Skip to content

E
eterban
Commit a3f8fe16 authored by Vitaly Lipatov's avatar Vitaly Lipatov
Browse files
Options

gateway: make ipset maxelem configurable via settings.ini

Default 2000000, was hardcoded 650000.
parent 051276d4
Hide whitespace changes
Inline Side-by-side
Showing with 41 additions and 29 deletions
common/etc/eterban/settings.ini
View file @ a3f8fe16
......@@ -8,9 +8,14 @@
# Input interface
#i_interface = brlocal
# Secord input interface
# Second input interface
#i_interface2 = brlocal2
# Internal interface (for blocking outgoing connections to banned IPs)
# When internal users access banned IPs on ports 80/443,
# traffic is redirected to ban_server (DNAT by destination, not source)
#internal_interface = vmbr0
#hostname = localhost
# Maximum number of entries in ipset (default: 2000000)
......
gateway/usr/share/eterban/eterban_switcher.py
View file @ a3f8fe16
......@@ -49,6 +49,7 @@ def parse_config (path_to_config, path_to_log):
ban_server_ipv6 = config.get("Settings", "ban_server_ipv6", fallback = "")
i_interface = config.get("Settings", "i_interface", fallback = "i_interface")
i_interface2 = config.get("Settings", "i_interface2", fallback = "")
internal_interface = config.get("Settings", "internal_interface", fallback = "")
if redis_server == "redis_server" or ban_server == "ban_server" or i_interface == "i_interface":
#config.set("Settings", "redis_server", "10.20.30.101")
#with open(path_to_config, "w") as config_file:
......@@ -60,7 +61,7 @@ def parse_config (path_to_config, path_to_log):
sys.exit()
else:
maxelem = config.getint("Settings", "maxelem", fallback=2000000)
return (redis_server, ban_server, ban_server_ipv6, i_interface, i_interface2, maxelem)
return (redis_server, ban_server, ban_server_ipv6, i_interface, i_interface2, internal_interface, maxelem)
def save_ipset_eterban_1():
global ipset_eterban_1, ipset_eterban_1_ipv6, ipset_firehol, ipset_eterban_white, path_to_eterban
......@@ -77,7 +78,7 @@ def restore_ipset_eterban_1():
subprocess.call (command, shell = True)
def create_iptables_rules():
global ban_server, ipset_eterban_1, ipset_firehol, ipset_eterban_white, i_interface, i_interface2, maxelem
global ban_server, ipset_eterban_1, ipset_firehol, ipset_eterban_white, i_interface, i_interface2, internal_interface, maxelem
commands=['ipset create ' + ipset_eterban_1 + ' hash:ip maxelem ' + str(maxelem),
'ipset create ' + ipset_firehol + ' hash:net',
'ipset create ' + ipset_eterban_white + ' hash:ip',
......@@ -90,18 +91,22 @@ def create_iptables_rules():
for command in commands:
subprocess.call (command, shell = True)
if not i_interface2:
return
if i_interface2:
commands=[
'iptables -t nat -I PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_firehol + ' src -j DNAT --to-destination ' + ban_server,
'iptables -t nat -I PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_1 + ' src -j DNAT --to-destination ' + ban_server,
'iptables -t nat -I PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_white + ' src -j ACCEPT',
'iptables -I FORWARD -i ' + i_interface2 + ' -p tcp -m multiport ! --dport 80,81,443 -m set --match-set ' + ipset_eterban_1 + ' src -j REJECT']
for command in commands:
subprocess.call (command, shell = True)
commands=[
'iptables -t nat -I PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_firehol + ' src -j DNAT --to-destination ' + ban_server,
'iptables -t nat -I PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_1 + ' src -j DNAT --to-destination ' + ban_server,
'iptables -t nat -I PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_white + ' src -j ACCEPT',
#'iptables -t nat -I PREROUTING -i ' + i_interface2 + ' -m set ! --match-set ' + ipset_eterban_1 + ' src -d ' + ban_server + ' -p tcp -m multiport --destination-port 80,443 -j DNAT --to-destination ' + ban_server + ':81',
#'iptables -t nat -I PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_1 + ' src -p tcp --dport 443 -j DNAT --to-destination ' + ban_server + ':80',
