]>
Commit | Line | Data |
---|---|---|
bee67bf1 DM |
1 | =A simple simulator to test our iptables rules= |
2 | ||
3 | ==Invovation== | |
4 | ||
5 | # ./fwtester.pl | |
6 | ||
7 | This scans for subdirectory named test-* an invokes fwtester.pl | |
8 | for each subdirectory with: | |
9 | ||
10 | # ./fwtester.pl test-<name>/tests | |
11 | ||
12 | ==Test directory contents== | |
13 | ||
14 | Each test directory can contain the following files: | |
15 | ||
16 | *cluster.fw Cluster wide firewall config | |
17 | ||
18 | *host.fw Host firewall config | |
19 | ||
20 | *<VMID>.fw Firewall config for VMs | |
21 | ||
22 | *tests Test descriptions | |
23 | ||
24 | ==Test description== | |
25 | ||
26 | The test description file can contain one or more tests using | |
27 | the following syntax: | |
28 | ||
29 | { from => '<zone>' , to => '<zone>', action => '<DROP|RECECT|ACCEPT>', [ source => '<ip>',] [ dest => '<ip>',] [ proto => '<tcp|udp>',] [ dport => <port>,], [ sport => <port>,] } | |
30 | ||
31 | The following <zone> definition exist currently: | |
32 | ||
33 | * host: The host itself | |
34 | ||
35 | * outside: The outside world (vmbr0 port eth0) | |
36 | ||
37 | * vm<ID>: A qemu virtual machine | |
38 | ||
39 | * ct<ID>: An openvz container | |
40 | ||
c0c871d8 DM |
41 | * nfvm: Non firewalled VM (vmbr port tapXYZ) |
42 | ||
bee67bf1 DM |
43 | ==Test examples== |
44 | ||
45 | { from => 'outside', to => 'ct200', dport => 22, action => 'ACCEPT' } | |
46 | { from => 'vm101', to => 'vm100', dport => 443, action => 'ACCEPT', id => 'vm2vm'} | |
47 | ||
48 | You can assign an 'id' to each test, so that you can run them separately: | |
49 | ||
50 | ./fwtester.pl -d test-basic1/tests vm2vm | |
51 |