You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
root a0178ca34c add new dmz ip 1 year ago
re2oapi@b12df74fe7 MAC-IP table 5 years ago
zones add new dmz ip 1 year ago
.gitignore MAC-IP table 5 years ago
.gitmodules MAC-IP table 5 years ago
README.md Readme 5 years ago
archi.nft Update IP to match new services 2 years ago
checkmac.nft License 4 years ago
config.ini.example MAC-IP table 5 years ago
firewall.nft Commit running configuration 2 years ago
firewall.py Commit running configuration 2 years ago
firewall.service A small Readme. 5 years ago
global_policy.nft License 4 years ago
mac_ip.py roulette 4 years ago
main.py License 4 years ago
nat.nft Add port forwarding rules for Aurélian Pinet 2 years ago
nat.py License 4 years ago
re2o.conf Ajout des droits pour la VM des rennais (DNS) 4 years ago
roulette.nft roulette 4 years ago
roulette.py La Rouuuleeeeteuuuh 4 years ago

README.md

Re2o firewall with nftables

This script creates a firewall from Re2o information using nftables.

What it does :

  • Fetch mac-ip table from re2o and filter traffic from the adherent NAT with it;
  • Create a NAT table for FedeRez and Adherent, and NAT the admin and prerezotage VLANs properly.

What it does not do (yet) :

  • Fetch opened ports on Re2o and filter traffic with these infos.

Install :

cd /usr/local/
git clone --recursive https://gitlab.rezometz.org/klafyvel/firewall.git
apt install python3 python3-click python3-iso8601
cp config.ini.example config.ini
vim config.ini
chmod +x main.py
cp firewall.service /etc/systemd/system/
systemctl start firewall.service
echo "* * * * * root /usr/bin/python3 main.py macip 2>&1 | /usr/bin/logger -t firewall" >> /etc/cron.d/firewall

Usage :

Usage: main.py [OPTIONS] COMMAND [ARGS]...

  Re2o firewall manager.

  Used without command, the firewall manager will load the whole firewall
  (i.e. the struture, the macip set and the MAC table). By default it erases
  the current NAT table and macp set. You can choose to keep the current
  values for these with the flags.

Options:
  --keep-nat / --dont-keep-nat    Should I keep the current NAT table ?
  --keep-macip / --dont-keep-macip
                                  Should I keep the current macip set ?
  --help                          Show this message and exit.

Commands:
  macip  Load the macip set.
  nat    Load the NAT table.

Dependencies :

- re2oapi
- python3-click