Consolidate NAT and VPN settings into IP sets
I have tried every possible permutation and I think this is the one. NetBox-managed IP prefixes are pushed with ansible to firewall master. The managed prefixes are added to custom IP sets defined in the app, but only NAT addresses and VPN groups can be configured for them. This way all NAT and VPN policy is (again) configured in the app. Also both NetBox-managed and user-defined networks are treated the same. Also improve^Wtweak config generation. Also templates.
This commit is contained in:
parent
cac7658566
commit
d123db4e64
10 changed files with 154 additions and 162 deletions
|
|
@ -27,6 +27,9 @@ h1 > a {
|
|||
color: unset;
|
||||
text-decoration: none;
|
||||
}
|
||||
input:read-only {
|
||||
border-style: dotted;
|
||||
}
|
||||
pre {
|
||||
background-color: #eeeeee;
|
||||
border: 1px solid black;
|
||||
|
|
@ -39,6 +42,9 @@ th {
|
|||
th, td {
|
||||
padding-right: 1em;
|
||||
}
|
||||
th {
|
||||
border-bottom: 1px solid black;
|
||||
}
|
||||
ul.keys {
|
||||
margin: 0 0.5em 0.5em;
|
||||
padding-left: 1em;
|
||||
|
|
@ -48,6 +54,8 @@ ul.keys a {
|
|||
}
|
||||
</style>
|
||||
|
||||
{% block header %}{% endblock %}
|
||||
|
||||
<title>FRIwall</title>
|
||||
|
||||
{% if current_user.is_authenticated %}
|
||||
|
|
|
|||
|
|
@ -14,18 +14,14 @@
|
|||
<dl>
|
||||
<dt><a href="{{ url_for('nodes') }}">Status</a>
|
||||
<dd>status opek v požarnem zidu
|
||||
<dt><a href="{{ url_for('config.index') }}">Nastavitve</a>
|
||||
<dd>nastavitve aplikacije FRIwall
|
||||
<dt><a href="{{ url_for('ipsets.index') }}">Območja IP</a>
|
||||
<dd>definicije območij IP
|
||||
<dt><a href="{{ url_for('ipsets.index') }}">Omrežja</a>
|
||||
<dd>območja IP, naslovi NAT in skupine za VPN
|
||||
<dt><a href="{{ url_for('rules.index') }}">Urejanje pravil</a>
|
||||
<dd>pravila za posredovanje prometa
|
||||
<dt><a href="{{ url_for('nat.index') }}">NAT</a>
|
||||
<dd>javni naslovi za pisarniška omrežja
|
||||
<dt><a href="{{ url_for('config.edit', name='netmap') }}">Netmap</a>
|
||||
<dd>statične 1:1 preslikave naslovov za strežniška omrežja
|
||||
<dt><a href="{{ url_for('config.edit', name='groups') }}">Skupine</a>
|
||||
<dd>preslikave uporabnikov LDAP v pisarniška omrežja
|
||||
<dt><a href="{{ url_for('config.index') }}">Nastavitve</a>
|
||||
<dd>nastavitve aplikacije FRIwall
|
||||
</dl>
|
||||
</section>
|
||||
{% endif %}
|
||||
|
|
|
|||
|
|
@ -1,25 +1,38 @@
|
|||
{% extends 'base.html' %}
|
||||
{% block header %}
|
||||
<style>
|
||||
td > input {
|
||||
width: 100%;
|
||||
}
|
||||
</style>
|
||||
{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<p>
|
||||
Urejate območja IP. Za vsako območje lahko dodate enega ali več obsegov IP in/ali IPv6, ločenih s presledki.
|
||||
Urejate naslovna območja. Za statična omrežja lahko določimo naslov NAT in skupino za VPN. Za lastna območja lahko poleg tega definiramo enega ali več obsegov IP, ločenih s presledki.
|
||||
|
||||
<p>
|
||||
NAT se izvaja na območjih, kjer je nastavljen. Uporabniki VPN imajo glede na skupine v AD enake dostope kot območja, za katera so nastavljene te skupine.
