mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-09-16 18:14:40 +02:00
minor refactoring in NATCompiler::ExpandMultipleAddresses::processNext to include SDNAT rules; rerun tests
This commit is contained in:
Vadim Kurland
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:40 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:20 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall-base-rulesets.fw
|
||||
# files: firewall-base-rulesets.conf
|
||||
@@ -163,7 +163,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "en2 192.168.100.1/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:40 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:20 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:41 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:21 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall-ipv6-1.fw pf-ipv6.fw
|
||||
# files: firewall-ipv6-1-Policy_ipv4.conf /etc/fw/pf-ipv6-Policy_ipv4.conf
|
||||
@@ -175,7 +175,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo ::1/128 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:41 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:21 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
# Tables: (5)
|
||||
table <tbl.r4.s> { 222.222.222.22 , 222.222.222.23 }
|
||||
table <tbl.r4.sx> { 2001:5c0:0:2::24 , 3ffe:1200:2000::/36 , 3ffe:1200:2001:1:8000::1 }
|
||||
table <tbl.r5.s> { 61.150.47.112 , 74.125.19.99 , 74.125.19.103 , 74.125.19.104 , 74.125.19.147 , 192.168.1.0 }
|
||||
table <tbl.r5.s> { 61.150.47.112 , 74.125.224.48 , 74.125.224.49 , 74.125.224.50 , 74.125.224.51 , 74.125.224.52 , 192.168.1.0 }
|
||||
table <tbl.r5.sx> { 2001:5c0:0:2::24 , 3ffe:1200:2001:1:8000::1 }
|
||||
table <tbl.r7.s> { 61.150.47.112 , 192.168.1.0 }
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:42 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:22 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall-ipv6-2.fw pf.fw
|
||||
# files: firewall-ipv6-2.conf pf.conf
|
||||
@@ -179,7 +179,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo ::1/128 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:42 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:22 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:09 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:18:49 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall.fw /etc/pf.fw
|
||||
# files: firewall.conf /etc/pf.conf
|
||||
@@ -167,7 +167,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:09 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:18:49 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:10 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:18:50 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall1.fw
|
||||
# files: firewall1.conf
|
||||
@@ -76,7 +76,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:10 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:18:50 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:10 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:18:51 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall10-1.fw
|
||||
# files: firewall10-1.conf
|
||||
@@ -74,7 +74,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:10 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:18:51 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:11 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:18:52 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall10-2.fw
|
||||
# files: firewall10-2.conf
|
||||
@@ -74,7 +74,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:11 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:18:52 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:12 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:18:52 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall10-3.fw
|
||||
# files: firewall10-3.conf
|
||||
@@ -76,7 +76,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:12 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:18:52 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:13 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:18:53 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall10-4.fw
|
||||
# files: firewall10-4.conf
|
||||
@@ -76,7 +76,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:13 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:18:53 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:13 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:18:54 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall10-5.fw
|
||||
# files: firewall10-5.conf
|
||||
@@ -77,7 +77,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:13 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:18:54 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:14 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:18:55 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall10-6.fw
|
||||
# files: firewall10-6.conf
|
||||
@@ -77,7 +77,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:14 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:18:55 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:15 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:18:55 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall11.fw
|
||||
# files: firewall11.conf
|
||||
@@ -77,7 +77,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:15 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:18:55 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:16 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:18:56 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall12.fw
|
||||
# files: firewall12.conf
|
||||
@@ -159,7 +159,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo0 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:16 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:18:56 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:16 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:18:57 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall13.fw
|
||||
# files: firewall13.conf
|
||||
@@ -88,7 +88,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:16 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:18:57 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:18 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:18:58 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall14-1.fw
|
||||
# files: firewall14-1.conf
|
||||
@@ -244,7 +244,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "vlan103 10.100.103.1/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:18 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:18:58 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:17 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:18:58 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall14.fw
|
||||
# files: firewall14.conf
|
||||
@@ -244,7 +244,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "vlan103 10.100.103.1/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:17 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:18:58 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:21 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:01 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall2-1.fw
