| 1569 | |
| 1570 | |
| 1571 | class IpTablesExecutor: |
| 1572 | |
| 1573 | config = None |
| 1574 | |
| 1575 | def __init__(self, config): |
| 1576 | self.config = config |
| 1577 | |
| 1578 | def process(self): |
| 1579 | acls = CsAcl('networkacl', self.config) |
| 1580 | acls.flushAllIpv6Rules() |
| 1581 | acls.process() |
| 1582 | |
| 1583 | acls = CsAcl('firewallrules', self.config) |
| 1584 | acls.flushAllowAllEgressRules() |
| 1585 | acls.process() |
| 1586 | |
| 1587 | ip6_fw = CsIpv6Firewall('ipv6firewallrules', self.config) |
| 1588 | ip6_fw.flushAllRules() |
| 1589 | ip6_fw.process() |
| 1590 | |
| 1591 | fwd = CsForwardingRules("forwardingrules", self.config) |
| 1592 | fwd.process() |
| 1593 | |
| 1594 | vpns = CsSite2SiteVpn("site2sitevpn", self.config) |
| 1595 | vpns.process() |
| 1596 | |
| 1597 | rvpn = CsRemoteAccessVpn("remoteaccessvpn", self.config) |
| 1598 | rvpn.process() |
| 1599 | |
| 1600 | lb = CsLoadBalancer("loadbalancer", self.config) |
| 1601 | lb.process() |
| 1602 | |
| 1603 | logging.debug("Configuring iptables rules") |
| 1604 | nf = CsNetfilters() |
| 1605 | nf.compare(self.config.get_fw()) |
| 1606 | |
| 1607 | logging.info("Configuring nftables IPv4 firewall rules %s" % self.config.get_nft_ipv4_fw()) |
| 1608 | acls.flushAllIpv4RoutingRules() |
| 1609 | nf = CsNetfilters() |
| 1610 | nf.apply_nft_ipv4_rules(self.config.get_nft_ipv4_fw(), "firewall") |
| 1611 | acls.flushAllIptablesRules() |
| 1612 | |
| 1613 | logging.info("Configuring nftables IPv4 ACL rules %s" % self.config.get_nft_ipv4_acl()) |
| 1614 | acls.flushAllIpv4RoutingACLRules() |
| 1615 | nf = CsNetfilters() |
| 1616 | nf.apply_nft_ipv4_rules(self.config.get_nft_ipv4_acl(), "acl") |
| 1617 | |
| 1618 | logging.info("Configuring nftables IPv6 ACL rules %s" % self.config.get_ipv6_acl()) |
| 1619 | nf = CsNetfilters() |
| 1620 | nf.apply_ip6_rules(self.config.get_ipv6_acl(), "acl") |
| 1621 | |
| 1622 | logging.info("Configuring nftables IPv6 firewall rules %s" % self.config.get_ipv6_fw()) |
| 1623 | nf = CsNetfilters() |
| 1624 | nf.apply_ip6_rules(self.config.get_ipv6_fw(), "firewall") |
| 1625 | |
| 1626 | logging.debug("Configuring iptables rules done ...saving rules") |
| 1627 | |
| 1628 | # Save iptables configuration - will be loaded on reboot by the iptables-restore that is configured on /etc/rc.local |