--- distrib/60-Sphynx_rules	2016-12-14 09:16:46.000000000 +0100
+++ modif/60-Sphynx_rules	2017-05-24 13:05:58.132841159 +0200
@@ -28,23 +28,19 @@
 # autoriser les connexions au travers d'ipsec
 /sbin/iptables -A root-eth0 -m policy --pol ipsec --proto esp --dir out -j ACCEPT

-## definition de la chaine eth0-root
-/sbin/iptables -A eth0-root -p tcp -m state --state NEW -m tcp --dport 4201:4202 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-%if %%admin_eth0 == 'oui'
-#ead-web on eth0
- %for %%ip_admin in %%ip_admin_eth0
-/sbin/iptables -A eth0-root -s %%ip_admin/%%ip_admin.netmask_admin_eth0 -p tcp -m state --state NEW -m tcp --dport 4200 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-/sbin/iptables -A eth0-root -s %%ip_admin/%%ip_admin.netmask_admin_eth0 -p tcp -m state --state NEW -m tcp --dport 8088 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
- %end for
-%end if
-%if %%ssh_eth0 == "oui"
-#ssh on eth0
- %for %%reseau_ssh in %%ip_ssh_eth0
-#/sbin/iptables -A eth0-root -s %%reseau_ssh/%%reseau_ssh.netmask_ssh_eth0 -p tcp -m state --state NEW -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-/sbin/iptables -A eth0-root -s %%reseau_ssh/%%reseau_ssh.netmask_ssh_eth0 -p tcp -m state --state NEW -m tcp --dport 8090 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
- %end for
-%end if
+%def ethX_root_ARV(%%num_int)
+ %set %%chain_name = "eth" + %%num_int + "-root"
+ %if %%getVar('admin_eth' + %%num_int) == 'oui'
+#ARV on eth%%num_int
+  %for %%ip_admin in %%getVar('ip_admin_eth' + %%num_int)
+   %set %%netmask_key = "netmask_admin_eth"+%%num_int
+/sbin/iptables -A %%chain_name -s %%ip_admin/%%getattr(%%ip_admin, %%netmask_key) -p tcp -m state --state NEW -m tcp --dport %%arv_port --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
+  %end for
+ %end if
+%end def

+## definition de la chaine eth0-root
+%%ethX_root_ARV('0')
 /sbin/iptables -A eth0-root -p udp -m udp --dport 500 -j ACCEPT
 /sbin/iptables -A eth0-root -p udp -m udp --dport 4500 -j ACCEPT
 /sbin/iptables -A eth0-root -p esp -j ACCEPT
@@ -62,38 +58,12 @@
 ## definition de la chaine eth1-root
 /sbin/iptables -A INPUT -d %%adresse_ip_eth1 -i eth1 -j eth1-root
 /sbin/iptables -A eth1-root -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-/sbin/iptables -A eth1-root -p tcp -m state --state NEW -m tcp --dport 4201:4202 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
- %if %%admin_eth1 == 'oui'
-#ead-web on eth1
-  %for %%ip_admin in %%ip_admin_eth1
-/sbin/iptables -A eth1-root -s %%ip_admin/%%ip_admin.netmask_admin_eth1 -p tcp -m state --state NEW -m tcp --dport 4200 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-/sbin/iptables -A eth1-root -s %%ip_admin/%%ip_admin.netmask_admin_eth1 -p tcp -m state --state NEW -m tcp --dport 8088 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-  %end for
- %end if
- %if %%ssh_eth1 == "oui"
- #ssh on eth1
-  %for %%reseau_ssh in %%ip_ssh_eth1
-/sbin/iptables -A eth1-root -s %%reseau_ssh/%%reseau_ssh.netmask_ssh_eth1 -p tcp -m state --state NEW -m tcp --dport 8090 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-  %end for
- %end if
+%%ethX_root_ARV('1')
 %end if

 %if %%nombre_interfaces >= '3'
 ## definition de la chaine eth2-root
-/sbin/iptables -A eth2-root -p tcp -m state --state NEW -m tcp --dport 4201:4202 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-#ead-web on eth2
-%if %%admin_eth2 == 'oui'
-  %for %%ip_admin in %%ip_admin_eth2
-/sbin/iptables -A eth2-root -s %%ip_admin/%%ip_admin.netmask_admin_eth2 -p tcp -m state --state NEW -m tcp --dport 4200 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-/sbin/iptables -A eth1-root -s %%ip_admin/%%ip_admin.netmask_admin_eth2 -p tcp -m state --state NEW -m tcp --dport 8088 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-  %end for
- %end if
- %if %%ssh_eth2 == "oui"
- #ssh on eth2
-  %for %%reseau_ssh in %%ip_ssh_eth2
-/sbin/iptables -A eth2-root -s %%reseau_ssh/%%reseau_ssh.netmask_ssh_eth2 -p tcp -m state --state NEW -m tcp --dport 8090 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-  %end for
- %end if
+%%ethX_root_ARV('2')
  %if %%getVar('activer_haute_dispo', 'non') != "non"
 /sbin/iptables -A %%corosync_dial_if-root -m pkttype --pkt-type multicast -j ACCEPT
 /sbin/iptables -A %%corosync_dial_if-root -p udp -m udp --dport %%corosync_mcastport -j ACCEPT
