firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix IPMI: add vnc port 5900, http(s) ports 80,443

Browse Source
This commit is contained in:
root 2017-03-18 17:33:51 +01:00
parent b54e85241f
commit c1550a6f9e
5 changed files with 39 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
conf/main_ipv4.conf.sample
View File

@ -693,8 +693,8 @@ ipmi_server_ips=""
# - TCP 623: Virtual Media for Remote Console # - TCP 623: Virtual Media for Remote Console
# - TCP 3520: "This is TCP Port 3520 which is also needed in addition to TCP port 5900 to be able to use iKVM." # - TCP 3520: "This is TCP Port 3520 which is also needed in addition to TCP port 5900 to be able to use iKVM."
# - # -
ipmi_udp_port=623 ipmi_udp_ports="623 5900"
ipmi_tcp_ports="623 3520" ipmi_tcp_ports="80 443 623 3520"
# ============= # =============

4
conf/main_ipv6.conf.sample
View File

@ -678,8 +678,8 @@ ipmi_server_ips=""
# - TCP 623: Virtual Media for Remote Console # - TCP 623: Virtual Media for Remote Console
# - TCP 3520: "This is TCP Port 3520 which is also needed in addition to TCP port 5900 to be able to use iKVM." # - TCP 3520: "This is TCP Port 3520 which is also needed in addition to TCP port 5900 to be able to use iKVM."
# - # -
ipmi_udp_port=623 ipmi_udp_ports="623 5900"
ipmi_tcp_ports="623 3520" ipmi_tcp_ports="80 443 623 3520"
# ============= # =============

5
conf/post_decalrations.conf
View File

@ -384,6 +384,11 @@ done
# - IPMI # - IPMI
# --- # ---
declare -a ipmi_udp_port_arr
for _port in $ipmi_udp_ports ; do
ipmi_udp_port_arr+=("$_port")
done
declare -a ipmi_tcp_port_arr declare -a ipmi_tcp_port_arr
for _port in $ipmi_tcp_ports ; do for _port in $ipmi_tcp_ports ; do
ipmi_tcp_port_arr+=("$_port") ipmi_tcp_port_arr+=("$_port")

20
ip6t-firewall-gateway
View File

@ -2667,14 +2667,18 @@ echononl "\t\tIPMI Tools (e.g. IPMIView) only out"
if $allow_ipmi_request_out && ! $permit_local_net_to_inet ; then if $allow_ipmi_request_out && ! $permit_local_net_to_inet ; then
for _dev in ${ext_if_arr[@]} ; do for _dev in ${ext_if_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -p udp --dport $ipmi_udp_port -m conntrack --ctstate NEW -j ACCEPT for _port in ${ipmi_udp_port_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
for _port in ${ipmi_tcp_port_arr[@]} ; do for _port in ${ipmi_tcp_port_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT $ip6t -A OUTPUT -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done done
if $kernel_forward_between_interfaces ; then if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -o $_dev -p udp --dport $ipmi_udp_port -m conntrack --ctstate NEW -j ACCEPT for _port in ${ipmi_udp_port_arr[@]} ; do
$ip6t -A FORWARD -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
for _port in ${ipmi_tcp_port_arr[@]} ; do for _port in ${ipmi_tcp_port_arr[@]} ; do
$ip6t -A FORWARD -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT $ip6t -A FORWARD -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done done
@ -2696,13 +2700,17 @@ echononl "\t\tIPMI Tools (e.g. IPMIView) local Networks"
if [[ ${#ipmi_server_ip_arr[@]} -gt 0 ]]; then if [[ ${#ipmi_server_ip_arr[@]} -gt 0 ]]; then
for _ip in ${ipmi_server_ip_arr[@]} ; do for _ip in ${ipmi_server_ip_arr[@]} ; do
$ip6t -A OUTPUT -p udp -d $_ip --dport $ipmi_udp_port -m conntrack --ctstate NEW -j ACCEPT for _port in ${ipmi_udp_port_arr[@]} ; do
$ip6t -A OUTPUT -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
for _port in ${ipmi_tcp_port_arr[@]} ; do for _port in ${ipmi_tcp_port_arr[@]} ; do
$ip6t -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT $ip6t -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done done
if $kernel_forward_between_interfaces && ! $permit_between_local_networks ; then if $kernel_forward_between_interfaces && ! $permit_between_local_networks ; then
$ip6t -A FORWARD -p udp -d $_ip --dport $ipmi_udp_port -m conntrack --ctstate NEW -j ACCEPT for _port in ${ipmi_udp_port_arr[@]} ; do
$ip6t -A FORWARD -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
for _port in ${ipmi_tcp_port_arr[@]} ; do for _port in ${ipmi_tcp_port_arr[@]} ; do
$ip6t -A FORWARD -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT $ip6t -A FORWARD -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done done
@ -2710,11 +2718,13 @@ if [[ ${#ipmi_server_ip_arr[@]} -gt 0 ]]; then
# - Rule is needed if (local) interface aliases in use (like eth0:1) # - Rule is needed if (local) interface aliases in use (like eth0:1)
# - # -
if $local_alias_interfaces ; then if $local_alias_interfaces ; then
for _port in ${ipmi_udp_port_arr[@]} ; do
$ip6t -A FORWARD -p udp -s $_ip --sport $_port -m conntrack --ctstate NEW -j ACCEPT
done
for _port in ${ipmi_tcp_port_arr[@]} ; do for _port in ${ipmi_tcp_port_arr[@]} ; do
$ip6t -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT $ip6t -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT $ip6t -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
done done
$ip6t -A FORWARD -p udp -s $_ip --sport $ipmi_udp_port -m conntrack --ctstate NEW -j ACCEPT
fi fi
fi fi
done done

