wip #6601 @1.5

diff --git a/app/Models/TeamServers.php b/app/Models/TeamServers.php
index 61c2f6406c52933dd7d622f15180f3cf105f9692..c2d07702ead8e7941671117f8fee9544bb7f6151 100644 (file)
--- a/app/Models/TeamServers.php
+++ b/app/Models/TeamServers.php
@@ -54,6 +54,23 @@ ufw disable
 ufw default allow outgoing
 
 ';
+            $locals = ['127.0.0.0/8', '10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'];
+            $lhosts = [];
+            foreach ($locals as $k => $local) {
+                $lhosts[] = '$l' . $k;
+                $fw .= 'l' . $k . '=' . self::digOrIP($local) . "\n";
+            }
+
+
+            foreach ($ip as $k => $i) {
+                $lhosts[] = '$i' . $k;
+                $fw .= 'i' . $k . '=' . self::digOrIP($i) . "\n";
+            }
+            $fw .= "\n";
+
+            $fw .= 'local=(' . implode(' ', $lhosts) . ')' . "\n\n";
+
+
             $bhosts = [];
             foreach ($blacklist as $k => $b) {
                 $bhosts[] = '$b' . $k;
@@ -76,12 +93,6 @@ ufw default allow outgoing
             }
             $fw .= "\n";
 
-            foreach ($ip as $k => $i) {
-                $hosts[] = '$i' . $k;
-                $fw .= 'i' . $k . '=' . self::digOrIP($i) . "\n";
-            }
-            $fw .= "\n";
-
 
             $fw .= 'auth=(' . implode(' ', $hosts) . ')' . "\n\n";
 
@@ -123,16 +134,19 @@ ufw default allow outgoing
 
             $fw .= 'for ip in "${blacklist[@]}"
 do
-        ufw deny in from $ip
-        ufw deny in to $ip
+        ufw deny from $ip
+        ufw deny to $ip
+done
+
+for ip in "${local[@]}"
+do
+        ufw allow from $ip
 done
 
 for ip in "${auth[@]}"
 do' . "\n";
             $fw .= "\t" . 'ufw allow from $ip' . "\n";
             $fw .= "\t" . 'ufw allow to $ip' . "\n";
-            $fw .= "\t" . 'ufw allow out from $ip' . "\n";
-            $fw .= "\t" . 'ufw allow out to $ip' . "\n";
             $fw .= 'done' . "\n\n";
             if (isset($backup) && count($backup)) {
                 $fw .= 'for ip in "${backup[@]}"

diff --git a/resources/servers/alphaville/firewall b/resources/servers/alphaville/firewall
index ee54214df3a425ac99eada37ae89051542085a6e..44ba90fe2f9c46c4fbce126879dc475c274657a5 100644 (file)
--- a/resources/servers/alphaville/firewall
+++ b/resources/servers/alphaville/firewall
@@ -9,6 +9,16 @@ ufw disable
 
 ufw default allow outgoing
 
+l0=127.0.0.0/8
+l1=10.0.0.0/8
+l2=172.16.0.0/12
+l3=192.168.0.0/16
+i0=`dig +short paris.cubedesigners.com | tail -1`
+i1=`dig +short montpellier.cubedesigners.com | tail -1`
+i2=`dig +short tortuga.enhydra.fr | tail -1`
+
+local=($l0 $l1 $l2 $l3 $i0 $i1 $i2)
+
 b0=24.104.34.225
 b1=62.99.220.220
 b2=50.62.177.177
@@ -32,29 +42,26 @@ s6_2=`dig +short mail2.cubedesigners.com | tail -1`
 s7=`dig +short kingkong.cubedesigners.com | tail -1`
 s8=`dig +short fastandfurious.cubedesigners.com | tail -1`
 