|
||||
# files: firewall2-1.conf
|
||||
@@ -89,7 +89,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:21 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:01 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:19 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:18:59 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall2.fw
|
||||
# files: firewall2.conf
|
||||
@@ -73,7 +73,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:19 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:18:59 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:19 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:00 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall20.fw
|
||||
# files: firewall20.conf
|
||||
@@ -73,7 +73,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:19 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:00 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:20 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:01 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall21.fw
|
||||
# files: firewall21-NAT_1.conf
|
||||
@@ -82,7 +82,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:20 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:01 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:22 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:02 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall22.fw
|
||||
# files: firewall22-NAT_1.conf
|
||||
@@ -80,7 +80,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:22 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:02 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:23 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:03 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall3.fw
|
||||
# files: firewall3.conf
|
||||
@@ -159,7 +159,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:23 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:03 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
table <tbl.r0> { 157.166.224.25 , 157.166.224.26 , 157.166.226.25 , 157.166.226.26 , 157.166.255.18 , 157.166.255.19 }
|
||||
table <tbl.r10.d> { www.google.com , 157.166.224.25 , 157.166.224.26 , 157.166.226.25 , 157.166.226.26 , 157.166.255.18 , 157.166.255.19 }
|
||||
table <tbl.r2> { www.google.com , www.cnn.com }
|
||||
table <tbl.r8.d> { 74.125.19.99 , 74.125.19.103 , 74.125.19.104 , 74.125.19.147 , 157.166.224.25 , 157.166.224.26 , 157.166.226.25 , 157.166.226.26 , 157.166.255.18 , 157.166.255.19 }
|
||||
table <tbl.r8.d> { 74.125.224.48 , 74.125.224.49 , 74.125.224.50 , 74.125.224.51 , 74.125.224.52 , 157.166.224.25 , 157.166.224.26 , 157.166.226.25 , 157.166.226.26 , 157.166.255.18 , 157.166.255.19 }
|
||||
|
||||
#
|
||||
# Rule 0 (NAT)
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:23 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:04 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall33.fw
|
||||
# files: firewall33.conf
|
||||
@@ -162,7 +162,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:23 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:04 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:24 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:05 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall34.fw
|
||||
# files: firewall34.conf
|
||||
@@ -158,7 +158,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:24 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:05 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:25 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:05 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall38.fw
|
||||
# files: firewall38.conf
|
||||
@@ -76,7 +76,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:25 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:05 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:26 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:06 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall39.fw pf.fw
|
||||
# files: firewall39.conf pf.conf
|
||||
@@ -79,7 +79,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:26 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:06 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:26 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:07 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall4.fw pf.fw
|
||||
# files: firewall4.conf /etc/fw/pf.conf
|
||||
@@ -78,7 +78,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:26 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:07 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:28 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:09 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall40-1.fw
|
||||
# files: firewall40-1.conf
|
||||
@@ -176,7 +176,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo0 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:28 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:09 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:27 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:08 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall40.fw
|
||||
# files: firewall40.conf
|
||||
@@ -160,7 +160,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "lo0 127.0.0.1/0xff000000" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:27 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:08 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:29 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:09 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall41.fw
|
||||
# files: firewall41.conf
|
||||
@@ -163,7 +163,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "eth1 2.2.2.2/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:29 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:09 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:30 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:10 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall5.fw
|
||||
# files: firewall5.conf
|
||||
@@ -77,7 +77,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:30 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:10 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:31 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:11 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall51.fw
|
||||
# files: firewall51.conf
|
||||
@@ -80,7 +80,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:31 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:11 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:31 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:12 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall6.fw
|
||||
# files: firewall6.conf
|
||||
@@ -73,7 +73,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:31 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:12 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:32 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:13 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall62.fw
|
||||
# files: firewall62.conf
|
||||
@@ -185,7 +185,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "en1 222.222.222.222/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:32 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:13 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:33 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:13 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall63.fw
|
||||
# files: firewall63.conf
|
||||
@@ -77,7 +77,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:33 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:13 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:34 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:14 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall7.fw
|
||||
# files: firewall7.conf
|
||||
@@ -73,7 +73,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:34 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:14 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:34 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:15 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall70.fw
|
||||
# files: firewall70.conf
|
||||
@@ -82,7 +82,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:34 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:15 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:35 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:16 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall8.fw
|
||||
# files: firewall8.conf
|
||||
@@ -72,7 +72,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:35 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:16 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:37 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:17 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall80-4.5.fw
|
||||
# files: firewall80-4.5.conf
|
||||
@@ -73,7 +73,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:37 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:17 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:36 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:16 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall80.fw
|
||||
# files: firewall80.conf
|
||||
@@ -73,7 +73,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:36 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:16 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:37 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:18 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall9.fw
|
||||
# files: firewall9.conf
|
||||
@@ -76,7 +76,7 @@ configure_interfaces() {
|
||||
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:37 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:18 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:38 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:19 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall91.fw /etc/fw/pf.fw
|
||||
# files: firewall91.conf /etc/fw/pf.conf
|
||||
@@ -243,7 +243,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "vlan103 10.100.103.1/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:38 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:19 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:39 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:19 2011 PST by vadim
|
||||
#
|
||||
# files: * firewall92.fw /etc/fw/pf.fw
|
||||
# files: firewall92.conf /etc/fw/path\ with\ space/pf.conf
|
||||
@@ -160,7 +160,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "em1 10.1.1.81/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:39 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:19 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -0,0 +1,71 @@
|
||||
|
||||
|
||||
|
||||
|
||||
# Tables: (2)
|
||||
table <tbl.r1.d> { 172.24.0.1 , 172.24.0.2 , 192.168.1.1 , 192.168.1.2 }
|
||||
table <tbl.r2.s> { 172.24.0.1 , 172.24.0.2 }
|
||||
|
||||
#
|
||||
# Rule 0 (NAT)
|
||||
nat on en0 proto {tcp udp icmp} from 192.168.1.0/24 to any -> 172.24.0.1
|
||||
#
|
||||
# Rule 1 (NAT)
|
||||
nat on en0 proto {tcp udp icmp} from 192.168.1.0/24 to any -> 172.24.0.1
|
||||
#
|
||||
# Rule 2 (NAT)
|
||||
nat proto {tcp udp icmp} from 192.168.1.0/24 to any -> 172.24.0.1
|
||||
#
|
||||
# Rule 3 (NAT)
|
||||
nat on en0 proto {tcp udp icmp} from 192.168.1.0/24 to any -> { 172.24.0.2 , 172.24.0.3 }
|
||||
#
|
||||
# Rule 4 (NAT)
|
||||
nat on en0 proto {tcp udp icmp} from 192.168.1.0/24 to any -> 172.24.0.2
|
||||
#
|
||||
# Rule 5 (NAT)
|
||||
nat proto {tcp udp icmp} from 192.168.1.0/24 to any -> 172.24.0.3
|
||||
#
|
||||
# Rule 6 (NAT)
|
||||
rdr on en0 proto tcp from any to 172.24.0.1 port 80 -> 172.24.0.100 port 80
|
||||
#
|
||||
# Rule 7 (NAT)
|
||||
rdr on en0 proto tcp from any to 172.24.0.1 port 80 -> 172.24.0.100 port 80
|
||||
#
|
||||
# Rule 8 (NAT)
|
||||
rdr proto tcp from any to 172.24.0.1 port 80 -> 172.24.0.100 port 80
|
||||
|
||||
#
|
||||
# Rule -3 pfsync (automatic)
|
||||
pass quick on en0 inet proto pfsync from any to any label "RULE -3 -- ACCEPT "
|
||||
#
|
||||
# Rule -2 CARP (automatic)
|
||||
pass quick on en1 inet proto carp from any to any label "RULE -2 -- ACCEPT "
|
||||
#
|
||||
# Rule -1 CARP (automatic)
|
||||
pass quick on en0 inet proto carp from any to any label "RULE -1 -- ACCEPT "
|
||||
#
|
||||
# Rule 0 (lo)
|
||||
pass quick on lo inet from any to any label "RULE 0 -- ACCEPT "
|
||||
#
|
||||
# Rule 1 (global)
|
||||
pass quick inet from any to <tbl.r1.d> label "RULE 1 -- ACCEPT "
|
||||
#
|
||||
# Rule 2 (global)
|
||||
pass quick inet from <tbl.r2.s> to any label "RULE 2 -- ACCEPT "
|
||||
#
|
||||
# Rule 3 (global)
|
||||
pass quick inet from any to <tbl.r2.s> label "RULE 3 -- ACCEPT "
|
||||
#
|
||||
# Rule 4 (carp0)
|
||||
pass in quick on en0 inet from any to any label "RULE 4 -- ACCEPT "
|
||||
#
|
||||
# Rule 5 (carp0)
|
||||
pass in quick on en1 inet from any to any label "RULE 5 -- ACCEPT "
|
||||
#
|
||||
# Rule 6 (global)
|
||||
block log quick inet from any to any no state label "RULE 6 -- DROP "
|
||||
#
|
||||
# Rule fallback rule
|
||||
# fallback rule
|
||||
block quick inet from any to any no state label "RULE 10000 -- DROP "
|
||||
|
||||
Executable
+308
@@ -0,0 +1,308 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Fri Jan 7 13:02:11 2011 PST by vadim
|
||||
#
|
||||
# files: * openbsd-1.fw
|
||||
# files: openbsd-1.conf
|
||||
#
|
||||
# Compiled for pf 4.x
|
||||
#
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
FWDIR=`dirname $0`
|
||||
|
||||
IFCONFIG="/sbin/ifconfig"
|
||||
PFCTL="/sbin/pfctl"
|
||||
SYSCTL="/sbin/sysctl"
|
||||
LOGGER="/usr/bin/logger"
|
||||
|
||||
log() {
|
||||
echo "$1"
|
||||
test -x "$LOGGER" && $LOGGER -p info "$1"
|
||||
}
|
||||
|
||||
diff_intf() {
|
||||
func=$1
|
||||
list1=$2
|
||||
list2=$3
|
||||
cmd=$4
|
||||
for intf in $list1
|
||||
do
|
||||
echo $list2 | grep -q $intf || {
|
||||
# $vlan is absent in list 2
|
||||
$func $intf $cmd
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
missing_address() {
|
||||
address=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $address
|
||||
addr=$1
|
||||
interface=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
if echo "$addr" | grep -q ':'
|
||||
then
|
||||
inet="inet6"
|
||||
addr=$(echo "$addr" | sed 's!/! prefixlen !')
