19 lines
1.0 KiB
Bash
19 lines
1.0 KiB
Bash
IF=$(ip -4 route show default | awk '{for (i = 1; i < NF; i++) if ($i == "dev") { print $(i + 1); exit }}')
|
|
[ -n "$IF" ] || refuse "no default route; this lab needs a working network"
|
|
state_set if "$IF"
|
|
state_set ip-forward "$(sysctl -n net.ipv4.ip_forward)"
|
|
ls /etc/sysctl.d >"$LAB_STATE/sysctl-d"
|
|
|
|
pkg_install firewalld nftables tcpdump
|
|
pkg_installed firewalld && systemctl is-active --quiet firewalld && state_set firewalld-was-active 1
|
|
tar -C /etc -cf "$LAB_STATE/firewalld.tar" firewalld
|
|
systemctl enable --now --quiet firewalld
|
|
firewall-cmd -q --state
|
|
z=$(firewall-cmd --get-zone-of-interface="$IF" 2>/dev/null || firewall-cmd --get-default-zone)
|
|
firewall-cmd -q --permanent --zone="$z" --query-service=ssh || firewall-cmd -q --permanent --zone="$z" --add-service=ssh
|
|
firewall-cmd -q --permanent --zone="$z" --query-masquerade && firewall-cmd -q --permanent --zone="$z" --remove-masquerade
|
|
firewall-cmd -q --permanent --info-policy int-to-pub >/dev/null 2>&1 && firewall-cmd -q --permanent --delete-policy int-to-pub
|
|
firewall-cmd -q --reload
|
|
peer_up
|
|
true
|