crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Nouveaux vlan ADM

Browse source 
+ on laisse passer les IP en 10.231.136.* avant de lire les chaines
non routables

darcs-hash:20070830211938-c3cc4-26b5ee96d0ce970d9ff89fa9fc9449d651bee22e.gz
This commit is contained in:
dubost 2007-08-30 23:19:38 +02:00
parent d532767298
commit 826d00d26a
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
gestion/gen_confs/firewall.py
View file

@ -483,6 +483,8 @@ class firewall_komaz(firewall_crans) :
def reseaux_non_routables(self) : def reseaux_non_routables(self) :
""" Construction de RESEAUX_NON_ROUTABLES_{DST,SRC} """ """ Construction de RESEAUX_NON_ROUTABLES_{DST,SRC} """
self.anim = anim('\tFiltrage ip non routables',len(self.liste_reseaux_non_routables)) self.anim = anim('\tFiltrage ip non routables',len(self.liste_reseaux_non_routables))
iptables("-t nat -A RESEAUX_NON_ROUTABLES_DST -d 10.231.136.0/24 -j RETURN")
iptables("-t nat -A RESEAUX_NON_ROUTABLES_SRC -d 10.231.136.0/24 -j RETURN")
for reseau in self.liste_reseaux_non_routables : for reseau in self.liste_reseaux_non_routables :
iptables("-t nat -A RESEAUX_NON_ROUTABLES_DST -d %s -j DROP" % reseau) iptables("-t nat -A RESEAUX_NON_ROUTABLES_DST -d %s -j DROP" % reseau)
iptables("-t nat -A RESEAUX_NON_ROUTABLES_SRC -s %s -j DROP" % reseau) iptables("-t nat -A RESEAUX_NON_ROUTABLES_SRC -s %s -j DROP" % reseau)
@ -618,7 +620,7 @@ class firewall_komaz(firewall_crans) :
# Proxy transparent # Proxy transparent
iptables("-t nat -A PREROUTING -p tcp -m mark --mark %s " % conf_fw.mark['proxy'] + iptables("-t nat -A PREROUTING -p tcp -m mark --mark %s " % conf_fw.mark['proxy'] +
"-j DNAT --to-destination 138.231.144.10:3128") "-j DNAT --to-destination 10.231.136.10:3128")
print OK print OK
def filter_table_tweaks(self) : def filter_table_tweaks(self) :
@ -1150,7 +1152,7 @@ class firewall_sila(firewall_rouge):
# Pour le proxy transparent # Pour le proxy transparent
iptables("-t mangle -F PREROUTING") iptables("-t mangle -F PREROUTING")
iptables("-t mangle -i crans.2 -A PREROUTING -p tcp --destination-port 3128 " + iptables("-t mangle -i crans.2 -A PREROUTING -p tcp --destination-port 3128 " +
"--destination 138.231.144.10 " + "--destination 10.231.136.10 " +
"-m mac --mac-source %s " % mac_komaz + "-m mac --mac-source %s " % mac_komaz +
"-j MARK --set-mark %s" % conf_fw.mark['proxy']) "-j MARK --set-mark %s" % conf_fw.mark['proxy'])
iptables("-t mangle -A PREROUTING -m mark --mark %s -j ACCEPT" % conf_fw.mark['proxy']) iptables("-t mangle -A PREROUTING -m mark --mark %s -j ACCEPT" % conf_fw.mark['proxy'])