|
||||
|
||||
<form id="request" method="POST">
|
||||
<table>
|
||||
<table style="width: 100%;">
|
||||
<thead>
|
||||
<th>Ime<th>IP<th>IPv6
|
||||
<th>Ime<th>IP<th>IPv6<th>NAT<th>VPN
|
||||
<tbody>
|
||||
<tbody>
|
||||
{% for name, addresses in ipsets.items() %}
|
||||
{% for name, data in ipsets.items() %}
|
||||
<tr>
|
||||
<td><input name="name" value="{{ name }}" />
|
||||
<td><input name="ip" value="{{ addresses.ip|join(' ') }}" />
|
||||
<td><input name="ip6" value="{{ addresses.ip6|join(' ') }}" />
|
||||
<td style="max-width: 4em;"><input name="name" value="{{ name }}" {% if not data.custom %}readonly{% endif %} />
|
||||
<td style="max-width: 5em;"><input name="ip" value="{{ data.ip|join(' ') }}" {% if not data.custom %}readonly{% endif %} />
|
||||
<td style="max-width: 8em;"><input name="ip6" value="{{ data.ip6|join(' ') }}" {% if not data.custom %}readonly{% endif %} />
|
||||
<td style="max-width: 5em;"><input name="nat" value="{{ data.nat }}" />
|
||||
<td style=""><input name="vpn" value="{{ data.vpn }}" />
|
||||
{% endfor %}
|
||||
<tr>
|
||||
<td><input name="name" />
|
||||
<td><input name="ip" />
|
||||
<td><input name="ip6" />
|
||||
<td style="max-width: 4em;"><input name="name" />
|
||||
<td style="max-width: 5em;"><input name="ip" />
|
||||
<td style="max-width: 8em;"><input name="ip6" />
|
||||
<td style="max-width: 5em;"><input name="nat" />
|
||||
<td><input name="vpn" />
|
||||
</table>
|
||||
<p><button id="submit" type="submit">Shrani</button>
|
||||
</form>
|
||||
|
|
|
|||
|
|
@ -1,19 +0,0 @@
|
|||
{% extends 'base.html' %}
|
||||
|
||||
{% block content %}
|
||||
<p>
|
||||
Urejate naslove NAT za pisarniška omrežja.
|
||||
|
||||
<form id="request" method="POST">
|
||||
<table>
|
||||
<tbody>
|
||||
{% for office, address in nat.items() %}
|
||||
<tr>
|
||||
<td><label for="{{ office }}">{{ office }}</label>
|
||||
<td><input id="{{ office }}" name="{{ office }}" value="{{ address }}" />
|
||||
{% endfor %}
|
||||
</table>
|
||||
<p><button id="submit" type="submit">Shrani</button>
|
||||
</form>
|
||||
|
||||
{% endblock %}
|
||||
|
|
@ -1,8 +1,18 @@
|
|||
{% extends 'base.html' %}
|
||||
{% block header %}
|
||||
<style>
|
||||
tbody > tr:nth-child(odd) {
|
||||
background-color: #eeeeee;
|
||||
}
|
||||
td {
|
||||
vertical-align: top;
|
||||
}
|
||||
</style>
|
||||
{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<p>
|
||||
Urejate pravilo #{{ index }}. V pravilih lahko uporabljate imena območij IP, prikazana spodaj. <a href="{{ url_for('rules.index') }}">Seznam pravil.</a>
|
||||
Urejate pravilo #{{ index }}. <a href="{{ url_for('rules.index') }}">Seznam pravil.</a>
|
||||
|
||||
<form id="request" method="POST">
|
||||
<p>
|
||||
|
|
@ -18,19 +28,28 @@ Uporabniki, ki lahko o(ne)mogočijo pravilo<br>
|
|||
|
||||
<p>
|
||||
<label for="text">Pravila nftables</label>
|
||||
<textarea id="text" name="text" style="width: 100%; height: 20em;">{{ rule.text }}</textarea>
|
||||
<textarea id="text" name="text" style="width: 100%; height: 20em;" placeholder="iif @inside ip saddr @from ip daddr @to accept
iif @inside ip6 saddr @from/6 ip6 daddr @to/6 accept">
|
||||
{{- rule.text }}
|
||||
</textarea>
|
||||
<p><button id="submit" type="submit">Shrani</button>
|
||||
</form>
|
||||
|
||||
<table>
|
||||
<p>
|
||||
V pravilih lahko uporabljamo spodnja območja IP, npr. <code>@pr5</code> in <code>@pr5/6</code> za območji IPv4 in IPv6 učilnice 5. Za notranja omrežja uporabimo vmesnik <code>@inside</code>, za zunanja pa vmesnik <code>@outside</code>. Primere z razlago najdemo v <a href="https://wiki.nftables.org">dokumentaciji nftables</a>.
|
||||
|
||||
<table style="width: 100%;">
|
||||
<thead>
|
||||
<th>Območje<th>IP<th>IPv6
|
||||
<th>Omrežje
|
||||
<th>IP
|
||||
<th>IPv6
|
||||
<th>VPN
|
||||
<tbody>
|
||||
{% for network, addresses in ipsets.items() %}
|
||||
{% for name, data in ipsets.items() %}
|
||||
<tr>
|
||||
<td>{{ network }}
|
||||
<td>{{ addresses.ip|join('<br>')|safe }}
|
||||
<td>{{ addresses.ip6|join('<br>')|safe }}
|
||||
<td>{{ name }}
|
||||
<td>{{ data.ip|join('<br>')|safe }}
|
||||
<td>{{ data.ip6|join('<br>')|safe }}
|
||||
<td>{{ data.vpn }}
|
||||
{% endfor %}
|
||||
</table>
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue