crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[firewall4] Passage dans filtrage_ports uniquement en entrée et sortie du réseau crans

Browse source
This commit is contained in:
Valentin Samir 2013-06-14 13:05:07 +02:00
parent 9d4f8a2d73
commit e44c44f7d6
1 changed files with 2 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
gestion/gen_confs/firewall4.py
View file

@ -552,7 +552,8 @@ class firewall_komaz(firewall_base_routeur):
self.add(table, chain, '-j %s' % self.connexion_appartement(table)) self.add(table, chain, '-j %s' % self.connexion_appartement(table))
self.add(table, chain, '-j %s' % self.ingress_filtering(table)) self.add(table, chain, '-j %s' % self.ingress_filtering(table))
self.add(table, chain, '-j %s' % self.limit_ssh_connexion(table)) self.add(table, chain, '-j %s' % self.limit_ssh_connexion(table))
self.add(table, chain, '-j %s' % self.filtrage_ports(table)) self.add(table, chain, '-i %s -j %s' % (dev['out'], self.filtrage_ports(table)))
self.add(table, chain, '-o %s -j %s' % (dev['out'], self.filtrage_ports(table)))
return return
def nat_table(self): def nat_table(self):
@ -873,9 +874,6 @@ class firewall_komaz(firewall_base_routeur):
if config.firewall.ports_default[proto]['input']: if config.firewall.ports_default[proto]['input']:
self.add(table, chain, '-p %s -d %s -m multiport --dports %s -j RETURN' % (proto, net, ','.join( format_port(port) for port in config.firewall.ports_default[proto]['input']))) self.add(table, chain, '-p %s -d %s -m multiport --dports %s -j RETURN' % (proto, net, ','.join( format_port(port) for port in config.firewall.ports_default[proto]['input'])))
# TODO faire un truc plus propre (config.py ?) -- b2moo
# syslog et https
self.add(table, chain, '-p udp -s 138.231.148.0/24 -m multiport --dports 443,514 -j RETURN')
for machine in self.machines(): for machine in self.machines():
for ip in machine['ipHostNumber']: for ip in machine['ipHostNumber']:
if 'portTCPout' in machine.attrs.keys(): if 'portTCPout' in machine.attrs.keys():