(self)
| 537 | self.fw.append(['', '', '-A NETWORK_STATS -i eth2 ! -o eth0 -p tcp']) |
| 538 | |
| 539 | def fw_vpcrouter(self): |
| 540 | if not self.config.is_vpc() or self.config.is_routed(): |
| 541 | return |
| 542 | |
| 543 | self.fw.append(["filter", "", "-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT"]) |
| 544 | |
| 545 | if self.get_type() in ["guest"]: |
| 546 | self.fw.append(["mangle", "front", "-A PREROUTING " + |
| 547 | " -i %s -m state --state RELATED,ESTABLISHED " % self.dev + |
| 548 | "-j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff"]) |
| 549 | |
| 550 | guestNetworkCidr = self.address['network'] |
| 551 | if self.config.has_public_network(): |
| 552 | self.fw.append(["filter", "", "-A FORWARD -d %s -o %s -j ACL_INBOUND_%s" % |
| 553 | (guestNetworkCidr, self.dev, self.dev)]) |
| 554 | self.fw.append( |
| 555 | ["filter", "front", "-A ACL_INBOUND_%s -d 224.0.0.18/32 -j ACCEPT" % self.dev]) |
| 556 | self.fw.append( |
| 557 | ["filter", "front", "-A ACL_INBOUND_%s -d 225.0.0.50/32 -j ACCEPT" % self.dev]) |
| 558 | self.fw.append( |
| 559 | ["filter", "", "-A ACL_INBOUND_%s -j DROP" % self.dev]) |
| 560 | self.fw.append( |
| 561 | ["mangle", "front", "-A ACL_OUTBOUND_%s -d 225.0.0.50/32 -j ACCEPT" % self.dev]) |
| 562 | self.fw.append( |
| 563 | ["mangle", "front", "-A ACL_OUTBOUND_%s -d 224.0.0.18/32 -j ACCEPT" % self.dev]) |
| 564 | else: |
| 565 | self.fw.append(["filter", "", "-A FORWARD -d %s -o %s -j ACCEPT" % (guestNetworkCidr, self.dev)]) |
| 566 | |
| 567 | self.fw.append( |
| 568 | ["filter", "", "-A INPUT -i %s -p udp -m udp --dport 67 -j ACCEPT" % self.dev]) |
| 569 | self.fw.append( |
| 570 | ["mangle", "front", "-A POSTROUTING " + "-p udp -m udp --dport 68 -j CHECKSUM --checksum-fill"]) |
| 571 | self.fw.append( |
| 572 | ["filter", "", "-A INPUT -i %s -p udp -m udp --dport 53 -s %s -j ACCEPT" % (self.dev, guestNetworkCidr)]) |
| 573 | self.fw.append( |
| 574 | ["filter", "", "-A INPUT -i %s -p tcp -m tcp --dport 53 -s %s -j ACCEPT" % (self.dev, guestNetworkCidr)]) |
| 575 | self.fw.append( |
| 576 | ["filter", "", "-A INPUT -i %s -p tcp -m tcp --dport 80 -s %s -m state --state NEW -j ACCEPT" % (self.dev, guestNetworkCidr)]) |
| 577 | self.fw.append( |
| 578 | ["filter", "", "-A INPUT -i %s -p tcp -m tcp --dport 443 -s %s -m state --state NEW -j ACCEPT" % (self.dev, guestNetworkCidr)]) |
| 579 | self.fw.append( |
| 580 | ["filter", "", "-A INPUT -i %s -p tcp -m tcp --dport 8080 -s %s -m state --state NEW -j ACCEPT" % (self.dev, guestNetworkCidr)]) |
| 581 | |
| 582 | if self.config.has_public_network(): |
| 583 | self.fw.append(["mangle", "", |
| 584 | "-A PREROUTING -m state --state NEW -i %s -s %s ! -d %s/32 -j ACL_OUTBOUND_%s" % |
| 585 | (self.dev, guestNetworkCidr, self.address['gateway'], self.dev)]) |
| 586 | |
| 587 | # Process static routes for this interface |
| 588 | static_routes = CsStaticRoutes("staticroutes", self.config) |
| 589 | if static_routes: |
| 590 | for item in static_routes.get_bag(): |
| 591 | if item == "id": |
| 592 | continue |
| 593 | static_route = static_routes.get_bag()[item] |
| 594 | if static_route['revoke']: |
| 595 | continue |
| 596 |
no test coverage detected