|
|
|
|
|
|
|
|
<?xml version="1.0" encoding="utf-8"?> |
|
|
<?xml version="1.0" encoding="utf-8"?> |
|
|
<zone{% if 'target' in zone %} target="{{ zone.target }}"{% endif %}> |
|
|
|
|
|
{% if 'short' in zone %}<short>{{ zone.short }}</short>{% else %}<short>{{ name }}</short>{% endif %} |
|
|
|
|
|
{% if 'description' in zone %}<description>{{ zone.description }}</description>{% endif %} |
|
|
|
|
|
|
|
|
<zone{%- if 'target' in zone %} target="{{ zone.target }}"{%- endif %}> |
|
|
|
|
|
{% if 'short' in zone %}<short>{{ zone.short }}</short>{% else %}<short>{{ name }}</short>{% endif %} |
|
|
|
|
|
{% if 'description' in zone %}<description>{{ zone.description }}</description>{% endif %} |
|
|
|
|
|
|
|
|
{% if 'interfaces' in zone %} |
|
|
|
|
|
{% for v in zone.interfaces %}<interface name="{{ v }}" />{% endfor %} |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
{% if 'sources' in zone %} |
|
|
|
|
|
{% for v in zone.sources %}<source address="{{ v }}" />{% endfor %} |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
{% if 'services' in zone %} |
|
|
|
|
|
{% for v in zone.services %}<service name="{{ v }}" />{% endfor %} |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
{% if 'ports' in zone %} |
|
|
|
|
|
{% for v in zone.ports %} |
|
|
|
|
|
{% if 'comment' in v %} |
|
|
|
|
|
<!-- {{ v.comment }} --> |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
<port port="{{ v.port }}" protocol="{{ v.protocol }}"/> |
|
|
|
|
|
{% endfor %} |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
{% if 'icmp_blocks' in zone %} |
|
|
|
|
|
{% for v in zone.icmp_blocks %}<icmp-block name="{{ v }}" />{% endfor %} |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
{% if 'masquerade' in zone %}{% if zone.masquerade %}<masquerade/>{% endif %}{% endif %} |
|
|
|
|
|
{% if 'forward_ports' in zone %} |
|
|
|
|
|
{% for v in zone.forward_ports %} |
|
|
|
|
|
{% if 'comment' in v %} |
|
|
|
|
|
<!-- {{ v.comment }} --> |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
<forward-port port="{{ v.portid }}" protocol="{{ v.protocol }}"{% if 'to_port' in v %} to-port="{{ v.to_port }}"{% endif %}{% if 'to_addr' in v %} to-addr="{{ v.to_addr }}"{% endif %} /> |
|
|
|
|
|
{% endfor %} |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
|
|
|
{%- if 'interfaces' in zone %} |
|
|
|
|
|
{%- for v in zone.interfaces %} |
|
|
|
|
|
<interface name="{{ v }}" /> |
|
|
|
|
|
{%- endfor %} |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'sources' in zone %} |
|
|
|
|
|
{%- for v in zone.sources %} |
|
|
|
|
|
<source address="{{ v }}" /> |
|
|
|
|
|
{%- endfor %} |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'services' in zone %} |
|
|
|
|
|
{%- for v in zone.services %} |
|
|
|
|
|
<service name="{{ v }}" /> |
|
|
|
|
|
{%- endfor %} |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'ports' in zone %} |
|
|
|
|
|
{%- for v in zone.ports %} |
|
|
|
|
|
{%- if 'comment' in v %} |
|
|
|
|
|
<!-- {{ v.comment }} --> |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
<port port="{{ v.port }}" protocol="{{ v.protocol }}"/> |
|
|
|
|
|
{%- endfor %} |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'icmp_blocks' in zone %} |
|
|
|
|
|
{%- for v in zone.icmp_blocks %} |
|
|
|
|
|
<icmp-block name="{{ v }}" /> |
|
|
|
|
|
{%- endfor %} |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'masquerade' in zone %} |
|
|
|
|
|
{%- if zone.masquerade %} |
|
|
|
|
|
<masquerade/> |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'forward_ports' in zone %} |
|
|
|
|
|
{%- for v in zone.forward_ports %} |
|
|
|
|
|
{%- if 'comment' in v %} |
|
|
|
|
|
<!-- {{ v.comment }} --> |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
<forward-port port="{{ v.portid }}" protocol="{{ v.protocol }}"{%- if 'to_port' in v %} to-port="{{ v.to_port }}"{%- endif %}{%- if 'to_addr' in v %} to-addr="{{ v.to_addr }}"{%- endif %} /> |
|
|
|
|
|
{%- endfor %} |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
|
|
|
{% if 'rich_rules' in zone %} |
|
|
|
|
|
{% for rule in zone.rich_rules %} |
|
|
|
|
|
{% if 'family' in rule %} |
|
|
|
|
|
<rule family="{{ rule.family }}"> |
|
|
|
|
|
{% else %} |
|
|
|
|
|
<rule> |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
{% if 'source' in rule %} |
|
|
|
|
|
<source address="{{ rule.source.address }}" {% if 'invert' in rule.source %}invert="{{ rule.source.invert }}"{% endif %}/> |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
{% if 'destination' in rule %} |
|
|
|
|
|
<destination address="{{ rule.destination.address }}" {% if 'invert' in rule.destination %}invert="{{ rule.destination.invert }}"{% endif %}/> |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
{% if 'service' in rule %} |
|
|
|
|
|
|
|
|
{%- if 'rich_rules' in zone %} |
|
|
|
|
|
{%- for rule in zone.rich_rules %} |
|
|
|
|
|
{%- if 'family' in rule %} |
|
|
|
|
|
