No description
Find a file
2020-01-20 11:49:05 +01:00
re2oapi@b12df74fe7 MAC-IP table 2019-03-12 22:06:28 +01:00
zones License 2019-12-20 19:18:10 +01:00
.gitignore MAC-IP table 2019-03-12 22:06:28 +01:00
.gitmodules MAC-IP table 2019-03-12 22:06:28 +01:00
archi.nft License 2019-12-20 19:18:10 +01:00
checkmac.nft License 2019-12-20 19:18:10 +01:00
config.ini.example MAC-IP table 2019-03-12 22:06:28 +01:00
firewall.nft La roulette a la priorité sur tout. 2020-01-20 11:26:27 +01:00
firewall.py License 2019-12-20 19:18:10 +01:00
firewall.service A small Readme. 2019-05-07 00:03:42 +02:00
global_policy.nft License 2019-12-20 19:18:10 +01:00
mac_ip.py La roulette a la priorité sur tout. 2020-01-20 11:26:27 +01:00
main.py License 2019-12-20 19:18:10 +01:00
nat.nft License 2019-12-20 19:18:10 +01:00
nat.py License 2019-12-20 19:18:10 +01:00
README.md Readme 2019-05-07 00:05:36 +02:00
roulette.nft Autorise les bannis à voir la roulette 2020-01-20 11:49:05 +01:00
roulette.py La Rouuuleeeeteuuuh 2020-01-18 14:23:41 +01:00

Re2o firewall with nftables

This script creates a firewall from Re2o information using nftables.

What it does :

  • Fetch mac-ip table from re2o and filter traffic from the adherent NAT with it;
  • Create a NAT table for FedeRez and Adherent, and NAT the admin and prerezotage VLANs properly.

What it does not do (yet) :

  • Fetch opened ports on Re2o and filter traffic with these infos.

Install :

cd /usr/local/
git clone --recursive https://gitlab.rezometz.org/klafyvel/firewall.git
apt install python3 python3-click python3-iso8601
cp config.ini.example config.ini
vim config.ini
chmod +x main.py
cp firewall.service /etc/systemd/system/
systemctl start firewall.service
echo "* * * * * root /usr/bin/python3 main.py macip 2>&1 | /usr/bin/logger -t firewall" >> /etc/cron.d/firewall

Usage :

Usage: main.py [OPTIONS] COMMAND [ARGS]...

  Re2o firewall manager.

  Used without command, the firewall manager will load the whole firewall
  (i.e. the struture, the macip set and the MAC table). By default it erases
  the current NAT table and macp set. You can choose to keep the current
  values for these with the flags.

Options:
  --keep-nat / --dont-keep-nat    Should I keep the current NAT table ?
  --keep-macip / --dont-keep-macip
                                  Should I keep the current macip set ?
  --help                          Show this message and exit.

Commands:
  macip  Load the macip set.
  nat    Load the NAT table.

Dependencies :

- re2oapi
- python3-click