Skip to content

Commit a706ff6

Browse files
author
Jean-François Hivert
committed
Version 1.0
0 parents  commit a706ff6

35 files changed

Lines changed: 7003 additions & 0 deletions

‎LICENSE‎

Lines changed: 674 additions & 0 deletions
Large diffs are not rendered by default.

‎README.md‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# PHP-CLI SHELL for FIREWALL
2+
3+
This repository is the addon for PHP-CLI SHELL about FIREWALL (acl) service.
4+
With this addon you can create ACLs (monosite, failover and fullmesh) and generate template for your firewall appliance.
5+
For the moment, only JunOS templates are availables. There are 2 templates for JunOS: one formated with {} and one with set commands.
6+
7+
ACL monosite: basic ACL, source(s), destination(s), no automation. For this ACL category you can not enable fullmesh option!
8+
ACL failover: failover ACL(s) will be automaticaly generated for all failover sites in inbound or outbound.
9+
ACL failover with fullmesh option: source and destination of ACL will be isolated to process automation.
10+
11+
You have to use base PHP-CLI SHELL project that is here: https://github.com/cloudwatt/php-cli-shell_base
12+
13+
14+
# INSTALLATION
15+
16+
#### APT PHP
17+
__*https://launchpad.net/~ondrej/+archive/ubuntu/php*__
18+
* add-apt-repository ppa:ondrej/php
19+
* apt-get update
20+
* apt install php7.1-cli php7.1-mbstring php7.1-readline
21+
22+
#### REPOSITORIES
23+
* git clone https://github.com/cloudwatt/php-cli-shell_base
24+
* git checkout tags/v1.1
25+
* git clone https://github.com/cloudwatt/php-cli-shell_firewall
26+
* git checkout tags/v1.0
27+
* Merge these two repositories
28+
29+
#### PHPIPAM (Optionnal)
30+
If you have PHPIPAM and you want object name autocompletion, you have to perform these steps:
31+
* git clone https://github.com/cloudwatt/php-cli-shell_phpipam
32+
* git checkout tags/v1.1
33+
* Merge this repository with two previous repositories (base and firewall)
34+
* Install PHP-CLI SHELL for PHPIPAM with README helper
35+
https://github.com/cloudwatt/php-cli-shell_phpipam/blob/master/README.md
36+
37+
#### CONFIGURATION FILE
38+
* mv configurations/firewall.json.example configurations/firewall.json
39+
* vim configurations/firewall.json
40+
* Adapt configuration to your network topology
41+
* Of course you can add more than two sites
42+
* Do not change topology attribute names: internet, onPremise, interSite, private
43+
* /!\ Zone name between site (MPLS-ADM, MPLS-USR) must be the same on all sites
44+
*This is will change in next release to add more flexibility*
45+
* Optionnal
46+
* You can create user configuration files for base and firewall services to overwrite some configurations
47+
These files will be ignored for commits, so your user config files can not be overwrited by a futur release
48+
* vim configurations/firewall.user.json
49+
Change configuration like path or file
50+
* All *.user.json files are ignored by .gitignore
51+
52+
53+
#### PHP LAUNCHER FILE
54+
* mv firewall.php.example firewall.php
55+
* vim firewall.php
56+
* Change [IPAM_SERVER_KEY] with the key of your PHPIPAM server in configuration file
57+
You can add many PHPIPAM server, it is compatible multiple PHPIPAM
58+
If you have not PHPIPAM service, remove argument or keep it empty
59+
60+
#### CREDENTIALS FILE (Only if you install PHPIPAM service)
61+
/!\ For security reason, use a read only account!
62+
__*Change informations which are between []*__
63+
* vim credentialsFile
64+
* read -sr USER_PASSWORD_INPUT
65+
* export IPAM_[IPAM_SERVER_KEY]_LOGIN=[YourLoginHere]
66+
* export IPAM_[IPAM_SERVER_KEY]_PASSWORD=$USER_PASSWORD_INPUT
67+
__Change [IPAM_SERVER_KEY] with the key of your PHPIPAM server in configuration file__
68+
69+
70+
# EXECUTION
71+
72+
#### SHELL
73+
Launch PHP-CLI Shell for FIREWALL service
74+
* source credentialsFile
75+
* php firewall.php
76+
77+
#### CLI
78+
Call commands directly from your OS shell.
79+
__*Informations between [] are optionnal*__
80+
* source credentialsFile
81+
* php firewall.php --site name|all --create_host "name;IPv4[;IPv6]" --create_subnet "name;IPv4/mask[;IPv6/mask]" --create_network "name;IPv4-IPv4[;IPv6-IPv6]"
82+
--create_rule monosite|failover [--fullmesh] --action permit|deny
83+
--source_host name --source_subnet name --source_network name
84+
--destination_host name --destination_subnet name --destination_network name
85+
--protocol protocol;number[-number] --description maDescription
86+
--save [name;[force]] --export_configuration "junos[;force]"