-i0=127.0.0.0/8
-i1=10.0.0.0/8
-i2=172.16.0.0/12
-i3=192.168.0.0/16
-i4=`dig +short tortuga.enhydra.fr | tail -1`
-
-auth=($s1 $s2 $s2_0 $s3 $s4 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s6 $s6_0 $s6_1 $s6_2 $s7 $s8 $i0 $i1 $i2 $i3 $i4)
+auth=($s1 $s2 $s2_0 $s3 $s4 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s6 $s6_0 $s6_1 $s6_2 $s7 $s8)
 
 ufw allow 80
 ufw allow 443
 
 for ip in "${blacklist[@]}"
 do
-        ufw deny in from $ip
-        ufw deny in to $ip
+        ufw deny from $ip
+        ufw deny to $ip
+done
+
+for ip in "${local[@]}"
+do
+        ufw allow from $ip
 done
 
 for ip in "${auth[@]}"
 do
        ufw allow from $ip
        ufw allow to $ip
-       ufw allow out from $ip
-       ufw allow out to $ip
 done
 
 #SSH

diff --git a/resources/servers/brazil/firewall b/resources/servers/brazil/firewall
index b61c08103a9cd8e757fed2e75bad3e7b0c1d37cc..8a7cb80f71c7942a2c0b8c3ff52ceb8eb4731e0f 100644 (file)
--- a/resources/servers/brazil/firewall
+++ b/resources/servers/brazil/firewall
@@ -9,6 +9,16 @@ ufw disable
 
 ufw default allow outgoing
 
+l0=127.0.0.0/8
+l1=10.0.0.0/8
+l2=172.16.0.0/12
+l3=192.168.0.0/16
+i0=`dig +short paris.cubedesigners.com | tail -1`
+i1=`dig +short montpellier.cubedesigners.com | tail -1`
+i2=`dig +short tortuga.enhydra.fr | tail -1`
+
+local=($l0 $l1 $l2 $l3 $i0 $i1 $i2)
+
 b0=24.104.34.225
 b1=62.99.220.220
 b2=50.62.177.177
@@ -33,27 +43,24 @@ s6_2=`dig +short mail2.cubedesigners.com | tail -1`
 s7=`dig +short kingkong.cubedesigners.com | tail -1`
 s8=`dig +short fastandfurious.cubedesigners.com | tail -1`
 
-i0=127.0.0.0/8
-i1=10.0.0.0/8
-i2=172.16.0.0/12
-i3=192.168.0.0/16
-i4=`dig +short tortuga.enhydra.fr | tail -1`
-
-auth=($s0 $s0_0 $s2 $s2_0 $s3 $s4 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s6 $s6_0 $s6_1 $s6_2 $s7 $s8 $i0 $i1 $i2 $i3 $i4)
+auth=($s0 $s0_0 $s2 $s2_0 $s3 $s4 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s6 $s6_0 $s6_1 $s6_2 $s7 $s8)
 
 
 for ip in "${blacklist[@]}"
 do
-        ufw deny in from $ip
-        ufw deny in to $ip
+        ufw deny from $ip
+        ufw deny to $ip
+done
+
+for ip in "${local[@]}"
+do
+        ufw allow from $ip
 done
 
 for ip in "${auth[@]}"
 do
        ufw allow from $ip
        ufw allow to $ip
-       ufw allow out from $ip
-       ufw allow out to $ip
 done
 
 #SSH

diff --git a/resources/servers/dobermann/firewall b/resources/servers/dobermann/firewall
index 79ec8197907e7ebfe10edb1584027e3db2c66dc9..d292d48bb7afad32c25452600eb3d7f4a8e94587 100644 (file)
--- a/resources/servers/dobermann/firewall
+++ b/resources/servers/dobermann/firewall
@@ -9,6 +9,16 @@ ufw disable
 
 ufw default allow outgoing
 
+l0=127.0.0.0/8
+l1=10.0.0.0/8
+l2=172.16.0.0/12
+l3=192.168.0.0/16
+i0=`dig +short paris.cubedesigners.com | tail -1`
+i1=`dig +short montpellier.cubedesigners.com | tail -1`
+i2=`dig +short tortuga.enhydra.fr | tail -1`
+
+local=($l0 $l1 $l2 $l3 $i0 $i1 $i2)
+
 b0=24.104.34.225
 b1=62.99.220.220
 b2=50.62.177.177
@@ -33,13 +43,7 @@ s6_2=`dig +short mail2.cubedesigners.com | tail -1`
 s7=`dig +short kingkong.cubedesigners.com | tail -1`
 s8=`dig +short fastandfurious.cubedesigners.com | tail -1`
 
