(self)
| 449 | self.fw.append(["filter", "", "-P FORWARD DROP"]) |
| 450 | |
| 451 | def fw_router(self): |
| 452 | if self.config.is_vpc() or self.config.is_routed() or self.config.is_dhcp(): |
| 453 | return |
| 454 | |
| 455 | self.fw.append(["mangle", "front", "-A PREROUTING " + |
| 456 | "-m state --state RELATED,ESTABLISHED " + |
| 457 | "-j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff"]) |
| 458 | |
| 459 | self.fw.append(["mangle", "front", |
| 460 | "-A POSTROUTING " + |
| 461 | "-p udp -m udp --dport 68 -j CHECKSUM --checksum-fill"]) |
| 462 | |
| 463 | if self.get_type() in ["public"]: |
| 464 | self.fw.append(["mangle", "front", |
| 465 | "-A PREROUTING " + |
| 466 | "-d %s/32 -j VPN_%s" % (self.address['public_ip'], self.address['public_ip'])]) |
| 467 | self.fw.append(["mangle", "front", |
| 468 | "-A PREROUTING " + |
| 469 | "-d %s/32 -j FIREWALL_%s" % (self.address['public_ip'], self.address['public_ip'])]) |
| 470 | self.fw.append(["mangle", "front", |
| 471 | "-A FIREWALL_%s " % self.address['public_ip'] + |
| 472 | "-m state --state RELATED,ESTABLISHED -j RETURN"]) |
| 473 | self.fw.append(["mangle", "", |
| 474 | "-A FIREWALL_%s -j DROP" % self.address['public_ip']]) |
| 475 | self.fw.append(["mangle", "", |
| 476 | "-I VPN_%s -m state --state RELATED,ESTABLISHED -j ACCEPT" % self.address['public_ip']]) |
| 477 | self.fw.append(["mangle", "", |
| 478 | "-A VPN_%s -j RETURN" % self.address['public_ip']]) |
| 479 | self.fw.append( |
| 480 | ["", "front", "-A FORWARD -j NETWORK_STATS_%s" % self.dev]) |
| 481 | self.fw.append( |
| 482 | ["", "front", "-A INPUT -j NETWORK_STATS_%s" % self.dev]) |
| 483 | self.fw.append( |
| 484 | ["", "front", "-A OUTPUT -j NETWORK_STATS_%s" % self.dev]) |
| 485 | self.fw.append( |
| 486 | ["", "", "-A NETWORK_STATS_%s -i eth0 -o %s" % (self.dev, self.dev)]) |
| 487 | self.fw.append( |
| 488 | ["", "", "-A NETWORK_STATS_%s -i %s -o eth0" % (self.dev, self.dev)]) |
| 489 | self.fw.append( |
| 490 | ["", "", "-A NETWORK_STATS_%s -o %s ! -i eth0 -p tcp" % (self.dev, self.dev)]) |
| 491 | self.fw.append( |
| 492 | ["", "", "-A NETWORK_STATS_%s -i %s ! -o eth0 -p tcp" % (self.dev, self.dev)]) |
| 493 | self.fw.append( |
| 494 | ["nat", "", "-A POSTROUTING -o %s -j SNAT --to-source %s" % (self.dev, self.cl.get_eth2_ip())]) |
| 495 | self.fw.append(["mangle", "", |
| 496 | "-A PREROUTING -i %s -m state --state NEW " % self.dev + |
| 497 | "-j CONNMARK --set-xmark %s/0xffffffff" % self.dnum]) |
| 498 | self.fw.append(["filter", "", |
| 499 | "-A FORWARD -i %s -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT" % self.dev]) |
| 500 | self.fw.append(["filter", "", |
| 501 | "-A FORWARD -i eth0 -o %s -j FW_OUTBOUND" % self.dev]) |
| 502 | |
| 503 | self.fw.append(["filter", "", "-A INPUT -d 224.0.0.18/32 -j ACCEPT"]) |
| 504 | self.fw.append(["filter", "", "-A INPUT -d 225.0.0.50/32 -j ACCEPT"]) |
| 505 | self.fw.append(["filter", "", "-A INPUT -i %s -m state --state RELATED,ESTABLISHED -j ACCEPT" % |
| 506 | self.dev]) |
| 507 | self.fw.append(["filter", "", "-A INPUT -p icmp -j ACCEPT"]) |
| 508 | self.fw.append(["filter", "", "-A INPUT -i lo -j ACCEPT"]) |
no test coverage detected