Changeset 13861 in genesis

Timestamp:

May 9, 2017, 6:15:37 AM (8 years ago)

Author:

rick

Message:

Make rdr_rules global for multi-access use.

Allowing them to be used at all exit-nodes, which could be usefull if one
exit-node is down and service still need to continue working.

Files:

• nodes/Henk/wleiden.yaml (modified) (1 diff)
• nodes/Herman/wleiden.yaml (modified) (1 diff)
• nodes/JorisdeWitte/wleiden.yaml (modified) (1 diff)
• nodes/Rick/wleiden.yaml (modified) (1 diff)
• nodes/Rustdam2/wleiden.yaml (modified) (1 diff)
• nodes/StVictor/wleiden.yaml (modified) (1 diff)
• nodes/TEYBestuurscentrum/wleiden.yaml (modified) (1 diff)
• nodes/TestTienAlix3D/wleiden.yaml (modified) (1 diff)
• nodes/TestTienThuis/wleiden.yaml (modified) (1 diff)
• nodes/Watertoren1/wleiden.yaml (modified) (1 diff)
• nodes/global_rdr_rules.yaml (added)
• tools/gformat.py (modified) (6 diffs)

nodes/Henk/wleiden.yaml

@@ -15 +15 @@
 rdnap_y   : 464983
 rdr_host  : "213.73.188.7"
-rdr_rules :
-- ['tcp', 9070, '172.16.16.2', 80]
-- ['tcp', 9080, '172.17.0.41', 80]
-- ['tcp', 9081, '172.17.0.42', 554]
-- ['tcp', 9082, '172.17.0.43', 554]
-- ['tcp', 9083, '172.17.0.44', 80]
-- ['tcp', 9084, '172.17.0.43', 80]
-- ['tcp', 9085, '172.17.0.42', 80]
-- ['tcp', 9086, '172.17.0.45', 21]
-- ['tcp', 9087, '172.17.0.45', 3389]
-- ['tcp', 9092, '172.17.51.5', 80]
-- ['tcp', 9096, '172.17.13.66', 88]
 release   : "9.0-RELEASE"
 remote_access: "213.73.188.7"

nodes/Herman/wleiden.yaml

@@ -16 +16 @@
 rdnap_y   : "474703"
 rdr_host  : "scholten.ddns.net"
-rdr_rules :
-- ['tcp', 3389, '172.17.0.45', 3389]
-- ['tcp', 9080, '172.17.0.41', 80]
-- ['tcp', 9081, '172.17.0.42', 554]
-- ['tcp', 9082, '172.17.0.43', 554]
-- ['tcp', 9083, '172.17.0.44', 80]
-- ['tcp', 9084, '172.17.0.43', 80]
-- ['tcp', 9085, '172.17.0.42', 80]
-- ['tcp', 9086, '172.17.0.45', 21]
-- ['tcp', 9087, '172.17.0.45', 3389]
-- ['tcp', 9092, '172.17.51.5', 80]
-- ['tcp', 9096, '172.17.13.66', 88]
 release   : "9.0-RELEASE"
 service_accesspoint: False

nodes/JorisdeWitte/wleiden.yaml

@@ -15 +15 @@
 rdnap_y   : 467757
 rdr_host  : "213.124.17.163"
-rdr_rules :
-- ['tcp', 9080, '172.17.0.41', 80]
-- ['tcp', 9081, '172.17.0.42', 554]
-- ['tcp', 9082, '172.17.0.43', 554]
-- ['tcp', 9083, '172.17.0.44', 80]
-- ['tcp', 9084, '172.17.0.43', 80]
-- ['tcp', 9085, '172.17.0.42', 80]
-- ['tcp', 9086, '172.17.0.45', 21]
-- ['tcp', 9087, '172.17.0.45', 3389]
-- ['tcp', 9091, '172.16.9.237', 88]
-- ['tcp', 9092, '172.17.51.5', 80]
-- ['tcp', 9096, '172.17.13.66', 88]
-- ['tcp', 9099, '172.16.9.116', 80]
 release   : "9.0-RELEASE"
 service_accesspoint: True

nodes/Rick/wleiden.yaml

@@ -18 +18 @@
 rdnap_y   : 462103
 rdr_host  : "80.127.152.27"
-rdr_rules :
-- ['tcp', 9080, '172.17.0.41', 80]
-- ['tcp', 9081, '172.17.0.42', 554]
-- ['tcp', 9082, '172.17.0.43', 554]
-- ['tcp', 9083, '172.17.0.44', 80]
-- ['tcp', 9084, '172.17.0.43', 80]
-- ['tcp', 9085, '172.17.0.42', 80]
-- ['tcp', 9086, '172.17.0.45', 21]
-- ['tcp', 9087, '172.17.0.45', 3389]
-- ['tcp', 9092, '172.17.51.5', 80]
-- ['tcp', 9096, '172.17.13.66', 88]
 release   : "9.0-RELEASE"
 service_accesspoint: True