-i0=127.0.0.0/8
-i1=10.0.0.0/8
-i2=172.16.0.0/12
-i3=192.168.0.0/16
-i4=`dig +short tortuga.enhydra.fr | tail -1`
-
-auth=($s0 $s0_0 $s1 $s2 $s2_0 $s4 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s6 $s6_0 $s6_1 $s6_2 $s7 $s8 $i0 $i1 $i2 $i3 $i4)
+auth=($s0 $s0_0 $s1 $s2 $s2_0 $s4 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s6 $s6_0 $s6_1 $s6_2 $s7 $s8)
 
 c0=`dig +short s1.adangelis.com | tail -1`
 c1=`dig +short www.fondation-sycomore.com | tail -1`
@@ -50,16 +54,19 @@ ufw allow 443
 
 for ip in "${blacklist[@]}"
 do
-        ufw deny in from $ip
-        ufw deny in to $ip
+        ufw deny from $ip
+        ufw deny to $ip
+done
+
+for ip in "${local[@]}"
+do
+        ufw allow from $ip
 done
 
 for ip in "${auth[@]}"
 do
        ufw allow from $ip
        ufw allow to $ip
-       ufw allow out from $ip
-       ufw allow out to $ip
 done
 
 for ip in "${backup[@]}"

diff --git a/resources/servers/dracula/firewall b/resources/servers/dracula/firewall
index 3130b8a7968aae9cc52722c283a15203fb8db3b7..d715439947463819deae5bde4fe7820d6f4c1326 100644 (file)
--- a/resources/servers/dracula/firewall
+++ b/resources/servers/dracula/firewall
@@ -9,6 +9,16 @@ ufw disable
 
 ufw default allow outgoing
 
+l0=127.0.0.0/8
+l1=10.0.0.0/8
+l2=172.16.0.0/12
+l3=192.168.0.0/16
+i0=`dig +short paris.cubedesigners.com | tail -1`
+i1=`dig +short montpellier.cubedesigners.com | tail -1`
+i2=`dig +short tortuga.enhydra.fr | tail -1`
+
+local=($l0 $l1 $l2 $l3 $i0 $i1 $i2)
+
 b0=24.104.34.225
 b1=62.99.220.220
 b2=50.62.177.177
@@ -32,13 +42,7 @@ s6_2=`dig +short mail2.cubedesigners.com | tail -1`
 s7=`dig +short kingkong.cubedesigners.com | tail -1`
 s8=`dig +short fastandfurious.cubedesigners.com | tail -1`
 
-i0=127.0.0.0/8
-i1=10.0.0.0/8
-i2=172.16.0.0/12
-i3=192.168.0.0/16
-i4=`dig +short tortuga.enhydra.fr | tail -1`
-
-auth=($s0 $s0_0 $s1 $s3 $s4 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s6 $s6_0 $s6_1 $s6_2 $s7 $s8 $i0 $i1 $i2 $i3 $i4)
+auth=($s0 $s0_0 $s1 $s3 $s4 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s6 $s6_0 $s6_1 $s6_2 $s7 $s8)
 
 ufw allow 53
 ufw allow 80
@@ -46,16 +50,19 @@ ufw allow 443
 
 for ip in "${blacklist[@]}"
 do
-        ufw deny in from $ip
-        ufw deny in to $ip
+        ufw deny from $ip
+        ufw deny to $ip
+done
+
+for ip in "${local[@]}"
+do
+        ufw allow from $ip
 done
 
 for ip in "${auth[@]}"
 do
        ufw allow from $ip
        ufw allow to $ip
-       ufw allow out from $ip
-       ufw allow out to $ip
 done
 
