firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Support IP range for 'Allow extern service'.

Browse Source
This commit is contained in:
Christoph 2025-05-23 12:44:02 +02:00
parent c2d62b72bd
commit 01db31c39c
2 changed files with 22 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
ip6t-firewall-gateway
View File

@ -1885,18 +1885,25 @@ if [[ ${#allow_to_ext_service_arr[@]} -gt 0 ]] ; then
IFS=',' read -a _val_arr <<< "${_val}"
if [[ "${_val_arr[1]}" == *"-"* ]]; then
_tmp_port=${_val_arr[1]}
_port="${_tmp_port//-/:}"
else
_port=${_val_arr[1]}
fi
for _dev in ${ext_if_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A OUTPUT -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_port} -m conntrack --ctstate NEW -j ACCEPT
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A FORWARD -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_port} -m conntrack --ctstate NEW -j ACCEPT
fi
done
if $local_alias_interfaces && $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
if [[ "${_val_arr[2]}" = "tcp" ]]; then
$ip6t -A FORWARD -p tcp -d ${_val_arr[0]} --dport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -s ${_val_arr[0]} --sport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -d ${_val_arr[0]} --dport ${_port} --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -s ${_val_arr[0]} --sport ${_port} --tcp-flag ACK ACK -j ACCEPT
fi
fi

15
ipt-firewall-gateway
View File

@ -2599,18 +2599,25 @@ if [[ ${#allow_to_ext_service_arr[@]} -gt 0 ]] ; then
IFS=':' read -a _val_arr <<< "${_val}"
if [[ "${_val_arr[1]}" == *"-"* ]]; then
_tmp_port=${_val_arr[1]}
_port="${_tmp_port//-/:}"
else
_port=${_val_arr[1]}
fi
for _dev in ${ext_if_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
$ipt -A OUTPUT -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_port} -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
$ipt -A FORWARD -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
$ipt -A FORWARD -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_port} -m conntrack --ctstate NEW -j ACCEPT
fi
done
if $local_alias_interfaces ; then
if [[ "${_val_arr[2]}" = "tcp" ]]; then
$ipt -A FORWARD -p tcp -d ${_val_arr[0]} --dport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
$ipt -A FORWARD -p tcp -s ${_val_arr[0]} --sport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
$ipt -A FORWARD -p tcp -d ${_val_arr[0]} --dport ${_port} --tcp-flag ACK ACK -j ACCEPT
$ipt -A FORWARD -p tcp -s ${_val_arr[0]} --sport ${_port} --tcp-flag ACK ACK -j ACCEPT
fi
fi