dataset/seed/host-systemd-machined/templates/risottofirewall.service

45 lines
1.6 KiB
SYSTEMD
Raw Normal View History

%def %%get_protocol_port(%%port)
%if ':' in %%port
%set %%protocol, %%port = %%port.split(':')
%else
%set %%protocol = 'tcp'
%end if
%return %%protocol, %%port
%end def
2022-06-29 11:44:01 +02:00
[Unit]
Description=Firewall for Risotto
After=network.target
[Service]
Type=oneshot
RemainAfterExit=yes
2022-12-25 17:08:52 +01:00
%set %%has_rules = False
%set %%incoming_ports = {'tcp': {}, 'udp': {}}
2022-06-29 11:44:01 +02:00
%for %%dns in %%machined.machines
2022-12-25 17:08:52 +01:00
%set %%machine = %%normalize_family(%%dns)
%set %%outgoing = %%machined['machine_' + %%machine]['outgoing_ports_' + %%machine]
2022-06-29 11:44:01 +02:00
%if %%outgoing
2022-12-25 17:08:52 +01:00
%set %%ip = %%machined['machine_' + %%machine]['ip_' + %%machine]
2022-06-29 11:44:01 +02:00
%for %%port in %%outgoing
%set %%protocol, %%port = %%get_protocol_port(%%port)
2022-12-25 17:08:52 +01:00
ExecStart=/sbin/iptables -t nat -A POSTROUTING -s %%ip -p %%protocol -m %%protocol --dport %%port -o %%output_interface -j MASQUERADE
ExecStop=-/sbin/iptables -t nat -D POSTROUTING -s %%ip -p %%protocol -m %%protocol --dport %%port -o %%output_interface -j MASQUERADE
%set %%has_rules = False
2022-06-29 11:44:01 +02:00
%end for
%end if
%set %%incoming = %%machined['machine_' + %%machine]['incoming_ports_' + %%machine]
%for %%port in %%incoming
%set %%protocol, %%port = %%get_protocol_port(%%port)
%if %%port in %%incoming_ports[%%protocol]
%raise Exception('the port "' + %%port + '" cannot be deployed for multiple machines: "' + %%dns + '" and "' + %%incoming_ports[%%protocol][%%port] + '"')
%end if
%set %%incoming_ports[%%protocol][%%port] = %%dns
%end for
2022-06-29 11:44:01 +02:00
%end for
2022-12-25 17:08:52 +01:00
%if not %%has_rules
ExecStart=/usr/bin/echo "No rule"
%end if
2022-06-29 11:44:01 +02:00
[Install]
WantedBy=multi-user.target