Adapt host configuration

Adapt the configuration of the test hosts to the new Debian-based
system.
This commit is contained in:
Reto Buerki
2012-12-18 16:00:21 +01:00
committed by Tobias Brunner
parent 108040800d
commit 766466b8d1
94 changed files with 680 additions and 24813 deletions
-1
View File
@@ -1 +0,0 @@
HOSTNAME=sun
-14
View File
@@ -1,14 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_SUN broadcast 192.168.0.255 netmask 255.255.255.0"
"PH_IP6_SUN/16" )
config_eth1=( "PH_IP_SUN1 broadcast 10.2.255.255 netmask 255.255.0.0"
"PH_IP6_SUN1/16" )
# For setting the default gateway
#
routes_eth0=( "default via 192.168.0.254" )
+1
View File
@@ -0,0 +1 @@
sun
-80
View File
@@ -1,80 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow esp
iptables -A INPUT -i eth0 -p 50 -j ACCEPT
iptables -A OUTPUT -o eth0 -p 50 -j ACCEPT
# allow IKE
iptables -A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
# allow NAT-T
iptables -A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
Executable → Regular
+3 -3
View File
@@ -7,20 +7,20 @@ conn %default
keylife=20m
rekeymargin=3m
keyingtries=1
left=PH_IP_SUN
left=192.168.0.2
leftcert=sunCert.pem
[email protected]
leftfirewall=yes
conn net-net
leftsubnet=10.2.0.0/16
right=PH_IP_MOON
right=192.168.0.1
rightsubnet=10.1.0.0/16
[email protected]
auto=add
conn host-host
right=PH_IP_MOON
right=192.168.0.1
[email protected]
auto=add
+21
View File
@@ -0,0 +1,21 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address PH_IP_SUN
netmask 255.255.255.0
broadcast 192.168.0.255
gateway 192.168.0.254
iface eth0 inet6 static
address PH_IP6_SUN
netmask 16
auto eth1
iface eth1 inet static
address PH_IP_SUN1
netmask 255.255.0.0
broadcast 10.2.255.255
iface eth1 inet6 static
address PH_IP6_SUN1
netmask 16
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff