No description
Find a file
2022-09-02 18:56:29 +02:00
re2oapi@b12df74fe7 MAC-IP table 2019-03-12 22:06:28 +01:00
zones Commit running configuration 2022-08-01 12:10:08 +02:00
.gitignore MAC-IP table 2019-03-12 22:06:28 +01:00
.gitmodules MAC-IP table 2019-03-12 22:06:28 +01:00
archi.nft Update IP to match new services 2022-09-02 18:56:29 +02:00
checkmac.nft License 2019-12-20 19:18:10 +01:00
config.ini.example MAC-IP table 2019-03-12 22:06:28 +01:00
firewall.nft Commit running configuration 2022-08-01 12:10:08 +02:00
firewall.py Commit running configuration 2022-08-01 12:10:08 +02:00
firewall.service A small Readme. 2019-05-07 00:03:42 +02:00
global_policy.nft License 2019-12-20 19:18:10 +01:00
mac_ip.py roulette 2020-01-22 23:13:08 +01:00
main.py License 2019-12-20 19:18:10 +01:00
nat.nft Port forwarding for Mohammed Ziani 2022-08-02 22:33:36 +02:00
nat.py License 2019-12-20 19:18:10 +01:00
re2o.conf Ajout des droits pour la VM des rennais (DNS) 2020-06-11 22:19:23 +02:00
README.md Readme 2019-05-07 00:05:36 +02:00
roulette.nft roulette 2020-01-22 23:13:08 +01:00
roulette.py La Rouuuleeeeteuuuh 2020-01-18 14:23:41 +01:00

Re2o firewall with nftables

This script creates a firewall from Re2o information using nftables.

What it does :

  • Fetch mac-ip table from re2o and filter traffic from the adherent NAT with it;
  • Create a NAT table for FedeRez and Adherent, and NAT the admin and prerezotage VLANs properly.

What it does not do (yet) :

  • Fetch opened ports on Re2o and filter traffic with these infos.

Install :

cd /usr/local/
git clone --recursive https://gitlab.rezometz.org/klafyvel/firewall.git
apt install python3 python3-click python3-iso8601
cp config.ini.example config.ini
vim config.ini
chmod +x main.py
cp firewall.service /etc/systemd/system/
systemctl start firewall.service
echo "* * * * * root /usr/bin/python3 main.py macip 2>&1 | /usr/bin/logger -t firewall" >> /etc/cron.d/firewall

Usage :

Usage: main.py [OPTIONS] COMMAND [ARGS]...

  Re2o firewall manager.

  Used without command, the firewall manager will load the whole firewall
  (i.e. the struture, the macip set and the MAC table). By default it erases
  the current NAT table and macp set. You can choose to keep the current
  values for these with the flags.

Options:
  --keep-nat / --dont-keep-nat    Should I keep the current NAT table ?
  --keep-macip / --dont-keep-macip
                                  Should I keep the current macip set ?
  --help                          Show this message and exit.

Commands:
  macip  Load the macip set.
  nat    Load the NAT table.

Dependencies :

- re2oapi
- python3-click