You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
root
f80922e415
|
7 years ago | |
|---|---|---|
| re2oapi@b12df74fe7 | 7 years ago | |
| zones | 7 years ago | |
| .gitignore | 7 years ago | |
| .gitmodules | 7 years ago | |
| README.md | 7 years ago | |
| archi.nft | 7 years ago | |
| checkmac.nft | 7 years ago | |
| config.ini.example | 7 years ago | |
| firewall.nft | 7 years ago | |
| firewall.py | 7 years ago | |
| firewall.service | 7 years ago | |
| global_policy.nft | 7 years ago | |
| mac_ip.py | 7 years ago | |
| main.py | 7 years ago | |
| nat.nft | 7 years ago | |
| nat.py | 7 years ago | |
README.md
Re2o firewall with nftables
This script creates a firewall from Re2o information using nftables.
What it does :
- Fetch mac-ip table from re2o and filter traffic from the adherent NAT with it;
- Create a NAT table for FedeRez and Adherent, and NAT the admin and prerezotage VLANs properly.
What it does not do (yet) :
- Fetch opened ports on Re2o and filter traffic with these infos.
Install :
cd /usr/local/
git clone --recursive https://gitlab.rezometz.org/klafyvel/firewall.git
apt install python3 python3-click python3-iso8601
cp config.ini.example config.ini
vim config.ini
chmod +x main.py
cp firewall.service /etc/systemd/system/
systemctl start firewall.service
echo "* * * * * root /usr/bin/python3 main.py macip 2>&1 | /usr/bin/logger -t firewall" >> /etc/cron.d/firewall
Usage :
See ./main.py --help.
Dependencies :
- re2oapi
- python3-click