nodes/Rustdam2/wleiden.yaml

@@ -15 +15 @@
 rdnap_y   : "458435"
 rdr_host  : "217.101.190.34"
-rdr_rules :
-- ['tcp', 9080, '172.17.0.41', 80]
-- ['tcp', 9081, '172.17.0.42', 554]
-- ['tcp', 9082, '172.17.0.43', 554]
-- ['tcp', 9083, '172.17.0.44', 80]
-- ['tcp', 9084, '172.17.0.43', 80]
-- ['tcp', 9085, '172.17.0.42', 80]
-- ['tcp', 9086, '172.17.0.45', 21]
-- ['tcp', 9087, '172.17.0.45', 3389]
-- ['tcp', 9090, '172.17.2.67', 80]
-- ['tcp', 9091, '172.16.9.237', 88]
-- ['tcp', 9092, '172.17.51.5', 80]
-- ['tcp', 9093, '172.17.51.5', 554]
-- ['tcp', 9096, '172.17.13.66', 88]
-- ['tcp', 9097, '172.17.52.10', 88]
-- ['tcp', 9100, '172.16.9.202', 88]
 release   : "9.0-RELEASE"
 remote_access: "94.210.178.47:1022"

nodes/StVictor/wleiden.yaml

@@ -15 +15 @@
 rdnap_y   : 474031
 rdr_host  : "82.217.246.132"
-rdr_rules :
-- ['tcp', 9080, '172.17.0.41', 80]
-- ['tcp', 9081, '172.17.0.42', 554]
-- ['tcp', 9082, '172.17.0.43', 554]
-- ['tcp', 9083, '172.17.0.44', 80]
-- ['tcp', 9084, '172.17.0.43', 80]
-- ['tcp', 9085, '172.17.0.42', 80]
-- ['tcp', 9086, '172.17.0.45', 21]
-- ['tcp', 9087, '172.17.0.45', 3389]
-- ['tcp', 9088, '172.16.6.229', 9081]
-- ['tcp', 9091, '172.16.9.237', 88]
-- ['tcp', 9092, '172.17.51.5', 80]
-- ['tcp', 9096, '172.17.13.66', 88]
-- ['tcp', 9099, '172.16.9.116', 80]
 release   : "9.0-RELEASE"
 service_accesspoint: True

nodes/TEYBestuurscentrum/wleiden.yaml

@@ -17 +17 @@
 rdnap_y   : 470942
 rdr_host  : "213.125.198.99"
-rdr_rules :
-- ['tcp', 9080, '172.17.0.41', 80]
-- ['tcp', 9081, '172.17.0.42', 554]
-- ['tcp', 9082, '172.17.0.43', 554]
-- ['tcp', 9083, '172.17.0.44', 80]
-- ['tcp', 9084, '172.17.0.43', 80]
-- ['tcp', 9085, '172.17.0.42', 80]
-- ['tcp', 9086, '172.17.0.45', 21]
-- ['tcp', 9087, '172.17.0.45', 3389]
-- ['tcp', 9090, '172.17.2.67', 80]
-- ['tcp', 9091, '172.16.9.237', 88]
-- ['tcp', 9092, '172.17.51.5', 80]
-- ['tcp', 9096, '172.17.13.66', 88]
 release   : "9.0-RELEASE"
 remote_access: "213.125.198.99:22"

nodes/TestTienAlix3D/wleiden.yaml

@@ -15 +15 @@
 rdnap_y   : 464983
 rdr_host  : "0.0.0.0"
-rdr_rules :
-- ['tcp', 9080, '172.17.0.41', 80]
-- ['tcp', 9081, '172.17.0.42', 554]
-- ['tcp', 9082, '172.17.0.43', 554]
-- ['tcp', 9083, '172.17.0.44', 80]
-- ['tcp', 9084, '172.17.0.43', 80]
-- ['tcp', 9085, '172.17.0.42', 80]
-- ['tcp', 9086, '172.17.0.45', 21]
-- ['tcp', 9087, '172.17.0.45', 3389]
-- ['tcp', 9092, '172.17.51.5', 80]
-- ['tcp', 9096, '172.17.13.66', 88]
 release   : "10.2-RELEASE"
 remote_access: ""

