rezometz/firewall
9
0
Fork 0
Code Issues Pull requests 1 Releases Wiki Activity

Fix nat for federez radius

Browse source
This commit is contained in:
Hugo Levy-Falk 2019-05-20 10:56:31 +02:00 committed by root
parent b395d0d258
commit 00342cf835
2 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
archi.nft
View file

@ -22,5 +22,7 @@ define range_aloes = 10.66.0.0/27
define range_prerezotage = 10.68.0.0/16 define range_prerezotage = 10.68.0.0/16
define range_public = 193.48.225.0/24 define range_public = 193.48.225.0/24
define ip_self_public = 193.48.225.2 define ip_self_public = 193.48.225.254
define ip_radius = 10.7.0.124 define ip_radius = 10.7.0.124

5
nat.nft
View file

@ -11,7 +11,7 @@ table ip nat {
type nat hook prerouting priority 0; type nat hook prerouting priority 0;
ip saddr $range_prerezotage ip daddr != { $intranet, $comnpay, $website } tcp dport {http,https} dnat $bounce_server; ip saddr $range_prerezotage ip daddr != { $intranet, $comnpay, $website } tcp dport {http,https} dnat $bounce_server;
ip saddr @radius_federez ip daddr $ip_self_public tcp dport { 636, 389 } dnat $ip_radius; ip saddr @radius_federez ip daddr $ip_self_public tcp dport { 636, 389 } dnat $ip_radius;
ip saddr @radius_federez ip daddr $ip_self_public udp dport { 636 } dnat $ip_radius; ip saddr @radius_federez ip daddr $ip_self_public udp dport { 636, 1812 } dnat $ip_radius;
} }
@ -20,6 +20,9 @@ table ip nat {
meta oifname != $if_supelec return meta oifname != $if_supelec return
ip saddr $ip_radius ip daddr @radius_federez tcp dport { 636, 389} snat to $ip_self_public
ip saddr $ip_radius ip daddr @radius_federez udp dport { 636, 1812 } snat to $ip_self_public
ip daddr != {10.0.0.0/8, $range_public} ip saddr vmap { ip daddr != {10.0.0.0/8, $range_public} ip saddr vmap {
$range_adherent : goto adherent_nat, $range_adherent : goto adherent_nat,
$range_admin : goto admin_nat, $range_admin : goto admin_nat,