|
||||
else
|
||||
inet="inet"
|
||||
addr=$(echo "$addr" | sed 's!/! netmask !')
|
||||
fi
|
||||
|
||||
parameter=""
|
||||
test "$cmd" = "add" && {
|
||||
echo "# Adding ip address: $interface $addr"
|
||||
parameter="alias"
|
||||
}
|
||||
test "$cmd" = "del" && {
|
||||
echo "# Removing ip address: $interface $addr"
|
||||
parameter="delete"
|
||||
}
|
||||
|
||||
$FWBDEBUG $IFCONFIG $interface $inet $addr $parameter
|
||||
$FWBDEBUG $IFCONFIG $interface up
|
||||
}
|
||||
|
||||
list_addresses_by_scope() {
|
||||
interface=$1
|
||||
scope=$2
|
||||
ignore_list=$3
|
||||
|
||||
scope_regex="1"
|
||||
if test -n "$scope"; then scope_regex=" \$0 !~ \"$scope\" "; fi
|
||||
|
||||
$IFCONFIG $interface | sed "s/%$interface//" | \
|
||||
awk -v IGNORED="$ignore_list" \
|
||||
"BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
||||
}
|
||||
(/inet |inet6 / && $scope_regex && !(\$2 in ignored_dict)) {printf \"%s/%s\n\",\$2,\$4;}" | \
|
||||
while read addr; do
|
||||
echo "${addr}@$interface"
|
||||
done | sort
|
||||
|
||||
}
|
||||
|
||||
update_addresses_of_interface() {
|
||||
ignore_list=$2
|
||||
set $1
|
||||
interface=$1
|
||||
shift
|
||||
|
||||
FWB_ADDRS=$(
|
||||
for addr in $*; do
|
||||
echo "${addr}@$interface"
|
||||
done | sort
|
||||
)
|
||||
|
||||
CURRENT_ADDRS_ALL_SCOPES=""
|
||||
CURRENT_ADDRS_GLOBAL_SCOPE=""
|
||||
|
||||
$IFCONFIG $interface >/dev/null 2>&1 && {
|
||||
CURRENT_ADDRS_ALL_SCOPES=$(list_addresses_by_scope $interface '' "$ignore_list")
|
||||
CURRENT_ADDRS_GLOBAL_SCOPE=$(list_addresses_by_scope $interface 'scopeid .*' "$ignore_list")
|
||||
} || {
|
||||
echo "# Interface $interface does not exist"
|
||||
# Stop the script if we are not in test mode
|
||||
test -z "$FWBDEBUG" && exit 1
|
||||
}
|
||||
|
||||
diff_intf missing_address "$FWB_ADDRS" "$CURRENT_ADDRS_ALL_SCOPES" add
|
||||
diff_intf missing_address "$CURRENT_ADDRS_GLOBAL_SCOPE" "$FWB_ADDRS" del
|
||||
}
|
||||
|
||||
missing_vlan() {
|
||||
vlan=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $vlan
|
||||
subint=$1
|
||||
parent=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
vlan_id=$(echo $subint | sed 's/vlan//')
|
||||
test "$cmd" = "add" && {
|
||||
echo "# Adding VLAN interface $subint (parent: $parent)"
|
||||
$FWBDEBUG $IFCONFIG $subint vlan $vlan_id vlandev $parent
|
||||
$FWBDEBUG $IFCONFIG $subint up
|
||||
}
|
||||
test "$cmd" = "rem" && {
|
||||
echo "# Removing VLAN interface $subint (parent: $parent)"
|
||||
$FWBDEBUG $IFCONFIG $subint vlan $vlan_id -vlandev
|
||||
$FWBDEBUG $IFCONFIG $subint destroy
|
||||
}
|
||||
}
|
||||
|
||||
parse_fwb_vlans() {
|
||||
set $1
|
||||
vlan_parent_interface=$1
|
||||
shift
|
||||
|
||||
FWB_VLANS=$(
|
||||
for subint in $*; do
|
||||
echo "${subint}@$vlan_parent_interface"
|
||||
done | sort
|
||||
)
|
||||
echo $FWB_VLANS
|
||||
}
|
||||
|
||||
parse_current_vlans() {
|
||||
vlan_parent_interface=$1
|
||||
$IFCONFIG -A | grep 'vlan: ' | sed 's/priority:.*parent interface://' | \
|
||||
while read x vlan_id parent
|
||||
do