nodes/TestTienThuis/wleiden.yaml

@@ -15 +15 @@
 rdnap_y   : 464983
 rdr_host  : "0.0.0.0"
-rdr_rules :
-- ['tcp', 9080, '172.17.0.41', 80]
-- ['tcp', 9081, '172.17.0.42', 554]
-- ['tcp', 9082, '172.17.0.43', 554]
-- ['tcp', 9083, '172.17.0.44', 80]
-- ['tcp', 9084, '172.17.0.43', 80]
-- ['tcp', 9085, '172.17.0.42', 80]
-- ['tcp', 9086, '172.17.0.45', 21]
-- ['tcp', 9087, '172.17.0.45', 3389]
-- ['tcp', 9092, '172.17.51.5', 80]
-- ['tcp', 9096, '172.17.13.66', 88]
 release   : "10.2-RELEASE"
 remote_access: ""

nodes/Watertoren1/wleiden.yaml

@@ -16 +16 @@
 rdnap_y   : 474286
 rdr_host  : "92.66.227.163"
-rdr_rules :
-- ['tcp', 9080, '172.17.0.41', 80]
-- ['tcp', 9081, '172.17.0.42', 554]
-- ['tcp', 9082, '172.17.0.43', 554]
-- ['tcp', 9083, '172.17.0.44', 80]
-- ['tcp', 9092, '172.17.51.5', 80]
-- ['tcp', 9096, '172.17.13.66', 88]
-- ['tcp', 43389, '172.17.0.45', 3389]
 release   : "9.0-RELEASE"
 remote_access: "92.66.227.163:22"

tools/gformat.py

@@ -175 +175 @@
 
     gfile = os.path.join(NODE_DIR,item,'wleiden.yaml')
+    global_rdr_file = os.path.join(NODE_DIR,'global_rdr_rules.yaml')
+    d = yaml.load(open(global_rdr_file, 'r'), Loader=Loader)
 
     # Default values
@@ -184 +186 @@
     f = open(gfile, 'r')
     datadump.update(yaml.load(f,Loader=Loader))
+    datadump['autogen_global_rdr_rules'] = d['global_rdr_rules']
     if datadump['nodetype'] == 'Hybrid':
       # Some values are defined implicitly
-      if datadump.has_key('rdr_rules') and datadump['rdr_rules'] and not datadump.has_key('service_incoming_rdr'):
+      if datadump.has_key('rdr_host') and datadump['rdr_host'] and not datadump.has_key('service_incoming_rdr'):
         datadump['service_incoming_rdr'] = True
       # Use some boring defaults
@@ -507 +510 @@
   """ Generate config file '/usr/local/etc/dhcpd.conf """
   # Redundency support, in cause local DNS server is not running/responding.
-  datadump['autogen_domain_name_servers'] = [datadump['masterip']] + [x[1] for x in get_neighbours(datadump)]
+  datadump['autogen_backup_dns_servers'] = [x[1] for x in get_neighbours(datadump)]
   output = generate_header(datadump)
   output += Template("""\
 # option definitions common to all supported networks...
 option domain-name "dhcp.{{ autogen_fqdn }}";
-
-option domain-name-servers {{ autogen_domain_name_servers|join(", ") }};
 
 default-lease-time 600;
@@ -569 +570 @@
     datadump[iface_key]['autogen_dhcp_start'] = dhcp_part + "." + dhcp_start
     datadump[iface_key]['autogen_dhcp_stop'] =  dhcp_part + "." + dhcp_stop
+    datadump[iface_key]['autogen_dns_servers'] = ','.join([datadump[iface_key]['autogen_addr']] + datadump['autogen_backup_dns_servers'])
 
     # Assume the first 10 IPs could be used for static entries
@@ -586 +588 @@
         range %(autogen_dhcp_start)s %(autogen_dhcp_stop)s;
         option routers %(autogen_addr)s;
+        option domain-name-servers %(autogen_dns_servers)s;
+
       }
       """ % datadump[iface_key]))
@@ -1168 +1172 @@
   """ Generate configuration file '/etc/pf.hybrid.conf.local' """
   datadump['autogen_header'] = generate_header(datadump, "#")
+  if datadump['service_incoming_rdr']:
+    datadump['global_rdr_rules'] = datadump['autogen_global_rdr_rules']
   return Template("""\
 {{ autogen_header }}
 
 # Redirect some internal facing services outside (7)
-# INFO: {{ rdr_rules|count }} rdr_rules (outside to internal redirect rules) defined.
+# INFO: {{ global_rdr_rules|count }} global_rdr_rules active on this node.
+{% for protocol, src_port,dest_ip,dest_port in global_rdr_rules -%}
+rdr on $ext_if inet proto {{ protocol }} from any to $ext_if port {{ src_port }} tag SRV -> {{ dest_ip }} port {{ dest_port }}
+{% endfor -%}
+# INFO: {{ rdr_rules|count }} node specific rdr_rules defined.
 {% for protocol, src_port,dest_ip,dest_port in rdr_rules -%}
 rdr on $ext_if inet proto {{ protocol }} from any to $ext_if port {{ src_port }} tag SRV -> {{ dest_ip }} port {{ dest_port }}