'iptables -I FORWARD -i ' + i_interface2 + ' -p tcp -m multiport ! --dport 80,81,443 -m set --match-set ' + ipset_eterban_1 + ' src -j REJECT']
for command in commands:
subprocess.call (command, shell = True)
# Internal interface: block outgoing connections to banned IPs (DNAT by destination)
if internal_interface:
commands=[
'iptables -t nat -I PREROUTING -i ' + internal_interface + ' -m set --match-set ' + ipset_eterban_1 + ' dst -p tcp -m multiport --dports 80,443 -j DNAT --to-destination ' + ban_server + ':82',
'iptables -t nat -I PREROUTING -i ' + internal_interface + ' -m set --match-set ' + ipset_firehol + ' dst -p tcp -m multiport --dports 80,443 -j DNAT --to-destination ' + ban_server + ':82']
for command in commands:
subprocess.call (command, shell = True)
def create_ip6tables_rules():
......@@ -135,7 +140,7 @@ def create_ip6tables_rules():
def destroy_iptables_rules ():
global ban_server, ipset_eterban_1, ipset_firehol, ipset_eterban_white, i_interface, i_interface2
global ban_server, ipset_eterban_1, ipset_firehol, ipset_eterban_white, i_interface, i_interface2, internal_interface
commands=[
'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_firehol + ' src -j DNAT --to-destination ' + ban_server,
'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_1 + ' src -j DNAT --to-destination ' + ban_server,
......@@ -150,20 +155,22 @@ def destroy_iptables_rules ():
subprocess.call (command, shell = True)
#print (command)
if not i_interface2:
return
commands=[
'iptables -t nat -D PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_firehol + ' src -j DNAT --to-destination ' + ban_server,
'iptables -t nat -D PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_1 + ' src -j DNAT --to-destination ' + ban_server,
'iptables -t nat -D PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_white + ' src -j ACCEPT',
#'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set ! --match-set ' + ipset_eterban_1 + ' src -d ' + ban_server + ' -p tcp -m multiport --destination-port 80,443 -j DNAT --to-destination ' + ban_server + ':81',
#'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_1 + ' src -p tcp --dport 443 -j DNAT --to-destination ' + ban_server + ':80',
'iptables -D FORWARD -i ' + i_interface2 + ' -p tcp -m multiport ! --dport 80,81,443 -m set --match-set ' + ipset_eterban_1 + ' src -j REJECT']
if i_interface2:
commands=[
'iptables -t nat -D PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_firehol + ' src -j DNAT --to-destination ' + ban_server,
'iptables -t nat -D PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_1 + ' src -j DNAT --to-destination ' + ban_server,
'iptables -t nat -D PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_white + ' src -j ACCEPT',
'iptables -D FORWARD -i ' + i_interface2 + ' -p tcp -m multiport ! --dport 80,81,443 -m set --match-set ' + ipset_eterban_1 + ' src -j REJECT']
for command in commands:
subprocess.call (command, shell = True)
for command in commands:
subprocess.call (command, shell = True)
#print (command)
# Internal interface: remove outgoing block rules
if internal_interface:
commands=[
'iptables -t nat -D PREROUTING -i ' + internal_interface + ' -m set --match-set ' + ipset_eterban_1 + ' dst -p tcp -m multiport --dports 80,443 -j DNAT --to-destination ' + ban_server + ':82',
'iptables -t nat -D PREROUTING -i ' + internal_interface + ' -m set --match-set ' + ipset_firehol + ' dst -p tcp -m multiport --dports 80,443 -j DNAT --to-destination ' + ban_server + ':82']
for command in commands:
subprocess.call (command, shell = True)
def destroy_ip6tables_rules ():
......@@ -216,7 +223,7 @@ signal.signal(signal.SIGTERM, exit_gracefully)
#print ('1')
redis_server, ban_server, ban_server_ipv6, i_interface, i_interface2, maxelem = parse_config (path_to_config, path_to_log)
redis_server, ban_server, ban_server_ipv6, i_interface, i_interface2, internal_interface, maxelem = parse_config (path_to_config, path_to_log)
#destroy_iptables_rules ()
#sys.exit()
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment