Adapt host configuration

Adapt the configuration of the test hosts to the new Debian-based
system.
This commit is contained in:
Reto Buerki
2012-12-18 16:00:21 +01:00
committed by Tobias Brunner
parent 108040800d
commit 766466b8d1
94 changed files with 680 additions and 24813 deletions
-1
View File
@@ -1 +0,0 @@
HOSTNAME=venus
-10
View File
@@ -1,10 +0,0 @@
# /etc/conf.d/net:
# This is basically the ifconfig argument without the ifconfig $iface
#
config_eth0=( "PH_IP_VENUS broadcast 10.1.255.255 netmask 255.255.0.0"
"PH_IP6_VENUS/16" )
# For setting the default gateway
#
routes_eth0=( "default via PH_IP_MOON1" )
+1
View File
@@ -0,0 +1 @@
venus
-74
View File
@@ -1,74 +0,0 @@
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
opts="start stop reload"
depend() {
before net
need logger
}
start() {
ebegin "Starting firewall"
# default policy is DROP
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
# allow IKE
iptables -A INPUT -i eth0 -p udp --sport 500 --dport 500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 500 --sport 500 -j ACCEPT
# allow NAT-T
iptables -A INPUT -i eth0 -p udp --sport 4500 --dport 4500 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp --dport 4500 --sport 4500 -j ACCEPT
# allow crl fetch from winnetou
iptables -A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
# allow ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
eend $?
}
stop() {
ebegin "Stopping firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
if [ $a == nat ]; then
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
elif [ $a == mangle ]; then
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT
elif [ $a == filter ]; then
/sbin/iptables -t filter -P INPUT ACCEPT
/sbin/iptables -t filter -P FORWARD ACCEPT
/sbin/iptables -t filter -P OUTPUT ACCEPT
fi
done
eend $?
}
reload() {
ebegin "Flushing firewall"
for a in `cat /proc/net/ip_tables_names`; do
/sbin/iptables -F -t $a
/sbin/iptables -X -t $a
done;
eend $?
start
}
File diff suppressed because it is too large Load Diff
+1 -1
View File
@@ -13,7 +13,7 @@ conn nat-t
leftcert=venusCert.pem
[email protected]
leftfirewall=yes
right=PH_IP_SUN
right=192.168.0.2
[email protected]
rightsubnet=10.2.0.0/16
auto=add
@@ -0,0 +1,12 @@
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address PH_IP_VENUS
netmask 255.255.0.0
broadcast 10.1.255.255
gateway 10.1.0.1
iface eth0 inet6 static
address PH_IP6_VENUS
netmask 16
File diff suppressed because it is too large Load Diff