Création d'un service

This commit is contained in:
Hugo Levy-Falk 2019-03-30 18:35:17 +01:00 committed by root
parent 96ceae0b1d
commit 21de67b467
2 changed files with 59 additions and 0 deletions

13
firewall.service Normal file
View file

@ -0,0 +1,13 @@
[Unit]
Description=RezoMetz Firewall Service
After=network.target
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=python3 /usr/local/firewall/init_firewall.py
ExecReload=python3 /usr/local/firewall/init_firewall.py
[Install]
WantedBy=multi-user.target
Alias=firewall.service

46
init_firewall.py Normal file
View file

@ -0,0 +1,46 @@
import os
import logging
from logging.handlers import RotatingFileHandler
import nat
import mac_ip
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
LOG_LEVEL = logging.INFO
logger = logging.getLogger()
logger.setLevel(LOG_LEVEL)
formatter = logging.Formatter('%(asctime)s :: %(levelname)s :: %(message)s')
file_handler = RotatingFileHandler('/var/log/firewall.log', 'a', 1000000, 1)
file_handler.setLevel(LOG_LEVEL)
file_handler.setFormatter(formatter)
logger.addHandler(file_handler)
stream_handler = logging.StreamHandler()
stream_handler.setFormatter(formatter)
stream_handler.setLevel(LOG_LEVEL)
logger.addHandler(stream_handler)
logger.info("Activation des paramètres noyau")
logging.debug("Activation du routage des paquets")
os.system('echo "1" > /proc/sys/net/ipv4/ip_forward')
logger.debug("Active la protection TCP SYN Cookies (demandes de connexion repetes)")
os.system('echo "1" > /proc/sys/net/ipv4/tcp_syncookies')
logger.debug("Filtrage en mode strict des paquets pour éviter l'IP spoofing "
"(voir RFC3704 Strict Reverse Path)")
os.system('echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter')
os.system('echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter')
logger.debug("Don't accept source routed packets.")
os.system('echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route')
logger.info("Chargement du firewall")
os.system('nft -I {install_dir} -f {firewall}'.format(
install_dir=BASE_DIR,
firewall=os.path.join(BASE_DIR, 'firewall.nft')
))
logger.info("Chargement de la table mac_ip")
mac_ip.update_macip()
logger.info("Chargement de la table nat")
nat.main()