(net_if, ports, src_ip, igmp, prompt)
Configure firewalld for blocksat and IGMP traffic

    Add one rich rule for blocksat traffic coming specifically from the
    satellite of choice (corresponding to the given source IP) and another rich
    rule (if necessary) for IGMP traffic.

    NOTE: unlike the iptables configuration, the current firewalld
    configuration disregards the network interface. The alternative to consider
    the interface is to use firewalld zones. However, because the network
    interface may not be dedicated to DVB-S2 traffic (e.g., when using a
    standalone receiver), it can be undesirable to assign the interface
    receiving satellite traffic to a dedicated zone just for blocksat. In
    contrast, the rich rule approach is more generic and works for all types of
    receivers.
Configure firewalld for blocksat and IGMP traffic
Configure firewalld for blocksat and IGMP traffic
def _configure_firewalld(net_if, ports, src_ip, igmp, prompt):
    """Configure firewalld for blocksat and IGMP traffic

    Add one rich rule for blocksat traffic coming specifically from the
    satellite of choice (corresponding to the given source IP) and another rich
    rule (if necessary) for IGMP traffic.

    NOTE: unlike the iptables configuration, the current firewalld
    configuration disregards the network interface. The alternative to consider
    the interface is to use firewalld zones. However, because the network
    interface may not be dedicated to DVB-S2 traffic (e.g., when using a
    standalone receiver), it can be undesirable to assign the interface
    receiving satellite traffic to a dedicated zone just for blocksat. In
    contrast, the rich rule approach is more generic and works for all types of
    receivers.

    """

    if len(ports) > 1:
        portrange = "{}-{}".format(min(ports), max(ports))
    else:
        portrange = ports

    util.fill_print(
        "- Configure the firewall to accept Blocksat traffic arriving " +
        "from {} towards address {} on UDP ports {}:\n".format(
            src_ip, defs.mcast_ip, portrange))

    if (not runner.dry and prompt):
        if (not util.ask_yes_or_no("Add firewalld rule?")):
            print("\nFirewall configuration cancelled")
            return

    rich_rule = ("rule "
                 "family=ipv4 "
                 "source address={} "
                 "destination address={}/32 "
                 "port port={} protocol=udp accept".format(
                     src_ip, defs.mcast_ip, portrange))
    runner.run(['firewall-cmd', '--add-rich-rule', "{}".format(rich_rule)],
               root=True)

    if (runner.dry):
        print()
        util.fill_print(
            "NOTE: Add \"--permanent\" to make it persistent. In this case, "
            "remember to reload firewalld afterwards.")

    # We're done, unless we also need to configure an IGMP rule
    if (not igmp):
        return

    util.fill_print(
        "- Allow IGMP packets. This is necessary when using a standalone "
        "DVB-S2 receiver connected through a switch:\n")

    if (not runner.dry and prompt):
        if (not util.ask_yes_or_no("Enable IGMP on the firewall?")):
            print("\nFirewall configuration cancelled")
            return

    runner.run(['firewall-cmd', '--add-protocol=igmp'], root=True)
    print()
def _configure_firewalld ( net_if , ports , src_ip , igmp , prompt ) : if len ( ports ) > 1 : portrange = "{}-{}" . format ( min ( ports ) , max ( ports ) ) else : portrange = ports util . fill_print ( "- Configure the firewall to accept Blocksat traffic arriving " + "from {} towards address {} on UDP ports {}:\n" . format ( src_ip , defs . mcast_ip , portrange ) ) if ( not runner . dry and prompt ) : if ( not util . ask_yes_or_no ( "Add firewalld rule?" ) ) : print ( "\nFirewall configuration cancelled" ) return rich_rule = ( "rule " "family=ipv4 " "source address={} " "destination address={}/32 " "port port={} protocol=udp accept" . format ( src_ip , defs . mcast_ip , portrange ) ) runner . run ( [ 'firewall-cmd' , '--add-rich-rule' , "{}" . format ( rich_rule ) ] , root = True ) if ( runner . dry ) : print ( ) util . fill_print ( "NOTE: Add \"--permanent\" to make it persistent. In this case, " "remember to reload firewalld afterwards." ) # We're done, unless we also need to configure an IGMP rule if ( not igmp ) : return util . fill_print ( "- Allow IGMP packets. This is necessary when using a standalone " "DVB-S2 receiver connected through a switch:\n" ) if ( not runner . dry and prompt ) : if ( not util . ask_yes_or_no ( "Enable IGMP on the firewall?" ) ) : print ( "\nFirewall configuration cancelled" ) return runner . run ( [ 'firewall-cmd' , '--add-protocol=igmp' ] , root = True ) print ( )