd681316cd5496c71f6811f4c5a6eff64f6432b.gz
This commit is contained in:
Valentin Samir 2012-11-22 18:14:58 +01:00
parent b9d816072a
commit 5e83e9aebd
2 changed files with 23 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

32
gestion/gen_confs/firewall_new.py
View file

@ -1141,8 +1141,8 @@ class firewall_komaz(firewall_crans) :
self.anim = anim("\tChaînes BLACKLIST", len(blacklist))
for machine in blacklist:
self.anim.cycle()
rules.append("-A BLACKLIST_DST -d %s -j REJECT --reject-with icmp-host-prohibited" % machine.ip())
rules.append("-A BLACKLIST_SRC -s %s -j REJECT --reject-with icmp-host-prohibited" % machine.ip())
rules.append("-A BLACKLIST_DST -d %s -j REJECT" % machine.ip())
rules.append("-A BLACKLIST_SRC -s %s -j REJECT" % machine.ip())
self.anim.reinit()
print OK
rules.append('COMMIT')
@ -1431,10 +1431,6 @@ class firewall_sable(firewall_redisdead):
def filter_table_tweaks(self) :
iptables("-P INPUT ACCEPT")
iptables("-P FORWARD DROP")
for ip in accueil_route.keys():
for port in accueil_route[ip]:
iptables("-A FORWARD -p tcp -d %s --dport %s -j ACCEPT" % (ip,port))
iptables("-A FORWARD -p tcp -s %s --sport %s -j ACCEPT" % (ip,port))
def mangle_table(self):
iptables("-t mangle -F PREROUTING")
@ -1456,12 +1452,6 @@ class firewall_sable(firewall_redisdead):
if_accueil = "eth0.%d" % vlans["accueil"]
if_isolement = "eth0.%d" % vlans["isolement"]
#intranet et wiki pour le vlan accueil
for ip in accueil_route.keys():
for port in accueil_route[ip]:
iptables("-t nat -A PREROUTING -i eth0.7 -p tcp -d %s --dport %s -j ACCEPT" % (ip,port))
iptables("-t nat -A POSTROUTING -p tcp -s %s -d %s --dport %s -j MASQUERADE" % (NETs['accueil'][0],ip,port))
# Proxy transparent pour le wifi
iptables("-t nat -A PREROUTING -i %s -p tcp --dport 80" %if_defaut +
" -d ! 138.231.136.0/24 -j DNAT --to-destination" +
@ -1585,9 +1575,10 @@ class firewall_routeur(firewall_crans):
iptables("-P INPUT ACCEPT")
iptables("-P FORWARD DROP")
for ip in accueil_route.keys():
for port in accueil_route[ip]:
iptables("-A FORWARD -p tcp -d %s --dport %s -j ACCEPT" % (ip,port))
iptables("-A FORWARD -p tcp -s %s --sport %s -j ACCEPT" % (ip,port))
for type in accueil_route[ip].keys():
for port in accueil_route[ip][type]:
iptables("-A FORWARD -p %s -d %s --dport %s -j ACCEPT" % (type,ip,port))
iptables("-A FORWARD -p %s -s %s --sport %s -j ACCEPT" % (type,ip,port))
def mangle_table(self):
iptables("-t mangle -F PREROUTING")
@ -1596,9 +1587,14 @@ class firewall_routeur(firewall_crans):
def nat_table(self):
#intranet et wiki pour le vlan accueil
for ip in accueil_route.keys():
for port in accueil_route[ip]:
iptables("-t nat -A PREROUTING -i %s -p tcp -d %s --dport %s -j ACCEPT" % (self.eth_accueil ,ip,port))
iptables("-t nat -A POSTROUTING -p tcp -s %s -d %s --dport %s -j MASQUERADE" % (NETs['accueil'][0],ip,port))
for type in accueil_route[ip].keys():
for port in accueil_route[ip][type]:
iptables("-t nat -A PREROUTING -i %s -p %s -d %s --dport %s -j ACCEPT" % (self.eth_accueil ,type,ip,port))
iptables("-t nat -A PREROUTING -i %s -p %s -d %s --dport %s -j ACCEPT" % (self.eth_isolement ,type,ip,port))
iptables("-t nat -A PREROUTING -i %s -p %s -d %s --dport %s -j ACCEPT" % (self.eth_appart ,type,ip,port))
iptables("-t nat -A POSTROUTING -p %s -s %s -d %s --dport %s -j MASQUERADE" % (type,NETs['accueil'][0],ip,port))
iptables("-t nat -A POSTROUTING -p %s -s %s -d %s --dport %s -j MASQUERADE" % (type,NETs['isolement'][0],ip,port))
iptables("-t nat -A POSTROUTING -p %s -s %s -d %s --dport %s -j MASQUERADE" % (type,NETs['personnel-ens'][0],ip,port))
# Proxy transparent pour les vlans isolement et accueil
i=1