crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

https pour le vlan radin

Browse source 
darcs-hash:20081009224428-af139-8db4ab7a4b52bc3cccfd4b3ed5a0ae9148679410.gz
This commit is contained in:
Jeremie Dimino 2008-10-10 00:44:28 +02:00
parent 0152143fca
commit 6118c45e22
2 changed files with 35 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

3
gestion/config.py
View file

@ -252,7 +252,8 @@ Les membres actifs du Crans"""
# Classe pour les paramètres du firewall #
##########################################
class conf_fw:
mark = { 'proxy' : '0x2',
mark = { 'https-radin': '0x3',
'proxy' : '0x2',
'bittorrent' : '0x1' }
# Valeur du masque utilisé pour créer un arbre dans les filtres

40
gestion/gen_confs/firewall.py
View file

@ -521,6 +521,12 @@ class firewall_komaz(firewall_crans) :
eth_ext = self.eth_ext
eth_int = self.eth_int
# Classification du traffic : extérieur <-> ftp
iptables("-t mangle -A POSTROUTING -o %(eth_int)s -d 136.231.136.10 "
"-j CLASSIFY --set-class 1:9997" % locals())
iptables("-t mangle -A POSTROUTING -o %(eth_ext)s -s 136.231.136.10 "
"-j CLASSIFY --set-class 1:9997" % locals())
# On ne va pas plus loin si il ne s'agit pas de bittorrent
iptables("-t mangle -A POSTROUTING -m mark ! --mark %s -j ACCEPT" % mark)
@ -575,6 +581,11 @@ class firewall_komaz(firewall_crans) :
"htb rate %(debit_adh)s ceil %(debit_adh)s" % locals())
tc("qdisc add dev %(interface)s parent 1:9999 "
"handle 9999: sfq perturb 10" % locals())
debit_ftp = 1000
tc("class add dev %(interface)s parent 1:1 classid 1:9997 "
"htb rate %(debit_ftp)s ceil %(debit_ftp)s" % locals())
tc("qdisc add dev %(interface)s parent 1:9997 "
"handle 9997: sfq perturb 10" % locals())
# On construit ensuite les classes et qdisc pour chaque adhérent
for adherent in adherents:
@ -1165,6 +1176,25 @@ class firewall_sable(firewall_rouge):
"-j MARK --set-mark %s" % conf_fw.mark['proxy'])
iptables("-t mangle -A PREROUTING -m mark --mark %s -j ACCEPT" % conf_fw.mark['proxy'])
# On marque les paquets venant du vlan radin vers de l'https
# pour qu'ils soient nattés
iptables("-t mangle -A PREROUTING -i eth0.%d -p tcp -m tcp --dport 443 -j MARK --set-mark %s" %
(vlans["radin"], conf_fw.mark["https-radin"]))
def filter_table(self):
iptables("-t filter -F")
if_radin = "eth0.%d" % vlans["radin"]
# forward pour le https pour le vlan radin
iptables("-t filter -A FORWARD -i %s -p tcp -m tcp --dport 443 -j ACCEPT" % if_radin)
iptables("-t filter -A FORWARD -o %s -p tcp -m tcp --sport 443 -j ACCEPT" % if_radin)
def nat_table(self):
firewall_rouge.nat_table(self)
# Pour le proxy transparent
iptables("-t nat -I PREROUTING -i eth0.2 -m mark --mark %s -j ACCEPT" % conf_fw.mark['proxy'])
if_defaut = "eth0"
if_radin = "eth0.%d" % vlans["radin"]
if_accueil = "eth0.%d" % vlans["accueil"]
@ -1175,20 +1205,14 @@ class firewall_sable(firewall_rouge):
iptables("-t nat -i %s -A PREROUTING -p tcp --destination-port 3128 -j ACCEPT" % interface)
iptables("-t nat -i %s -A PREROUTING -p tcp --destination-port 443 -j ACCEPT" % interface)
iptables("-i %s -A FORWARD -p tcp --destination-port 443 -j ACCEPT" % if_radin)
iptables("-o %s -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT" % if_radin)
iptables("-t nat -o %s -A POSTROUTING -p tcp --destination-port 443 -j MASQUERADE" % if_radin)
# Nat pour le https sur le vlan radin
iptables("-t nat -A POSTROUTING -m mark --mark %s -j MASQUERADE" % conf_fw.mark["https-radin"])
# Limite de débit sur le vlan radin
tc("qdisc del dev %s root" % if_radin)
tc("qdisc add dev %s root htb" % if_radin)
tc("class add dev %s root htb rate %d ceil %d" % (if_radin, debit_max_radin, debit_max_radin))
def nat_table(self):
firewall_rouge.nat_table(self)
# Pour le proxy transparent
iptables("-t nat -I PREROUTING -i eth0.2 -m mark --mark %s -j ACCEPT" % conf_fw.mark['proxy'])
firewall_bleu = firewall_zamok
if __name__ == '__main__' :