<rule family="{{ rule.family }}"> |
|
|
|
|
|
{%- else %} |
|
|
|
|
|
<rule> |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'source' in rule %} |
|
|
|
|
|
<source address="{{ rule.source.address }}" {%- if 'invert' in rule.source %}invert="{{ rule.source.invert }}"{%- endif %}/> |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'destination' in rule %} |
|
|
|
|
|
<destination address="{{ rule.destination.address }}" {%- if 'invert' in rule.destination %}invert="{{ rule.destination.invert }}"{%- endif %}/> |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'service' in rule %} |
|
|
<destination name="{{ rule.service }}"/> |
|
|
<destination name="{{ rule.service }}"/> |
|
|
{% endif %} |
|
|
|
|
|
{% if 'port' in rule %} |
|
|
|
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'port' in rule %} |
|
|
<port port="{{ rule.port.portid }}" protocol="{{ rule.port.protocol }}"/> |
|
|
<port port="{{ rule.port.portid }}" protocol="{{ rule.port.protocol }}"/> |
|
|
{% endif %} |
|
|
|
|
|
{% if 'protocol' in rule %} |
|
|
|
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'protocol' in rule %} |
|
|
<protocol value="{{ rule.protocol }}"/> |
|
|
<protocol value="{{ rule.protocol }}"/> |
|
|
{% endif %} |
|
|
|
|
|
{% if 'icmp_block' in rule %} |
|
|
|
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'icmp_block' in rule %} |
|
|
<icmp_block name="{{ rule.icmp_block }}"/> |
|
|
<icmp_block name="{{ rule.icmp_block }}"/> |
|
|
{% endif %} |
|
|
|
|
|
{% if 'masquerade' in rule %} |
|
|
|
|
|
{% if rule.masquerade %}<masquerade/>{% endif %} |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
{% if 'forward_port' in rule %} |
|
|
|
|
|
{% if 'comment' in rule.forward_port %} |
|
|
|
|
|
<!-- {{ rule.forward_port.comment }} --> |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
<forward-port port="{{ rule.forward_port.portid }}" protocol="{{ rule.forward_port.protocol }}"{% if 'to_port' in rule.forward_port %} to-port="{{ rule.forward_port.to_port }}"{% endif %}{% if 'to_addr' in rule.forward_port %} to-addr="{{ rule.forward_port.to_addr }}"{% endif %} /> |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
{% if 'log' in rule %} |
|
|
|
|
|
<log{% if 'prefix' in rule.log %} prefix="{{ rule.log.prefix }}"{% endif %}{% if 'level' in rule.log %} level="{{ rule.log.level }}"{% endif %}> |
|
|
|
|
|
{% if 'limit' in rule.log %} |
|
|
|
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'masquerade' in rule %} |
|
|
|
|
|
{%- if rule.masquerade %}<masquerade/>{%- endif %} |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'forward_port' in rule %} |
|
|
|
|
|
{%- if 'comment' in rule.forward_port %} |
|
|
|
|
|
<!-- {{ rule.forward_port.comment }} --> |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
<forward-port port="{{ rule.forward_port.portid }}" protocol="{{ rule.forward_port.protocol }}"{%- if 'to_port' in rule.forward_port %} to-port="{{ rule.forward_port.to_port }}"{%- endif %}{%- if 'to_addr' in rule.forward_port %} to-addr="{{ rule.forward_port.to_addr }}"{%- endif %} /> |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'log' in rule %} |
|
|
|
|
|
<log{%- if 'prefix' in rule.log %} prefix="{{ rule.log.prefix }}"{%- endif %}{%- if 'level' in rule.log %} level="{{ rule.log.level }}"{%- endif %}> |
|
|
|
|
|
{%- if 'limit' in rule.log %} |
|
|
<limit value="{{ rule.log.limit }}"/> |
|
|
<limit value="{{ rule.log.limit }}"/> |
|
|
{% endif %} |
|
|
|
|
|
|
|
|
{%- endif %} |
|
|
</log> |
|
|
</log> |
|
|
{% endif %} |
|
|
|
|
|
{% if 'audit' in rule %} |
|
|
|
|
|
<audit>{% if 'limit' in rule.audit %} <limit value="{{ rule.audit.limit }}"/>{% endif %}</audit> |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
{% if 'accept' in rule %} |
|
|
|
|
|
<accept/> |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
{% if 'reject' in rule %} |
|
|
|
|
|
<reject{% if 'type' in rule.reject %} type="{{ rule.reject.type }}"{% endif %}/> |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
{% if 'drop' in rule %} |
|
|
|
|
|
<drop/> |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
</rule> |
|
|
|
|
|
{% endfor %} |
|
|
|
|
|
{% endif %} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'audit' in rule %} |
|
|
|
|
|
<audit>{%- if 'limit' in rule.audit %} <limit value="{{ rule.audit.limit }}"/>{%- endif %}</audit> |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'accept' in rule %} |
|
|
|
|
|
<accept/> |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'reject' in rule %} |
|
|
|
|
|
<reject{%- if 'type' in rule.reject %} type="{{ rule.reject.type }}"{%- endif %}/> |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
{%- if 'drop' in rule %} |
|
|
|
|
|
<drop/> |
|
|
|
|
|
{%- endif %} |
|
|
|
|
|
</rule> |
|
|
|
|
|
{%- endfor %} |
|
|
|
|
|
{%- endif %} |
|
|
</zone> |
|
|
</zone> |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|