 #SSH

diff --git a/resources/servers/elephantman/firewall b/resources/servers/elephantman/firewall
index e99d9e58198bd0e4f5697dd341846ca4f4b5331a..f90c536b623375af474ed603121cf282eaef643f 100644 (file)
--- a/resources/servers/elephantman/firewall
+++ b/resources/servers/elephantman/firewall
@@ -9,6 +9,16 @@ ufw disable
 
 ufw default allow outgoing
 
+l0=127.0.0.0/8
+l1=10.0.0.0/8
+l2=172.16.0.0/12
+l3=192.168.0.0/16
+i0=`dig +short paris.cubedesigners.com | tail -1`
+i1=`dig +short montpellier.cubedesigners.com | tail -1`
+i2=`dig +short tortuga.enhydra.fr | tail -1`
+
+local=($l0 $l1 $l2 $l3 $i0 $i1 $i2)
+
 b0=24.104.34.225
 b1=62.99.220.220
 b2=50.62.177.177
@@ -33,27 +43,24 @@ s6_2=`dig +short mail2.cubedesigners.com | tail -1`
 s7=`dig +short kingkong.cubedesigners.com | tail -1`
 s8=`dig +short fastandfurious.cubedesigners.com | tail -1`
 
-i0=127.0.0.0/8
-i1=10.0.0.0/8
-i2=172.16.0.0/12
-i3=192.168.0.0/16
-i4=`dig +short tortuga.enhydra.fr | tail -1`
-
-auth=($s0 $s0_0 $s1 $s2 $s2_0 $s3 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s6 $s6_0 $s6_1 $s6_2 $s7 $s8 $i0 $i1 $i2 $i3 $i4)
+auth=($s0 $s0_0 $s1 $s2 $s2_0 $s3 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s6 $s6_0 $s6_1 $s6_2 $s7 $s8)
 
 
 for ip in "${blacklist[@]}"
 do
-        ufw deny in from $ip
-        ufw deny in to $ip
+        ufw deny from $ip
+        ufw deny to $ip
+done
+
+for ip in "${local[@]}"
+do
+        ufw allow from $ip
 done
 
 for ip in "${auth[@]}"
 do
        ufw allow from $ip
        ufw allow to $ip
-       ufw allow out from $ip
-       ufw allow out to $ip
 done
 
 for ip in "${backup[@]}"

diff --git a/resources/servers/fastandfurious/firewall b/resources/servers/fastandfurious/firewall
index 18ea48428498c0f2da1fde57db43f4c7958aac5a..6eaabcea18fdec7684c82dac8ab10722d7605ea2 100644 (file)
--- a/resources/servers/fastandfurious/firewall
+++ b/resources/servers/fastandfurious/firewall
@@ -9,6 +9,16 @@ ufw disable
 
 ufw default allow outgoing
 
+l0=127.0.0.0/8
+l1=10.0.0.0/8
+l2=172.16.0.0/12
+l3=192.168.0.0/16
+i0=`dig +short paris.cubedesigners.com | tail -1`
+i1=`dig +short montpellier.cubedesigners.com | tail -1`
+i2=`dig +short tortuga.enhydra.fr | tail -1`
+
+local=($l0 $l1 $l2 $l3 $i0 $i1 $i2)
+
 b0=24.104.34.225
 b1=62.99.220.220
 b2=50.62.177.177
@@ -33,28 +43,25 @@ s6_1=`dig +short mail.cubedesigners.com | tail -1`
 s6_2=`dig +short mail2.cubedesigners.com | tail -1`
 s7=`dig +short kingkong.cubedesigners.com | tail -1`
 
