Skip to content

E
eterban
Commit afba3a65 authored by Vitaly Lipatov's avatar Vitaly Lipatov
Browse files
Options

gateway: add internal_interface and IPv6 support for DNAT rules

- internal_interface (vmbr0): DNAT by destination for internal users accessing banned IPs on ports 80/443 → ban_server:82 (int2.py) - IPv6: add ether3 DNAT, internal_interface DNAT by dst - Fix duplicate for-loop bug in create_ip6tables_rules - Add destroy rules for internal_interface (IPv4 + IPv6) - Add TESTING.md with verification checklist
parent 3121fb2d
Hide whitespace changes
Inline Side-by-side
Showing with 114 additions and 41 deletions
TESTING.md 0 → 100644
View file @ afba3a65
# Проверка eterban после деплоя
## Подготовка
На priv (ssh -p32 91.232.225.1):
```bash
# Проверить что eterban запущен
sudo systemctl status eterban
# Проверить ipset
sudo eterban count
# Проверить iptables правила
sudo iptables -t nat -L PREROUTING -n | grep -E 'eterban|firehol|vmbr0'
sudo ip6tables -t nat -L PREROUTING -n | grep eterban
```
## 1. Внешний IPv4 (DNAT по source)
Забанить sprintbox, проверить с него через hetzner, разбанить:
```bash
# На priv:
sudo eterban ban 138.249.117.171
# С hetzner (ssh -p32 root@hetzner.egw.eterhost.ru):
ssh root@138.249.117.171 'curl -s --connect-timeout 5 http://etersoft.ru/ | grep title'
# Ожидание: <title>Ваш IP-адрес заблокирован на сервере. You are banned!</title>
# На priv:
sudo eterban unban 138.249.117.171
```
## 2. Внешний IPv6 (DNAT по source)
Забанить IPv6 vdska, проверить с него, разбанить:
```bash
# На priv:
sudo eterban ban 2a0d:6c2:25::3
# С vdska (ssh root@vdska.egw.eterhost.ru):
curl -6 -s --connect-timeout 5 http://etersoft.ru/ | grep title
# Ожидание: <title>Ваш IP-адрес заблокирован на сервере. You are banned!</title>
# На priv:
sudo eterban unban 2a0d:6c2:25::3
```
## 3. Внутренний IPv4 (DNAT по destination)
Обратиться с офисной машины к забаненному IPv4:
```bash
# С builder или epm-sisyphus:
curl -s --connect-timeout 5 http://210.79.191.76/ | grep title
# Ожидание: <title>Eterban ban</title>
```
## 4. Внутренний IPv6 (DNAT по destination)
Забанить тестовый IPv6, обратиться к нему изнутри, разбанить:
```bash
# На priv:
sudo eterban ban 2a0d:6c2:25::3
# С epm-sisyphus:
curl -6 -s --connect-timeout 5 http://[2a0d:6c2:25::3]/ | grep title
# Ожидание: <title>Ваш IP-адрес заблокирован на сервере. You are banned!</title>
# На priv:
sudo eterban unban 2a0d:6c2:25::3
```
## 5. Проверка int2.py (внутренний сервер плашки)
```bash
# На priv:
sudo systemctl status eterban-internal
# Должен быть active (running)
# Слушает на ban_server:82
curl -s http://91.232.225.67:82/ | grep title
# Ожидание: <title>Eterban ban</title>
```
## Примечания
- SSH к sprintbox доступен только с 91.232.225.0/24 и hetzner (135.181.95.108)
- КАТЕГОРИЧЕСКИ нельзя банить hetzner (135.181.95.108) — через него идут GRE/VPN туннели
- НЕ банить другие рабочие серверы (sprintbox и т.д.) без крайней необходимости
- int2.py использует SO_ORIGINAL_DST для определения оригинального IP назначения
- IPv6 адрес 2a03:5a00:c:20::67 должен быть назначен на vmbr0
gateway/usr/share/eterban/eterban_switcher.py
View file @ afba3a65
......@@ -110,33 +110,28 @@ def create_iptables_rules():
def create_ip6tables_rules():
global ban_server_ipv6, ipset_eterban_1_ipv6, i_interface, i_interface2, maxelem
global ban_server_ipv6, ipset_eterban_1_ipv6, i_interface, i_interface2, internal_interface, maxelem
if not ban_server_ipv6:
return
commands=['ipset create ' + ipset_eterban_1_ipv6 + ' hash:ip family inet6 maxelem ' + str(maxelem),
#'ipset create ' + ipset_firehol + ' hash:net',
#'ipset create ' + ipset_eterban_white + ' hash:ip',
#'ip6tables -t nat -I PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_firehol + ' src -j DNAT --to-destination ' + ban_server,
'ip6tables -t nat -I PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_1_ipv6 + ' src -j DNAT --to-destination ' + ban_server_ipv6,
#'ip6tables -t nat -I PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_white + ' src -j ACCEPT',
#'iptables -t nat -I PREROUTING -i ' + i_interface + ' -m set ! --match-set ' + ipset_eterban_1 + ' src -d ' + ban_server + ' -p tcp -m multiport --destination-port 80,443 -j DNAT --to-destination ' + ban_server + ':81',
#'iptables -t nat -I PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_1 + ' src -p tcp --dport 443 -j DNAT --to-destination ' + ban_server + ':80',
'ip6tables -I FORWARD -i ' + i_interface + ' -p tcp -m multiport ! --dport 80,443 -m set --match-set ' + ipset_eterban_1_ipv6 + ' src -j REJECT']
for command in commands:
subprocess.call (command, shell = True)
if not i_interface2:
return
if i_interface2:
commands=[
'ip6tables -t nat -I PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_1_ipv6 + ' src -j DNAT --to-destination ' + ban_server_ipv6,
