Création d'un service
This commit is contained in:
parent
96ceae0b1d
commit
21de67b467
2 changed files with 59 additions and 0 deletions
13
firewall.service
Normal file
13
firewall.service
Normal file
|
@ -0,0 +1,13 @@
|
||||||
|
[Unit]
|
||||||
|
Description=RezoMetz Firewall Service
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
RemainAfterExit=yes
|
||||||
|
ExecStart=python3 /usr/local/firewall/init_firewall.py
|
||||||
|
ExecReload=python3 /usr/local/firewall/init_firewall.py
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
Alias=firewall.service
|
46
init_firewall.py
Normal file
46
init_firewall.py
Normal file
|
@ -0,0 +1,46 @@
|
||||||
|
import os
|
||||||
|
import logging
|
||||||
|
from logging.handlers import RotatingFileHandler
|
||||||
|
|
||||||
|
import nat
|
||||||
|
import mac_ip
|
||||||
|
|
||||||
|
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
|
||||||
|
|
||||||
|
LOG_LEVEL = logging.INFO
|
||||||
|
|
||||||
|
logger = logging.getLogger()
|
||||||
|
logger.setLevel(LOG_LEVEL)
|
||||||
|
formatter = logging.Formatter('%(asctime)s :: %(levelname)s :: %(message)s')
|
||||||
|
file_handler = RotatingFileHandler('/var/log/firewall.log', 'a', 1000000, 1)
|
||||||
|
file_handler.setLevel(LOG_LEVEL)
|
||||||
|
file_handler.setFormatter(formatter)
|
||||||
|
logger.addHandler(file_handler)
|
||||||
|
stream_handler = logging.StreamHandler()
|
||||||
|
stream_handler.setFormatter(formatter)
|
||||||
|
stream_handler.setLevel(LOG_LEVEL)
|
||||||
|
logger.addHandler(stream_handler)
|
||||||
|
|
||||||
|
logger.info("Activation des paramètres noyau")
|
||||||
|
logging.debug("Activation du routage des paquets")
|
||||||
|
os.system('echo "1" > /proc/sys/net/ipv4/ip_forward')
|
||||||
|
logger.debug("Active la protection TCP SYN Cookies (demandes de connexion repetes)")
|
||||||
|
os.system('echo "1" > /proc/sys/net/ipv4/tcp_syncookies')
|
||||||
|
logger.debug("Filtrage en mode strict des paquets pour éviter l'IP spoofing "
|
||||||
|
"(voir RFC3704 Strict Reverse Path)")
|
||||||
|
os.system('echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter')
|
||||||
|
os.system('echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter')
|
||||||
|
logger.debug("Don't accept source routed packets.")
|
||||||
|
os.system('echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route')
|
||||||
|
|
||||||
|
logger.info("Chargement du firewall")
|
||||||
|
os.system('nft -I {install_dir} -f {firewall}'.format(
|
||||||
|
install_dir=BASE_DIR,
|
||||||
|
firewall=os.path.join(BASE_DIR, 'firewall.nft')
|
||||||
|
))
|
||||||
|
|
||||||
|
logger.info("Chargement de la table mac_ip")
|
||||||
|
mac_ip.update_macip()
|
||||||
|
|
||||||
|
logger.info("Chargement de la table nat")
|
||||||
|
nat.main()
|
Loading…
Reference in a new issue