crans/scripts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[./gestion/gen_confs/firewall.py] Diverses corrections

Browse source 
* correction d'une règle
 * On enlève un doublon
 * ip_conntrack_max a été déplacé lors de la migration vers lenny

darcs-hash:20090405134441-8fbb1-c39d728d4b9984a256624efc387e487c24daf582.gz
This commit is contained in:
Olivier Huber 2009-04-05 15:44:41 +02:00
parent d207ba7e7c
commit f09b6f981d
1 changed files with 2 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

12
gestion/gen_confs/firewall.py
View file

@ -625,17 +625,9 @@ class firewall_komaz(firewall_crans) :
# bande passante. # bande passante.
# Classification des paquets à destination du ftp # Classification des paquets à destination du ftp
iptables("-t mangle -A POSTROUTING -o %(eth_int)s --destination 136.231.136.10 --destination-port 21 " iptables("-t mangle -A POSTROUTING -o %(eth_int)s -p tcp -d 136.231.136.10 --dport 21 "
"-j CLASSIFY --set-class 1:9997" % locals()) "-j CLASSIFY --set-class 1:9997" % locals())
debit_ftp = 12000
# Restriction
for interface in [self.eth_ext, self.eth_int]:
tc("class add dev %(interface)s parent 1:1 classid 1:9997 "
"htb rate %(debit_ftp)s ceil %(debit_ftp)s" % locals())
tc("qdisc add dev %(interface)s parent 1:9997 "
"handle %(qdisc_id)d: sfq perturb 10" % locals())
self.anim.reinit() self.anim.reinit()
print OK print OK
@ -789,7 +781,7 @@ class firewall_komaz(firewall_crans) :
self.anim = anim("\tMise en place du routage") self.anim = anim("\tMise en place du routage")
warn = '' warn = ''
for cmd in [ 'echo 1 > /proc/sys/net/ipv4/ip_forward' , for cmd in [ 'echo 1 > /proc/sys/net/ipv4/ip_forward' ,
'echo 65536 > /proc/sys/net/ipv4/ip_conntrack_max' , 'echo 65536 > /proc/sys/net/ipv4/netfilter/ip_conntrack_max' ,
'modprobe ip_conntrack_ftp' , 'modprobe ip_conntrack_ftp' ,
'modprobe ip_conntrack_irc' ] : 'modprobe ip_conntrack_irc' ] :
status,output=getstatusoutput(cmd) status,output=getstatusoutput(cmd)