|
||||
test "$parent" = "$vlan_parent_interface" && echo "vlan$vlan_id@$parent"
|
||||
done | sort
|
||||
}
|
||||
|
||||
update_vlans_of_interface() {
|
||||
args="$1"
|
||||
set $1
|
||||
vlan_parent_interface=$1
|
||||
|
||||
FWB_VLANS=$(parse_fwb_vlans "$args")
|
||||
CURRENT_VLANS=$(parse_current_vlans $vlan_parent_interface)
|
||||
|
||||
$IFCONFIG $vlan_parent_interface up
|
||||
diff_intf missing_vlan "$FWB_VLANS" "$CURRENT_VLANS" add
|
||||
diff_intf missing_vlan "$CURRENT_VLANS" "$FWB_VLANS" rem
|
||||
}
|
||||
|
||||
sync_vlan_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
}
|
||||
($1 ~ /^vlan[0-9]/ && !($1 in ignored_dict)) {print $1;}' | sed 's/://' |\
|
||||
while read intf; do
|
||||
echo "# Deleting vlan interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf destroy
|
||||
done
|
||||
|
||||
for intf in $*; do
|
||||
$IFCONFIG $intf >/dev/null 2>&1 || {
|
||||
echo "# Creating vlan interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf create
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
sync_carp_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
}
|
||||
($1 ~ /^carp[0-9]/ && !($1 in ignored_dict)) {print $1;}' | sed 's/://' |\
|
||||
while read intf; do
|
||||
echo "# Deleting carp interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf destroy
|
||||
done
|
||||
|
||||
for intf in $*; do
|
||||
$IFCONFIG $intf >/dev/null 2>&1 || {
|
||||
echo "# Creating carp interface $intf"
|
||||
$SYSCTL -w net.inet.carp.allow=1
|
||||
$FWBDEBUG $IFCONFIG $intf create
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
sync_pfsync_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
}
|
||||
($1 ~ /^pfsync[0-9]/ && !($1 in ignored_dict)) {print $1;}' | sed 's/://' |\
|
||||
while read intf; do
|
||||
echo "# Deleting pfsync interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf destroy
|
||||
done
|
||||
|
||||
for intf in $*; do
|
||||
$IFCONFIG $intf >/dev/null 2>&1 || {
|
||||
echo "# Creating pfsync interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf create
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
verify_interfaces() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
set_kernel_vars() {
|
||||
:
|
||||
$SYSCTL -w net.inet.ip.forwarding=1
|
||||
}
|
||||
|
||||
prolog_commands() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
epilog_commands() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
run_epilog_and_exit() {
|
||||
epilog_commands
|
||||
exit $1
|
||||
}
|
||||
|
||||
configure_interfaces() {
|
||||
:
|
||||
sync_vlan_interfaces
|
||||
sync_carp_interfaces carp0 carp1
|
||||
$IFCONFIG carp0 vhid 101 pass secret carpdev en0
|
||||
$IFCONFIG carp1 vhid 100 pass secret carpdev en1
|
||||
|
||||
|
||||
update_addresses_of_interface "en0 172.24.0.2/0xffffff00 172.24.0.3/0xffffff00" ""
|
||||
update_addresses_of_interface "en1 192.168.1.2/0xffffff00" ""
|
||||
update_addresses_of_interface "carp0 172.24.0.1/0xffffff00" ""
|
||||
update_addresses_of_interface "carp1 192.168.1.1/0xffffff00" ""
|
||||
|
||||