‎backup/.gitignore‎

Whitespace-only changes.

‎backup/firewall/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
objects.json

‎backup/firewall/configurations/.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Ignore everything in this directory
2+
*
3+
# Except this file
4+
!.gitignore

‎configurations/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
*.user.json

‎configurations/firewall.json‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
{
2+
"FIREWALL": {
3+
"sites": {
4+
"site_A": {
5+
"location": "Paris, FRANCE",
6+
"hostname": "firewall_A",
7+
"os": "juniper-junos",
8+
"ip": "1.2.3.4",
9+
"gui": "https",
10+
"zones": {
11+
"WAN": {
12+
"ipv4": [ "0.0.0.0/0" ],
13+
"ipv6": [ "::/0" ]
14+
},
15+
"VPN-C": {
16+
"ipv4": [ "10.0.0.0/16" ],
17+
"ipv6": [ "2a04:2507:0:0::/64" ]
18+
},
19+
"VPN-D": {
20+
"ipv4": [ "10.1.0.0/16" ],
21+
"ipv6": [ "2a04:2507:0:1::/64" ]
22+
},
23+
"LOCAL-ADM": {
24+
"ipv4": [ "10.2.0.0/16" ],
25+
"ipv6": [ "2a04:2507:0:2::/64" ]
26+
},
27+
"LOCAL-USR": {
28+
"ipv4": [ "10.3.0.0/16" ],
29+
"ipv6": [ "2a04:2507:0:3::/64" ]
30+
},
31+
"MPLS-ADM": {
32+
"ipv4": [ "10.4.0.0/16", "10.6.0.0/16", "10.8.0.0/16" ],
33+
"ipv6": [ "2a04:2507:0:4::/64", "2a04:2507:0:6::/64", "2a04:2507:0:8::/64" ]
34+
},
35+
"MPLS-USR": {
36+
"ipv4": [ "10.5.0.0/16", "10.7.0.0/16", "10.9.0.0/16" ],
37+
"ipv6": [ "2a04:2507:0:5::/64", "2a04:2507:0:7::/64", "2a04:2507:0:9::/64" ]
38+
},
39+
"__PRIVATE__": {
40+
"ipv4": [ "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16" ],
41+
"ipv6": [ ]
42+
}
43+
},
44+
"topology": {
45+
"internet": [ "WAN" ],
46+
"onPremise": [ "LOCAL-ADM", "LOCAL-USR" ],
47+
"interSite": {
48+
"site_C": [ "VPN-C" ],
49+
"site_D": [ "VPN-D" ],
50+
"site_B": [ "MPLS-ADM", "MPLS-USR" ]
51+
},
52+
"private": [ "__PRIVATE__" ]
53+
}
54+
},
55+
"site_B": {
56+
"location": "Bordeaux, FRANCE",
57+
"hostname": "firewall_B",
58+
"os": "juniper-junos",
59+
"ip": "1.2.3.5",
60+
"gui": "https",
61+
"zones": {
62+
"WAN": {
63+
"ipv4": [ "0.0.0.0/0" ],
64+
"ipv6": [ "::/0" ]
65+
},
66+
"VPN-C": {
67+
"ipv4": [ "10.0.0.0/16" ],
68+
"ipv6": [ "2a04:2507:0:0::/64" ]
69+
},
70+
"VPN-D": {
71+
"ipv4": [ "10.1.0.0/16" ],
72+
"ipv6": [ "2a04:2507:0:1::/64" ]
73+
},
74+
"LOCAL-ADM": {
75+
"ipv4": [ "10.4.0.0/16" ],
76+
"ipv6": [ "2a04:2507:0:4::/64" ]
77+
},
78+
"LOCAL-USR": {
79+
"ipv4": [ "10.5.0.0/16" ],
80+
"ipv6": [ "2a04:2507:0:5::/64" ]
81+
},
82+
"MPLS-ADM": {
83+
"ipv4": [ "10.2.0.0/16", "10.6.0.0/16", "10.8.0.0/16" ],
84+
"ipv6": [ "2a04:2507:0:2::/64", "2a04:2507:0:6::/64", "2a04:2507:0:8::/64" ]
85+
},
86+
"MPLS-USR": {
87+
"ipv4": [ "10.3.0.0/16", "10.7.0.0/16", "10.9.0.0/16" ],
88+
"ipv6": [ "2a04:2507:0:3::/64", "2a04:2507:0:7::/64", "2a04:2507:0:9::/64" ]
89+
},
90+
"__PRIVATE__": {
91+
"ipv4": [ "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16" ],
92+
"ipv6": [ ]
93+
}
94+
},
95+
"topology": {
96+
"internet": [ "WAN" ],
97+
"onPremise": [ "LOCAL-ADM", "LOCAL-USR" ],
98+
"interSite": {
99+
"site_C": [ "VPN-C" ],
100+
"site_D": [ "VPN-D" ],
101+
"site_A": [ "MPLS-ADM", "MPLS-USR" ]
102+
},
103+
"private": [ "__PRIVATE__" ]
104+
}
105+
}
106+
},
107+
"configuration": {
108+
"templates": {
109+
"path": "templates/firewall"
110+
},
111+
"exports": {
112+
"path": "tmp"
113+
},
114+
"objects" : {
115+
"file": "backup/firewall/objects.json"
116+
},
117+
"configs": {
118+
"path": "backup/firewall/configurations"
119+
}
120+
}
121+
}
122+
}

