crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[firewall_new] On fixe le MSS TCP sur appartement, crans et ens en fonction de la MTU du lien

Browse source 
Ignore-this: ccb0455afc0cd9aa9b1686b555d934f

darcs-hash:20121218170003-3a55a-9dfbbca5af6e46a00f37c3a086a3043fd457ca52.gz
This commit is contained in:
Valentin Samir 2012-12-18 18:00:03 +01:00
parent e15ee23577
commit ed432829f1
1 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

12
gestion/gen_confs/firewall_new.py
View file

@ -237,11 +237,11 @@ class firewall_crans :
self.exception_catcher(self.filter_table)
self.exception_catcher(self.filter_table_tweaks)
# On peux router, on a besoin d'internet pour la suite
self.post_start_hook()
# Remplissage
self.start_fw_funcs()
# On peux router
self.post_start_hook()
cprint(u"\t -> fin de la procédure de démarrage",'vert')
def stop(self):
@ -764,12 +764,14 @@ class firewall_komaz(firewall_crans) :
'BLACKLIST_DST' , 'FILTRE_P2P', 'INGRESS_FILTERING',
'TEST_VIRUS_FLOOD', 'LOG_VIRUS', 'LOG_FLOOD','LOG_TRACKER','TRACKER_FILTER' ] :
iptables('-N %s' % chaine)
iptables("-A FORWARD -i ens -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu")
iptables("-A FORWARD -i crans -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu")
iptables("-A FORWARD -i %s -j BLACKLIST_DST" % self.eth_ext )
iptables("-A FORWARD -o %s -j BLACKLIST_SRC" % self.eth_ext )
iptables("-A FORWARD -s ! %s -d ! %s -j FILTRE_P2P" % (self.zone_serveur, self.zone_serveur) )
# Appartement ENS
iptables("-A FORWARD -i crans.21 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1456")
# Appartement ENS
iptables("-A FORWARD -i crans.21 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu")
iptables("-A FORWARD -s %s -j ACCEPT" % NETs['personnel-ens'][0])
iptables("-A FORWARD -d %s -j ACCEPT" % NETs['personnel-ens'][0])