20
ipt-firewall-gateway
View File

@ -3088,14 +3088,18 @@ echononl "\t\tIPMI Tools (e.g. IPMIView) only out"
if $allow_ipmi_request_out && ! $permit_local_net_to_inet ; then if $allow_ipmi_request_out && ! $permit_local_net_to_inet ; then
for _dev in ${ext_if_arr[@]} ; do for _dev in ${ext_if_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p udp --dport $ipmi_udp_port -m conntrack --ctstate NEW -j ACCEPT for _port in ${ipmi_udp_port_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
for _port in ${ipmi_tcp_port_arr[@]} ; do for _port in ${ipmi_tcp_port_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT $ipt -A OUTPUT -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done done
if $kernel_activate_forwarding ; then if $kernel_activate_forwarding ; then
$ipt -A FORWARD -o $_dev -p udp --dport $ipmi_udp_port -m conntrack --ctstate NEW -j ACCEPT for _port in ${ipmi_udp_port_arr[@]} ; do
$ipt -A FORWARD -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
for _port in ${ipmi_tcp_port_arr[@]} ; do for _port in ${ipmi_tcp_port_arr[@]} ; do
$ipt -A FORWARD -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT $ipt -A FORWARD -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done done
@ -3117,13 +3121,17 @@ echononl "\t\tIPMI Tools (e.g. IPMIView) local Networks"
if [[ ${#ipmi_server_ip_arr[@]} -gt 0 ]]; then if [[ ${#ipmi_server_ip_arr[@]} -gt 0 ]]; then
for _ip in ${ipmi_server_ip_arr[@]} ; do for _ip in ${ipmi_server_ip_arr[@]} ; do
$ipt -A OUTPUT -p udp -d $_ip --dport $ipmi_udp_port -m conntrack --ctstate NEW -j ACCEPT for _port in ${ipmi_udp_port_arr[@]} ; do
$ipt -A OUTPUT -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
for _port in ${ipmi_tcp_port_arr[@]} ; do for _port in ${ipmi_tcp_port_arr[@]} ; do
$ipt -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT $ipt -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done done
if $kernel_activate_forwarding && ! $permit_between_local_networks ; then if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
$ipt -A FORWARD -p udp -d $_ip --dport $ipmi_udp_port -m conntrack --ctstate NEW -j ACCEPT for _port in ${ipmi_udp_port_arr[@]} ; do
$ipt -A FORWARD -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
for _port in ${ipmi_tcp_port_arr[@]} ; do for _port in ${ipmi_tcp_port_arr[@]} ; do
$ipt -A FORWARD -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT $ipt -A FORWARD -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done done
@ -3131,11 +3139,13 @@ if [[ ${#ipmi_server_ip_arr[@]} -gt 0 ]]; then
# - Rule is needed if (local) interface aliases in use (like eth0:1) # - Rule is needed if (local) interface aliases in use (like eth0:1)
# - # -
if $local_alias_interfaces ; then if $local_alias_interfaces ; then
for _port in ${ipmi_udp_port_arr[@]} ; do
$ipt -A FORWARD -p udp -s $_ip --sport $_port -m conntrack --ctstate NEW -j ACCEPT
done
for _port in ${ipmi_tcp_port_arr[@]} ; do for _port in ${ipmi_tcp_port_arr[@]} ; do
$ipt -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT $ipt -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
$ipt -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT $ipt -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
done done
$ipt -A FORWARD -p udp -s $_ip --sport $ipmi_udp_port -m conntrack --ctstate NEW -j ACCEPT
fi fi
fi fi
done done