(self, rule)
| 1412 | self.forward_vr(rule) |
| 1413 | |
| 1414 | def forward_vr(self, rule): |
| 1415 | # Prefetch iptables variables |
| 1416 | public_fwinterface = self.getDeviceByIp(rule['public_ip']) |
| 1417 | internal_fwinterface = self.getDeviceByIp(rule['internal_ip']) |
| 1418 | public_fwports = self.portsToString(rule['public_ports'], ':') |
| 1419 | internal_fwports = self.portsToString(rule['internal_ports'], '-') |
| 1420 | fw1 = "-A PREROUTING -d %s/32 -i %s -p %s -m %s --dport %s -j DNAT --to-destination %s:%s" % \ |
| 1421 | ( |
| 1422 | rule['public_ip'], |
| 1423 | public_fwinterface, |
| 1424 | rule['protocol'], |
| 1425 | rule['protocol'], |
| 1426 | public_fwports, |
| 1427 | rule['internal_ip'], |
| 1428 | internal_fwports |
| 1429 | ) |
| 1430 | fw2 = "-A PREROUTING -d %s/32 -i %s -p %s -m %s --dport %s -j DNAT --to-destination %s:%s" % \ |
| 1431 | ( |
| 1432 | rule['public_ip'], |
| 1433 | internal_fwinterface, |
| 1434 | rule['protocol'], |
| 1435 | rule['protocol'], |
| 1436 | public_fwports, |
| 1437 | rule['internal_ip'], |
| 1438 | internal_fwports |
| 1439 | ) |
| 1440 | fw3 = "-A OUTPUT -d %s/32 -p %s -m %s --dport %s -j DNAT --to-destination %s:%s" % \ |
| 1441 | ( |
| 1442 | rule['public_ip'], |
| 1443 | rule['protocol'], |
| 1444 | rule['protocol'], |
| 1445 | public_fwports, |
| 1446 | rule['internal_ip'], |
| 1447 | internal_fwports |
| 1448 | ) |
| 1449 | fw4 = "-j SNAT --to-source %s -A POSTROUTING -s %s -d %s/32 -o %s -p %s -m %s --dport %s" % \ |
| 1450 | ( |
| 1451 | self.getGuestIp(), |
| 1452 | self.getNetworkByIp(rule['internal_ip']), |
| 1453 | rule['internal_ip'], |
| 1454 | internal_fwinterface, |
| 1455 | rule['protocol'], |
| 1456 | rule['protocol'], |
| 1457 | self.portsToString(rule['internal_ports'], ':') |
| 1458 | ) |
| 1459 | fw5 = "-A PREROUTING -d %s/32 -i %s -p %s -m %s --dport %s -j MARK --set-xmark %s/0xffffffff" % \ |
| 1460 | ( |
| 1461 | rule['public_ip'], |
| 1462 | public_fwinterface, |
| 1463 | rule['protocol'], |
| 1464 | rule['protocol'], |
| 1465 | public_fwports, |
| 1466 | hex(100 + int(public_fwinterface[3:])) |
| 1467 | ) |
| 1468 | fw6 = "-A PREROUTING -d %s/32 -i %s -p %s -m %s --dport %s -m state --state NEW -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff" % \ |
| 1469 | ( |
| 1470 | rule['public_ip'], |
| 1471 | public_fwinterface, |
no test coverage detected