'ip6tables -I FORWARD -i ' + i_interface2 + ' -p tcp -m multiport ! --dport 80,443 -m set --match-set ' + ipset_eterban_1_ipv6 + ' src -j REJECT']
for command in commands:
subprocess.call (command, shell = True)
commands=[
#'iptables -t nat -I PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_firehol + ' src -j DNAT --to-destination ' + ban_server,
'ip6tables -t nat -I PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_1_ipv6 + ' src -j DNAT --to-destination ' + ban_server,
#'iptables -t nat -I PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_white + ' src -j ACCEPT',
#'iptables -t nat -I PREROUTING -i ' + i_interface2 + ' -m set ! --match-set ' + ipset_eterban_1 + ' src -d ' + ban_server + ' -p tcp -m multiport --destination-port 80,443 -j DNAT --to-destination ' + ban_server + ':81',
#'iptables -t nat -I PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_1 + ' src -p tcp --dport 443 -j DNAT --to-destination ' + ban_server + ':80',
'ip6tables -I FORWARD -i ' + i_interface2 + ' -p tcp -m multiport ! --dport 80,443 -m set --match-set ' + ipset_eterban_1_ipv6 + ' src -j REJECT']
for command in commands:
subprocess.call (command, shell = True)
# Internal interface: block outgoing connections to banned IPv6 IPs (DNAT by destination)
if internal_interface:
commands=[
'ip6tables -t nat -I PREROUTING -i ' + internal_interface + ' -m set --match-set ' + ipset_eterban_1_ipv6 + ' dst -p tcp -m multiport --dports 80,443 -j DNAT --to-destination [' + ban_server_ipv6 + ']:82']
for command in commands:
subprocess.call (command, shell = True)
def destroy_iptables_rules ():
......@@ -174,38 +169,28 @@ def destroy_iptables_rules ():
def destroy_ip6tables_rules ():
global ban_server_ipv6, ipset_eterban_1_ipv6, i_interface, i_interface2
global ban_server_ipv6, ipset_eterban_1_ipv6, i_interface, i_interface2, internal_interface
if not ban_server_ipv6:
return
commands=[
#'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_firehol + ' src -j DNAT --to-destination ' + ban_server,
'ip6tables -t nat -D PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_1_ipv6 + ' src -j DNAT --to-destination ' + ban_server_ipv6,
#'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_white + ' src -j ACCEPT',
#'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set ! --match-set ' + ipset_eterban_1 + ' src -d ' + ban_server + ' -p tcp -m multiport --destination-port 80,443 -j DNAT --to-destination ' + ban_server + ':81',
#'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_1 + ' src -p tcp --dport 443 -j DNAT --to-destination ' + ban_server + ':80',
'ip6tables -D FORWARD -i ' + i_interface + ' -p tcp -m multiport ! --dport 80,443 -m set --match-set ' + ipset_eterban_1_ipv6 + ' src -j REJECT',
'ipset destroy ' + ipset_eterban_1_ipv6,
#'ipset destroy ' + ipset_firehol,
#'ipset destroy ' + ipset_eterban_white
]
'ipset destroy ' + ipset_eterban_1_ipv6]
for command in commands:
subprocess.call (command, shell = True)
#print (command)
if not i_interface2:
return
commands=[
#'iptables -t nat -D PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_firehol + ' src -j DNAT --to-destination ' + ban_server,
'ip6tables -t nat -D PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_1_ipv6 + ' src -j DNAT --to-destination ' + ban_server_ipv6,
#'iptables -t nat -D PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_white + ' src -j ACCEPT',
#'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set ! --match-set ' + ipset_eterban_1 + ' src -d ' + ban_server + ' -p tcp -m multiport --destination-port 80,443 -j DNAT --to-destination ' + ban_server + ':81',
#'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_1 + ' src -p tcp --dport 443 -j DNAT --to-destination ' + ban_server + ':80',
'ip6tables -D FORWARD -i ' + i_interface2 + ' -p tcp -m multiport ! --dport 80,443 -m set --match-set ' + ipset_eterban_1_ipv6 + ' src -j REJECT']
if i_interface2:
commands=[
'ip6tables -t nat -D PREROUTING -i ' + i_interface2 + ' -m set --match-set ' + ipset_eterban_1_ipv6 + ' src -j DNAT --to-destination ' + ban_server_ipv6,
'ip6tables -D FORWARD -i ' + i_interface2 + ' -p tcp -m multiport ! --dport 80,443 -m set --match-set ' + ipset_eterban_1_ipv6 + ' src -j REJECT']
for command in commands:
subprocess.call (command, shell = True)
for command in commands:
subprocess.call (command, shell = True)
#print (command)
if internal_interface:
commands=[
'ip6tables -t nat -D PREROUTING -i ' + internal_interface + ' -m set --match-set ' + ipset_eterban_1_ipv6 + ' dst -p tcp -m multiport --dports 80,443 -j DNAT --to-destination [' + ban_server_ipv6 + ']:82']
for command in commands:
subprocess.call (command, shell = True)
def exit_gracefully(signum, frame):
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment