Ignore:
Timestamp:
Aug 3, 2008, 6:50:25 PM (16 years ago)
Author:
george
Message:
  • Opraveno: Skripty pro generování nastavení služeb sítě. * Přidáno: Skript pro import online stavu počítačů z netwatch systému.
File:
1 edited

Legend:

Unmodified
Added
Removed

  • system/generators/iptables.php

    r37 r103  
    11<?php
    2 include_once('../../html/global.php');
     2include_once('/a/www/centrala/global.php');
    33
    44// Generate firewall rules
    5 exec('iptables -t nat -F Block');
    6 exec('iptables -t nat -F POSTROUTING');
    7 exec('iptables -t nat -F PreroutingDNAT');
    8 //    exec('iptables -t nat -A Block -p tcp --destination-port 80 -j REDIRECT --to-ports 3128');
     5exec('/sbin/iptables -t nat -F Block');
     6exec('/sbin/iptables -t nat -F POSTROUTING');
     7exec('/sbin/iptables -t nat -F PreroutingDNAT');
     8//    exec('/sbin/iptables -t nat -A Block -p tcp --destination-port 80 -j REDIRECT --to-ports 3128');
    99
    1010// Blocking according IP address
    … …  
    1515  while($Row = $DbResult2->fetch_array())
    1616  {
    17     exec('iptables -t nat -A Block -s '.$Row['IP'].' -j Local');
     17    exec('/sbin/iptables -t nat -A Block -s '.$Row['IP'].' -j Local');
    1818  }
    1919}
    … …  
    2424  while($Row = $DbResult2->fetch_array())
    2525  {
    26     exec('iptables -t nat -A Block -s '.$Row['IP'].' -j Local');
     26    exec('/sbin/iptables -t nat -A Block -s '.$Row['IP'].' -j Local');
    2727  }
    2828}
    … …  
    3939    if($User['inet'] == 0)
    4040    {
    41       if(($Row['block'] == 0) and ($Row['type'] == 1)) exec('iptables -t nat -A Block -m mac --mac-source '.$Row['MAC']." -j Proxy");
    42         else exec('iptables -t nat -A Block -m mac --mac-source '.$Row['MAC']." -j Local");
     41      if(($Row['block'] == 0) and ($Row['type'] == 1)) exec('/sbin/iptables -t nat -A Block -m mac --mac-source '.$Row['MAC']." -j Proxy");
     42        else exec('/sbin/iptables -t nat -A Block -m mac --mac-source '.$Row['MAC']." -j Local");
    4343    } else {
    4444      if($Row['vpn'] == 0)
    … …  
    4848        if($Row['name'] == 'TBC')
    4949        {
    50           exec('iptables -t nat -A PreroutingDNAT -m tcp -p tcp --dport 3724 -d '.$Row['external_ip'].' -j DNAT --to-destination '.$Row['IP'].':3725'); 
    51           exec('iptables -t nat -A POSTROUTING -m tcp -p tcp -s '.$Row['IP'].' --sport 3725 -o eth1 -j SNAT --to-source '.$Row['external_ip'].':3724'); 
     50          exec('/sbin/iptables -t nat -A PreroutingDNAT -m tcp -p tcp --dport 3724 -d '.$Row['external_ip'].' -j DNAT --to-destination '.$Row['IP'].':3725'); 
     51          exec('/sbin/iptables -t nat -A POSTROUTING -m tcp -p tcp -s '.$Row['IP'].' --sport 3725 -o eth1 -j SNAT --to-source '.$Row['external_ip'].':3724'); 
    5252        }
    5353        if(strtolower($Row['name']) != 'centrala')
    … …  
    5555          if($Row['external_ip'] != '')
    5656          {
    57             exec('iptables -t nat -A PreroutingDNAT -i eth1 -d '.$Row['external_ip'].' -j DNAT --to-destination '.$Row['IP']); 
    58             exec('iptables -t nat -A PreroutingDNAT -i eth1 -d '.$Row['external_ip'].' -j ACCEPT'); 
    59             exec('iptables -t nat -A POSTROUTING -s '.$Row['IP'].' -o eth1 -j SNAT --to-source '.$Row['external_ip']); 
     57            exec('/sbin/iptables -t nat -A PreroutingDNAT -i eth1 -d '.$Row['external_ip'].' -j DNAT --to-destination '.$Row['IP']); 
     58            exec('/sbin/iptables -t nat -A PreroutingDNAT -i eth1 -d '.$Row['external_ip'].' -j ACCEPT'); 
     59            exec('/sbin/iptables -t nat -A POSTROUTING -s '.$Row['IP'].' -o eth1 -j SNAT --to-source '.$Row['external_ip']); 
    6060          }
    61           exec('iptables -t nat -A Block -m mac --mac-source '.$Row['MAC']." -j Proxy");
     61          exec('/sbin/iptables -t nat -A Block -m mac --mac-source '.$Row['MAC']." -j Proxy");
    6262        }
    6363      }
    … …  
    6666        $CZFreeLocalIP = $Row['external_ip'];
    6767 //echo('vpn');
    68         //exec('iptables -t nat -A PreroutingDNAT -s '.$Row['IP'].' -p udp -m udp --dport 55556 -j DROP'); 
    69         if($Row['external_ip'] != '') exec('iptables -t nat -A PreroutingDNAT -d '.$Row['external_ip'].' -j ACCEPT'); 
    70         exec('iptables -t nat -A Block -s '.ToVpnIp($Row)." -j Proxy");
     68        //exec('/sbin/iptables -t nat -A PreroutingDNAT -s '.$Row['IP'].' -p udp -m udp --dport 55556 -j DROP'); 
     69        if($Row['external_ip'] != '') exec('/sbin/iptables -t nat -A PreroutingDNAT -d '.$Row['external_ip'].' -j ACCEPT'); 
     70        exec('/sbin/iptables -t nat -A Block -s '.ToVpnIp($Row)." -j Proxy");
    7171
    7272        if($Row['vpn'] == 1)
    7373        {
    74           exec('iptables -t nat -A Block -m mac --mac-source '.$Row['MAC']." -j Local");
    75         } else if($Row['vpn'] == 2) exec('iptables -t nat -A Block -m mac --mac-source '.$Row['MAC']." -j Proxy");
     74          exec('/sbin/iptables -t nat -A Block -m mac --mac-source '.$Row['MAC']." -j Local");
     75        } else if($Row['vpn'] == 2) exec('/sbin/iptables -t nat -A Block -m mac --mac-source '.$Row['MAC']." -j Proxy");
    7676      }
    7777      if($Row['czfree_ip'] != '')
    7878      {
    7979        // CZFree
    80         exec('iptables -t nat -A PreroutingDNAT -i tun0 -d '.$Row['czfree_ip'].' -j DNAT --to-destination '.$CZFreeLocalIP); 
    81         exec('iptables -t nat -A PreroutingDNAT -i tun0 -d '.$Row['czfree_ip'].' -j ACCEPT'); 
    82         exec('iptables -t nat -A POSTROUTING -s '.$CZFreeLocalIP.' -o tun0 -j SNAT --to-source '.$Row['czfree_ip']); 
     80        exec('/sbin/iptables -t nat -A PreroutingDNAT -i tun0 -d '.$Row['czfree_ip'].' -j DNAT --to-destination '.$CZFreeLocalIP); 
     81        exec('/sbin/iptables -t nat -A PreroutingDNAT -i tun0 -d '.$Row['czfree_ip'].' -j ACCEPT'); 
     82        exec('/sbin/iptables -t nat -A POSTROUTING -s '.$CZFreeLocalIP.' -o tun0 -j SNAT --to-source '.$Row['czfree_ip']); 
    8383      }
    8484    }
    … …  
    9090$DbResult = $Database->select('hosts', '*', 'name="MAIL"');
    9191$Row = $DbResult->fetch_array();
    92 exec('iptables -t nat -A PreroutingDNAT -p tcp -m tcp --dport 25 -d 212.111.4.174 -j DROP'); 
    93 exec('iptables -t nat -A PreroutingDNAT -p tcp -m tcp --dport 25 -d '.$Row['external_ip'].' -j DNAT --to-destination '.$Row['IP']); 
    94 exec('iptables -t nat -A PreroutingDNAT -p tcp -m tcp --dport 25 -d '.$Row['external_ip'].' -j ACCEPT'); 
    95 exec('iptables -t nat -A POSTROUTING -p tcp -m tcp --dport 25 -s 212.111.4.174 -o eth1 -j SNAT --to-source '.$Row['external_ip']); 
     92exec('/sbin/iptables -t nat -A PreroutingDNAT -p tcp -m tcp --dport 25 -d 212.111.4.174 -j DROP'); 
     93exec('/sbin/iptables -t nat -A PreroutingDNAT -p tcp -m tcp --dport 25 -d '.$Row['external_ip'].' -j DNAT --to-destination '.$Row['IP']); 
     94exec('/sbin/iptables -t nat -A PreroutingDNAT -p tcp -m tcp --dport 25 -d '.$Row['external_ip'].' -j ACCEPT'); 
     95exec('/sbin/iptables -t nat -A POSTROUTING -p tcp -m tcp --dport 25 -s 212.111.4.174 -o eth1 -j SNAT --to-source '.$Row['external_ip']); 
    9696
    9797// Local network NAT
    9898$DbResult = $Database->select('hosts', '*', 'name="GATE"');
    9999$Row = $DbResult->fetch_array();
    100 exec('iptables -t nat -A POSTROUTING -s 192.168.0.0/255.255.0.0 -o eth1 -j SNAT --to-source '.$Row['external_ip']);
    101 //exec('iptables -t nat -A POSTROUTING -s 10.0.0.0/255.0.0.0 -o eth1 -j SNAT --to-source '.$Row['external_ip']);
    102 //exec('iptables -t nat -A POSTROUTING -s 212.111.16.94 -o eth1 -j MASQUERADE');
     100exec('/sbin/iptables -t nat -A POSTROUTING -s 192.168.0.0/255.255.0.0 -o eth1 -j SNAT --to-source '.$Row['external_ip']);
     101//exec('/sbin/iptables -t nat -A POSTROUTING -s 10.0.0.0/255.0.0.0 -o eth1 -j SNAT --to-source '.$Row['external_ip']);
     102//exec('/sbin/iptables -t nat -A POSTROUTING -s 212.111.16.94 -o eth1 -j MASQUERADE');
    103103
    104104exec('/sbin/iptables-save>/etc/sysconfig/iptables');
Note: See TracChangeset for help on using the changeset viewer.