-i0=127.0.0.0/8
-i1=10.0.0.0/8
-i2=172.16.0.0/12
-i3=192.168.0.0/16
-i4=`dig +short tortuga.enhydra.fr | tail -1`
-
-auth=($s0 $s0_0 $s1 $s2 $s2_0 $s3 $s4 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s6 $s6_0 $s6_1 $s6_2 $s7 $i0 $i1 $i2 $i3 $i4)
+auth=($s0 $s0_0 $s1 $s2 $s2_0 $s3 $s4 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s6 $s6_0 $s6_1 $s6_2 $s7)
 
 ufw allow 51820
 
 for ip in "${blacklist[@]}"
 do
-        ufw deny in from $ip
-        ufw deny in to $ip
+        ufw deny from $ip
+        ufw deny to $ip
+done
+
+for ip in "${local[@]}"
+do
+        ufw allow from $ip
 done
 
 for ip in "${auth[@]}"
 do
        ufw allow from $ip
        ufw allow to $ip
-       ufw allow out from $ip
-       ufw allow out to $ip
 done
 
 for ip in "${backup[@]}"

diff --git a/resources/servers/godzilla/firewall b/resources/servers/godzilla/firewall
index cc3914727708bdb032e0a8ef0afafd604465025d..df310229d0464b99318b117ee26efd7bd85e1a17 100644 (file)
--- a/resources/servers/godzilla/firewall
+++ b/resources/servers/godzilla/firewall
@@ -9,6 +9,16 @@ ufw disable
 
 ufw default allow outgoing
 
+l0=127.0.0.0/8
+l1=10.0.0.0/8
+l2=172.16.0.0/12
+l3=192.168.0.0/16
+i0=`dig +short paris.cubedesigners.com | tail -1`
+i1=`dig +short montpellier.cubedesigners.com | tail -1`
+i2=`dig +short tortuga.enhydra.fr | tail -1`
+
+local=($l0 $l1 $l2 $l3 $i0 $i1 $i2)
+
 b0=24.104.34.225
 b1=62.99.220.220
 b2=50.62.177.177
@@ -29,13 +39,7 @@ s6_2=`dig +short mail2.cubedesigners.com | tail -1`
 s7=`dig +short kingkong.cubedesigners.com | tail -1`
 s8=`dig +short fastandfurious.cubedesigners.com | tail -1`
 
-i0=127.0.0.0/8
-i1=10.0.0.0/8
-i2=172.16.0.0/12
-i3=192.168.0.0/16
-i4=`dig +short tortuga.enhydra.fr | tail -1`
-
-auth=($s0 $s0_0 $s1 $s2 $s2_0 $s3 $s4 $s6 $s6_0 $s6_1 $s6_2 $s7 $s8 $i0 $i1 $i2 $i3 $i4)
+auth=($s0 $s0_0 $s1 $s2 $s2_0 $s3 $s4 $s6 $s6_0 $s6_1 $s6_2 $s7 $s8)
 
 ufw allow 53
 ufw allow 80
@@ -43,16 +47,19 @@ ufw allow 443
 
 for ip in "${blacklist[@]}"
 do
-        ufw deny in from $ip
-        ufw deny in to $ip
+        ufw deny from $ip
+        ufw deny to $ip
+done
+
+for ip in "${local[@]}"
+do
+        ufw allow from $ip
 done
 
 for ip in "${auth[@]}"
 do
        ufw allow from $ip
        ufw allow to $ip
-       ufw allow out from $ip
-       ufw allow out to $ip
 done
 
 for ip in "${backup[@]}"

diff --git a/resources/servers/her2/firewall b/resources/servers/her2/firewall
index 25e37694bc1b2b1a1352fc4533bf757cb718ca99..e9dcfb27e6d1c9cc3aac172b80ca2ca551cbd502 100644 (file)
--- a/resources/servers/her2/firewall
+++ b/resources/servers/her2/firewall
@@ -9,6 +9,16 @@ ufw disable
 
 ufw default allow outgoing
 
+l0=127.0.0.0/8
+l1=10.0.0.0/8
+l2=172.16.0.0/12
+l3=192.168.0.0/16
+i0=`dig +short paris.cubedesigners.com | tail -1`
+i1=`dig +short montpellier.cubedesigners.com | tail -1`
+i2=`dig +short tortuga.enhydra.fr | tail -1`
+
+local=($l0 $l1 $l2 $l3 $i0 $i1 $i2)
+
 b0=24.104.34.225
 b1=62.99.220.220
 b2=50.62.177.177
@@ -30,13 +40,7 @@ s5_3=`dig +short hosting.fluidbook.com | tail -1`
 s7=`dig +short kingkong.cubedesigners.com | tail -1`
 s8=`dig +short fastandfurious.cubedesigners.com | tail -1`
 
