(self)
| 750 | 'rule': "iifname %s oifname %s ct state related,established counter accept" % (self.dev, self.dev)}) |
| 751 | |
| 752 | def fw_dhcpserver(self): |
| 753 | if not self.config.is_dhcp(): |
| 754 | return |
| 755 | |
| 756 | self.fw.append(["mangle", "front", |
| 757 | "-A POSTROUTING " + |
| 758 | "-p udp -m udp --dport 68 -j CHECKSUM --checksum-fill"]) |
| 759 | |
| 760 | self.fw.append(["filter", "", "-A INPUT -d 224.0.0.18/32 -j ACCEPT"]) |
| 761 | self.fw.append(["filter", "", "-A INPUT -d 225.0.0.50/32 -j ACCEPT"]) |
| 762 | self.fw.append(["filter", "", "-A INPUT -i %s -m state --state RELATED,ESTABLISHED -j ACCEPT" % |
| 763 | self.dev]) |
| 764 | self.fw.append(["filter", "", "-A INPUT -p icmp -j ACCEPT"]) |
| 765 | self.fw.append(["filter", "", "-A INPUT -i lo -j ACCEPT"]) |
| 766 | |
| 767 | if self.config.is_vpc(): |
| 768 | self.fw.append( |
| 769 | ["filter", "", "-A INPUT -i eth0 -p tcp -m tcp --dport 3922 -m state --state NEW,ESTABLISHED -j ACCEPT"]) |
| 770 | else: |
| 771 | self.fw.append( |
| 772 | ["filter", "", "-A INPUT -i eth1 -p tcp -m tcp --dport 3922 -m state --state NEW,ESTABLISHED -j ACCEPT"]) |
| 773 | |
| 774 | if self.get_type() in ["guest"]: |
| 775 | guestNetworkCidr = self.address['network'] |
| 776 | self.fw.append( |
| 777 | ["filter", "", "-A INPUT -i %s -p udp -m udp --dport 67 -j ACCEPT" % self.dev]) |
| 778 | self.fw.append( |
| 779 | ["filter", "", "-A INPUT -i %s -p udp -m udp --dport 53 -s %s -j ACCEPT" % (self.dev, guestNetworkCidr)]) |
| 780 | self.fw.append( |
| 781 | ["filter", "", "-A INPUT -i %s -p tcp -m tcp --dport 53 -s %s -j ACCEPT" % (self.dev, guestNetworkCidr)]) |
| 782 | self.fw.append( |
| 783 | ["filter", "", "-A INPUT -i %s -p tcp -m tcp --dport 80 -s %s -m state --state NEW -j ACCEPT" % (self.dev, guestNetworkCidr)]) |
| 784 | self.fw.append( |
| 785 | ["filter", "", "-A INPUT -i %s -p tcp -m tcp --dport 443 -s %s -m state --state NEW -j ACCEPT" % (self.dev, guestNetworkCidr)]) |
| 786 | self.fw.append( |
| 787 | ["filter", "", "-A INPUT -i %s -p tcp -m tcp --dport 8080 -s %s -m state --state NEW -j ACCEPT" % (self.dev, guestNetworkCidr)]) |
| 788 | self.fw.append( |
| 789 | ["filter", "", "-A FORWARD -i %s -o %s -m state --state RELATED,ESTABLISHED -j ACCEPT" % (self.dev, self.dev)]) |
| 790 | self.fw.append( |
| 791 | ["filter", "", "-A FORWARD -i %s -o %s -m state --state NEW -j ACCEPT" % (self.dev, self.dev)]) |
| 792 | |
| 793 | |
| 794 | def post_config_change(self, method): |
no test coverage detected