sync_pfsync_interfaces pfsync0
|
||||
$IFCONFIG pfsync0 syncdev en0 syncpeer 172.24.0.3
|
||||
$IFCONFIG pfsync0 up
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Fri Jan 7 13:02:11 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
prolog_commands
|
||||
|
||||
$PFCTL \
|
||||
-f \
|
||||
${FWDIR}/openbsd-1.conf || exit 1
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
epilog_commands
|
||||
@@ -0,0 +1,71 @@
|
||||
|
||||
|
||||
|
||||
|
||||
# Tables: (2)
|
||||
table <tbl.r1.d> { 172.24.0.1 , 172.24.0.3 , 192.168.1.1 , 192.168.1.3 }
|
||||
table <tbl.r2.s> { 172.24.0.1 , 172.24.0.3 }
|
||||
|
||||
#
|
||||
# Rule 0 (NAT)
|
||||
nat on en0 proto {tcp udp icmp} from 192.168.1.0/24 to any -> 172.24.0.1
|
||||
#
|
||||
# Rule 1 (NAT)
|
||||
nat on en0 proto {tcp udp icmp} from 192.168.1.0/24 to any -> 172.24.0.1
|
||||
#
|
||||
# Rule 2 (NAT)
|
||||
nat proto {tcp udp icmp} from 192.168.1.0/24 to any -> 172.24.0.1
|
||||
#
|
||||
# Rule 3 (NAT)
|
||||
nat proto {tcp udp icmp} from 192.168.1.0/24 to any -> { 172.24.0.2 , 172.24.0.3 }
|
||||
#
|
||||
# Rule 4 (NAT)
|
||||
nat proto {tcp udp icmp} from 192.168.1.0/24 to any -> 172.24.0.2
|
||||
#
|
||||
# Rule 5 (NAT)
|
||||
nat on en0 proto {tcp udp icmp} from 192.168.1.0/24 to any -> 172.24.0.3
|
||||
#
|
||||
# Rule 6 (NAT)
|
||||
rdr on en0 proto tcp from any to 172.24.0.1 port 80 -> 172.24.0.100 port 80
|
||||
#
|
||||
# Rule 7 (NAT)
|
||||
rdr on en0 proto tcp from any to 172.24.0.1 port 80 -> 172.24.0.100 port 80
|
||||
#
|
||||
# Rule 8 (NAT)
|
||||
rdr proto tcp from any to 172.24.0.1 port 80 -> 172.24.0.100 port 80
|
||||
|
||||
#
|
||||
# Rule -3 pfsync (automatic)
|
||||
pass quick on en0 inet proto pfsync from any to any label "RULE -3 -- ACCEPT "
|
||||
#
|
||||
# Rule -2 CARP (automatic)
|
||||
pass quick on en1 inet proto carp from any to any label "RULE -2 -- ACCEPT "
|
||||
#
|
||||
# Rule -1 CARP (automatic)
|
||||
pass quick on en0 inet proto carp from any to any label "RULE -1 -- ACCEPT "
|
||||
#
|
||||
# Rule 0 (lo)
|
||||
pass quick on lo inet from any to any label "RULE 0 -- ACCEPT "
|
||||
#
|
||||
# Rule 1 (global)
|
||||
pass quick inet from any to <tbl.r1.d> label "RULE 1 -- ACCEPT "
|
||||
#
|
||||
# Rule 2 (global)
|
||||
pass quick inet from <tbl.r2.s> to any label "RULE 2 -- ACCEPT "
|
||||
#
|
||||
# Rule 3 (global)
|
||||
pass quick inet from any to <tbl.r2.s> label "RULE 3 -- ACCEPT "
|
||||
#
|
||||
# Rule 4 (carp0)
|
||||
pass in quick on en0 inet from any to any label "RULE 4 -- ACCEPT "
|
||||
#
|
||||
# Rule 5 (carp0)
|
||||
pass in quick on en1 inet from any to any label "RULE 5 -- ACCEPT "
|
||||
#
|
||||
# Rule 6 (global)
|
||||
block log quick inet from any to any no state label "RULE 6 -- DROP "
|
||||
#
|
||||
# Rule fallback rule
|
||||
# fallback rule
|
||||
block quick inet from any to any no state label "RULE 10000 -- DROP "
|
||||
|
||||
Executable
+204
@@ -0,0 +1,204 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# This is automatically generated file. DO NOT MODIFY !