‎firewall.php.example‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<?php
2+
define("ROOT_DIR", __DIR__);
3+
require_once('services/firewall.php');
4+
5+
if(!isset($configurations))
6+
{
7+
$configurations = array(
8+
__DIR__ . '/configurations/config.json',
9+
__DIR__ . '/configurations/config.user.json',
10+
__DIR__ . '/configurations/firewall.json',
11+
__DIR__ . '/configurations/firewall.user.json',
12+
);
13+
}
14+
15+
/**
16+
* Déplace le curseur d'une ligne vers le haut
17+
* Fix le saut de ligne lors de la touche entrée pour lancer le script CLI
18+
*
19+
* Permet d'harmoniser le traitement des sauts de lignes:
20+
* --> Saut de ligne avant un texte et non après!
21+
*/
22+
echo "\033[1A";
23+
24+
/**
25+
* Change [IPAM_SERVER_KEY] with the key of your PHPIPAM server in configuration file
26+
* You can add many PHPIPAM server, it is compatible multiple PHPIPAM
27+
* If you have not PHPIPAM service, remove argument or keep it empty
28+
*
29+
* Example with PHPIPAM disabled: $MAIN = new Service_Firewall($configurations, array());
30+
* Example with PHPIPAM enabled: $MAIN = new Service_Firewall($configurations, array('myIpamKey_1', 'myIpamKey_2'));
31+
*/
32+
$MAIN = new Service_Firewall($configurations, array('[IPAM_SERVER_KEY]'));
33+
34+
echo PHP_EOL;
35+
exit();

0 commit comments

Comments
 (0)