-i0=127.0.0.0/8
-i1=10.0.0.0/8
-i2=172.16.0.0/12
-i3=192.168.0.0/16
-i4=`dig +short tortuga.enhydra.fr | tail -1`
-
-auth=($s0 $s0_0 $s1 $s2 $s2_0 $s3 $s4 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s7 $s8 $i0 $i1 $i2 $i3 $i4)
+auth=($s0 $s0_0 $s1 $s2 $s2_0 $s3 $s4 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s7 $s8)
 
 ufw allow 53
 ufw allow 80
@@ -50,16 +54,19 @@ ufw allow 4190
 
 for ip in "${blacklist[@]}"
 do
-        ufw deny in from $ip
-        ufw deny in to $ip
+        ufw deny from $ip
+        ufw deny to $ip
+done
+
+for ip in "${local[@]}"
+do
+        ufw allow from $ip
 done
 
 for ip in "${auth[@]}"
 do
        ufw allow from $ip
        ufw allow to $ip
-       ufw allow out from $ip
-       ufw allow out to $ip
 done
 
 for ip in "${backup[@]}"

diff --git a/resources/servers/kingkong/firewall b/resources/servers/kingkong/firewall
index 907ae460a8019eff99aafd441fa2115761b1f75a..7f1993cf3fa270a04672e9797eba0ce0a3607398 100644 (file)
--- a/resources/servers/kingkong/firewall
+++ b/resources/servers/kingkong/firewall
@@ -9,6 +9,16 @@ ufw disable
 
 ufw default allow outgoing
 
+l0=127.0.0.0/8
+l1=10.0.0.0/8
+l2=172.16.0.0/12
+l3=192.168.0.0/16
+i0=`dig +short paris.cubedesigners.com | tail -1`
+i1=`dig +short montpellier.cubedesigners.com | tail -1`
+i2=`dig +short tortuga.enhydra.fr | tail -1`
+
+local=($l0 $l1 $l2 $l3 $i0 $i1 $i2)
+
 b0=24.104.34.225
 b1=62.99.220.220
 b2=50.62.177.177
@@ -33,29 +43,26 @@ s6_1=`dig +short mail.cubedesigners.com | tail -1`
 s6_2=`dig +short mail2.cubedesigners.com | tail -1`
 s8=`dig +short fastandfurious.cubedesigners.com | tail -1`
 
-i0=127.0.0.0/8
-i1=10.0.0.0/8
-i2=172.16.0.0/12
-i3=192.168.0.0/16
-i4=`dig +short tortuga.enhydra.fr | tail -1`
-
-auth=($s0 $s0_0 $s1 $s2 $s2_0 $s3 $s4 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s6 $s6_0 $s6_1 $s6_2 $s8 $i0 $i1 $i2 $i3 $i4)
+auth=($s0 $s0_0 $s1 $s2 $s2_0 $s3 $s4 $s5 $s5_0 $s5_1 $s5_2 $s5_3 $s6 $s6_0 $s6_1 $s6_2 $s8)
 
 ufw allow 80
 ufw allow 443
 
 for ip in "${blacklist[@]}"
 do
-        ufw deny in from $ip
-        ufw deny in to $ip
+        ufw deny from $ip
+        ufw deny to $ip
+done
+
+for ip in "${local[@]}"
+do
+        ufw allow from $ip
 done
 
 for ip in "${auth[@]}"
 do
        ufw allow from $ip
        ufw allow to $ip
-       ufw allow out from $ip
-       ufw allow out to $ip
 done
 
 for ip in "${backup[@]}"