crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[firewall_new] On bloque le débit à debit_max dès le début du reboot du firewall

Browse source 
darcs-hash:20120104125216-3a55a-8b823fa6ff3194eb9580da0f036279696c9bb8be.gz
This commit is contained in:
Valentin Samir 2012-01-04 13:52:16 +01:00
parent 3568566340
commit 81f9ae2c9e
1 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
gestion/gen_confs/firewall_new.py
View file

@ -514,7 +514,7 @@ class firewall_komaz(firewall_crans) :
# On marque les paquets bittorrent uniquement # On marque les paquets bittorrent uniquement
iptables("-t mangle -A PREROUTING -p tcp -j CONNMARK --restore-mark") iptables("-t mangle -A PREROUTING -p tcp -j CONNMARK --restore-mark")
iptables("-t mangle -A PREROUTING -p tcp -m mark ! --mark 0x0 -j ACCEPT") #iptables("-t mangle -A PREROUTING -p tcp -m mark ! --mark 0x0 -j ACCEPT")
iptables("-t mangle -A PREROUTING -p tcp -m ipp2p --bit " iptables("-t mangle -A PREROUTING -p tcp -m ipp2p --bit "
"-j MARK --set-mark %s" % mark) "-j MARK --set-mark %s" % mark)
iptables("-t mangle -A PREROUTING -p tcp -m mark --mark %s " iptables("-t mangle -A PREROUTING -p tcp -m mark --mark %s "
@ -571,6 +571,11 @@ class firewall_komaz(firewall_crans) :
tc("qdisc add dev %(interface)s parent 1:9997 " tc("qdisc add dev %(interface)s parent 1:9997 "
"handle 9997: sfq perturb 10" % locals()) "handle 9997: sfq perturb 10" % locals())
tc("class add dev %(interface)s parent 1:1 classid 1:9998 "
"htb rate %(debit_adh)skbps ceil %(debit_max)skbps" % locals())
tc("qdisc add dev %(interface)s parent 1:9998 "
"handle 9998: sfq perturb 10" % locals())
# On construit ensuite les classes et qdisc pour chaque adhérent # On construit ensuite les classes et qdisc pour chaque adhérent
for adherent in adherents: for adherent in adherents:
self.anim.cycle() self.anim.cycle()
@ -690,8 +695,8 @@ class firewall_komaz(firewall_crans) :
# Proxy transparent, pour les deconnexion soft # Proxy transparent, pour les deconnexion soft
iptables("-I FORWARD -m mark --mark %s -j ACCEPT" % conf_fw.mark['proxy']) iptables("-I FORWARD -m mark --mark %s -j ACCEPT" % conf_fw.mark['proxy'])
iptables('-I FORWARD -o ens -m state --state NEW -j LOG --log-prefix "LOG_ALL "') iptables('-I FORWARD -o %s -m state --state NEW -j LOG --log-prefix "LOG_ALL "' % self.eth_ext)
iptables('-I FORWARD -i ens -m state --state NEW -j LOG --log-prefix "LOG_ALL "') iptables('-I FORWARD -i %s -m state --state NEW -j LOG --log-prefix "LOG_ALL "' % self.eth_ext)
print OK print OK