crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[./gestion/gen_confs/firewall.py] Un "iptables -F OUTPUT" un peu trop violent

Browse source 
Avant, le VLAN adm devenait accessible pour tous ds que le firewall tait mis  jour par la blacklist.

darcs-hash:20100825105046-c8775-1611de7c2dc8be31128cb2ae1adfabdc8d5adeef.gz
This commit is contained in:
Nicolas Bruot 2010-08-25 12:50:46 +02:00
parent a2bf671bc7
commit dccb933910
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
gestion/gen_confs/firewall.py
View file

@ -1118,6 +1118,12 @@ class firewall_zamok(firewall_crans) :
"""Fondamentalement, bloque l'accès internet sur zamok aux
adhérents sanctionnés"""
iptables("-F OUTPUT")
# Règles OUTPUT de nat_table() à remettre en place
iptables("-t filter -A OUTPUT -o lo -j ACCEPT")
iptables("-t filter -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT")
iptables("-t filter -A OUTPUT -o %s -j SERV_OUT_ADM" % self.eth_adm)
self.filter_table()
blacklist_sanctions = ('upload', 'warez', 'p2p', 'autodisc_p2p', 'autodisc_upload', 'bloq')