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Fri Jan 7 13:02:11 2011 PST by vadim
|
||||
#
|
||||
# files: * openbsd-2.fw
|
||||
# files: openbsd-2.conf
|
||||
#
|
||||
# Compiled for pf 4.x
|
||||
#
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
FWDIR=`dirname $0`
|
||||
|
||||
IFCONFIG="/sbin/ifconfig"
|
||||
PFCTL="/sbin/pfctl"
|
||||
SYSCTL="/sbin/sysctl"
|
||||
LOGGER="/usr/bin/logger"
|
||||
|
||||
log() {
|
||||
echo "$1"
|
||||
test -x "$LOGGER" && $LOGGER -p info "$1"
|
||||
}
|
||||
|
||||
diff_intf() {
|
||||
func=$1
|
||||
list1=$2
|
||||
list2=$3
|
||||
cmd=$4
|
||||
for intf in $list1
|
||||
do
|
||||
echo $list2 | grep -q $intf || {
|
||||
# $vlan is absent in list 2
|
||||
$func $intf $cmd
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
|
||||
missing_address() {
|
||||
address=$1
|
||||
cmd=$2
|
||||
|
||||
oldIFS=$IFS
|
||||
IFS="@"
|
||||
set $address
|
||||
addr=$1
|
||||
interface=$2
|
||||
IFS=$oldIFS
|
||||
|
||||
if echo "$addr" | grep -q ':'
|
||||
then
|
||||
inet="inet6"
|
||||
addr=$(echo "$addr" | sed 's!/! prefixlen !')
|
||||
else
|
||||
inet="inet"
|
||||
addr=$(echo "$addr" | sed 's!/! netmask !')
|
||||
fi
|
||||
|
||||
parameter=""
|
||||
test "$cmd" = "add" && {
|
||||
echo "# Adding ip address: $interface $addr"
|
||||
parameter="alias"
|
||||
}
|
||||
test "$cmd" = "del" && {
|
||||
echo "# Removing ip address: $interface $addr"
|
||||
parameter="delete"
|
||||
}
|
||||
|
||||
$FWBDEBUG $IFCONFIG $interface $inet $addr $parameter
|
||||
$FWBDEBUG $IFCONFIG $interface up
|
||||
}
|
||||
|
||||
list_addresses_by_scope() {
|
||||
interface=$1
|
||||
scope=$2
|
||||
ignore_list=$3
|
||||
|
||||
scope_regex="1"
|
||||
if test -n "$scope"; then scope_regex=" \$0 !~ \"$scope\" "; fi
|
||||
|
||||
$IFCONFIG $interface | sed "s/%$interface//" | \
|
||||
awk -v IGNORED="$ignore_list" \
|
||||
"BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ignored_dict[ignored_arr[a]]=1;}
|
||||
}
|
||||
(/inet |inet6 / && $scope_regex && !(\$2 in ignored_dict)) {printf \"%s/%s\n\",\$2,\$4;}" | \
|
||||
while read addr; do
|
||||
echo "${addr}@$interface"
|
||||
done | sort
|
||||
|
||||
}
|
||||
|
||||
update_addresses_of_interface() {
|
||||
ignore_list=$2
|
||||
set $1
|
||||
interface=$1
|
||||
shift
|
||||
|
||||
FWB_ADDRS=$(
|
||||
for addr in $*; do
|
||||
echo "${addr}@$interface"
|
||||
done | sort
|
||||
)
|
||||
|
||||
CURRENT_ADDRS_ALL_SCOPES=""
|
||||
CURRENT_ADDRS_GLOBAL_SCOPE=""
|
||||
|
||||
$IFCONFIG $interface >/dev/null 2>&1 && {
|
||||
CURRENT_ADDRS_ALL_SCOPES=$(list_addresses_by_scope $interface '' "$ignore_list")
|
||||
CURRENT_ADDRS_GLOBAL_SCOPE=$(list_addresses_by_scope $interface 'scopeid .*' "$ignore_list")
|
||||
} || {
|
||||
echo "# Interface $interface does not exist"
|
||||
# Stop the script if we are not in test mode
|
||||
test -z "$FWBDEBUG" && exit 1
|
||||
}
|
||||
|
||||
diff_intf missing_address "$FWB_ADDRS" "$CURRENT_ADDRS_ALL_SCOPES" add
|
||||
diff_intf missing_address "$CURRENT_ADDRS_GLOBAL_SCOPE" "$FWB_ADDRS" del
|
||||
}
|
||||
|
||||
|
||||
|
||||
sync_carp_interfaces() {
|
||||
$IFCONFIG -A | awk -v IGNORED="$*" \
|
||||
'BEGIN {
|
||||
split(IGNORED,ignored_arr);
|
||||
for (a in ignored_arr) {ii=ignored_arr[a]":"; ignored_dict[ii]=1;}
|
||||
}
|
||||
($1 ~ /^carp[0-9]/ && !($1 in ignored_dict)) {print $1;}' | sed 's/://' |\
|
||||
while read intf; do
|
||||
echo "# Deleting carp interface $intf"
|
||||
$FWBDEBUG $IFCONFIG $intf destroy
|
||||
done
|
||||
|
||||
for intf in $*; do
|
||||
$IFCONFIG $intf >/dev/null 2>&1 || {
|
||||
echo "# Creating carp interface $intf"
|
||||
$SYSCTL -w net.inet.carp.allow=1
|
||||
$FWBDEBUG $IFCONFIG $intf create
|
||||
}
|
||||
done
|
||||
}
|
||||
|
||||
verify_interfaces() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
set_kernel_vars() {
|
||||
:
|
||||
$SYSCTL -w net.inet.ip.forwarding=1
|
||||
}
|
||||
|
||||
prolog_commands() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
epilog_commands() {
|
||||
:
|
||||
|
||||
}
|
||||
|
||||
run_epilog_and_exit() {
|
||||
epilog_commands
|
||||
exit $1
|
||||
}
|
||||
|
||||
configure_interfaces() {
|
||||
:
|
||||
sync_carp_interfaces carp0 carp1
|
||||
$IFCONFIG carp0 vhid 101 pass secret advskew 1 carpdev en0
|
||||
$IFCONFIG carp1 vhid 100 pass secret advskew 1 carpdev en1
|
||||
|
||||
|
||||
update_addresses_of_interface "en0 172.24.0.3/0xffffff00 172.24.0.2/0xffffff00" ""
|
||||
update_addresses_of_interface "en1 192.168.1.3/0xffffff00" ""
|
||||
update_addresses_of_interface "carp0 172.24.0.1/0xffffff00" ""
|
||||
update_addresses_of_interface "carp1 192.168.1.1/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Fri Jan 7 13:02:11 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
prolog_commands
|
||||
|
||||
$PFCTL \
|
||||
-f \
|
||||
${FWDIR}/openbsd-2.conf || exit 1
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
epilog_commands
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:42 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:22 2011 PST by vadim
|
||||
#
|
||||
# files: * pf_cluster_1_openbsd-1.fw
|
||||
# files: pf_cluster_1_openbsd-1.conf
|
||||
@@ -291,7 +291,7 @@ configure_interfaces() {
|
||||
$IFCONFIG pfsync0 up
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:42 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:22 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:42 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:22 2011 PST by vadim
|
||||
#
|
||||
# files: * pf_cluster_1_openbsd-2.fw
|
||||
# files: pf_cluster_1_openbsd-2.conf
|
||||
@@ -187,7 +187,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "carp1 192.168.1.1/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:42 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:22 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:42 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:23 2011 PST by vadim
|
||||
#
|
||||
# files: * pf_cluster_2_freebsd-2.fw
|
||||
# files: pf_cluster_2_freebsd-2.conf
|
||||
@@ -190,7 +190,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "carp1 192.168.1.1/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:42 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:23 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:42 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:23 2011 PST by vadim
|
||||
#
|
||||
# files: * pf_cluster_3_openbsd-3.fw
|
||||
# files: pf_cluster_3_openbsd-3.conf
|
||||
@@ -303,7 +303,7 @@ configure_interfaces() {
|
||||
sync_pfsync_interfaces
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:42 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:23 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# Firewall Builder fwb_pf v4.2.0.3425
|
||||
#
|
||||
# Generated Tue Jan 4 11:58:42 2011 PST by vadim
|
||||
# Generated Fri Jan 7 13:19:23 2011 PST by vadim
|
||||
#
|
||||
# files: * pf_cluster_3_openbsd-4.fw
|
||||
# files: pf_cluster_3_openbsd-4.conf
|
||||
@@ -192,7 +192,7 @@ configure_interfaces() {
|
||||
update_addresses_of_interface "carp2 172.20.0.1/0xffffff00" ""
|
||||
}
|
||||
|
||||
log "Activating firewall script generated Tue Jan 4 11:58:42 2011 by vadim"
|
||||
log "Activating firewall script generated Fri Jan 7 13:19:23 2011 by vadim"
|
||||
|
||||
set_kernel_vars
|
||||
configure_interfaces
|
||||
|
||||
Reference in New Issue
Block a user