Fix errors on rules for unify controllers.
This commit is contained in:
@ -798,7 +798,8 @@ fi
|
||||
|
||||
echononl "\tAllow these local networks any access to the internet"
|
||||
if [[ ${#any_access_to_inet_network_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_forward_between_interfaces ; then
|
||||
&& $kernel_forward_between_interfaces \
|
||||
&& ! $permit_local_net_to_inet ; then
|
||||
|
||||
for _net in ${any_access_to_inet_network_arr[@]}; do
|
||||
for _dev in ${ext_if_arr[@]} ; do
|
||||
@ -817,12 +818,9 @@ fi
|
||||
# ---
|
||||
|
||||
echononl "\tAllow local services from given local networks"
|
||||
|
||||
# - !! Note:
|
||||
# - does NOT depend on settings 'permit_between_local_networks' !!
|
||||
# -
|
||||
if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_forward_between_interfaces ; then
|
||||
&& $kernel_forward_between_interfaces \
|
||||
&& ! $permit_local_net_to_inet ; then
|
||||
|
||||
for _val in "${allow_local_net_to_local_service_arr[@]}" ; do
|
||||
IFS=',' read -a _val_arr <<< "${_val}"
|
||||
@ -853,11 +851,9 @@ fi
|
||||
|
||||
echononl "\tAllow all traffic from local network to local ip-address"
|
||||
|
||||
# - !! Note:
|
||||
# - does NOT depend on settings 'permit_between_local_networks' !!
|
||||
# -
|
||||
if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_forward_between_interfaces ; then
|
||||
&& $kernel_forward_between_interfaces \
|
||||
&& ! $permit_between_local_networks ; then
|
||||
|
||||
for _val in ${allow_local_net_to_local_ip_arr[@]} ; do
|
||||
IFS=',' read -a _val_arr <<< "${_val}"
|
||||
@ -885,11 +881,9 @@ fi
|
||||
|
||||
echononl "\tAllow all traffic from local ip-address to local network"
|
||||
|
||||
# - !! Note:
|
||||
# - does NOT depend on settings 'permit_between_local_networks' !!
|
||||
# -
|
||||
if [[ ${#allow_local_ip_to_local_net_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_forward_between_interfaces ; then
|
||||
&& $kernel_forward_between_interfaces \
|
||||
&& ! $permit_between_local_networks ; then
|
||||
|
||||
for _val in ${allow_local_ip_to_local_net_arr[@]} ; do
|
||||
IFS=',' read -a _val_arr <<< "${_val}"
|
||||
@ -917,11 +911,9 @@ fi
|
||||
|
||||
echononl "\tAllow all traffic from local network to (another) local network"
|
||||
|
||||
# - !! Note:
|
||||
# - does NOT depend on settings 'permit_between_local_networks' !!
|
||||
# -
|
||||
if [[ ${#allow_local_net_to_local_net_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_forward_between_interfaces ; then
|
||||
&& $kernel_forward_between_interfaces \
|
||||
&& ! $permit_between_local_networks ; then
|
||||
|
||||
for _val in ${allow_local_net_to_local_net_arr[@]} ; do
|
||||
IFS=',' read -a _val_arr <<< "${_val}"
|
||||
@ -949,11 +941,9 @@ fi
|
||||
|
||||
echononl "\tAllow local ip address from given local interface"
|
||||
|
||||
# - !! Note:
|
||||
# - does NOT depend on settings 'permit_between_local_networks' !!
|
||||
# -
|
||||
if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_forward_between_interfaces ; then
|
||||
&& $kernel_forward_between_interfaces \
|
||||
&& ! $permit_between_local_networks ; then
|
||||
|
||||
for _val in ${allow_local_if_to_local_ip_arr[@]} ; do
|
||||
IFS=',' read -a _val_arr <<< "${_val}"
|
||||
@ -980,10 +970,6 @@ fi
|
||||
# ---
|
||||
|
||||
echononl "\tSeparate local networks.."
|
||||
|
||||
# - !! Note:
|
||||
# - does NOT depend on settings 'permit_between_local_networks' !!
|
||||
# -
|
||||
if [[ ${#separate_local_network_arr[@]} -gt 0 ]] && $kernel_forward_between_interfaces ; then
|
||||
for _net in ${separate_local_network_arr[@]}; do
|
||||
for _dev in ${local_if_arr[@]} ; do
|
||||
@ -1002,10 +988,6 @@ fi
|
||||
# ---
|
||||
|
||||
echononl "\tSeparate local interfaces.."
|
||||
|
||||
# - !! Note:
|
||||
# - does NOT depend on settings 'permit_between_local_networks' !!
|
||||
# -
|
||||
if [[ ${#separate_local_if_arr[@]} -gt 0 ]] && $kernel_forward_between_interfaces ; then
|
||||
for _dev_1 in ${separate_local_if_arr[@]}; do
|
||||
for _dev_2 in ${local_if_arr[@]} ; do
|
||||
@ -2724,27 +2706,23 @@ fi
|
||||
# ---
|
||||
|
||||
echononl "\t\tUbiquiti Unifi Accesspoints"
|
||||
if [[ ${#unifi_controller_gateway_ip_arr[@]} -gt 0 ]] || [[ ${#unify_controller_local_net_ip_arr[@]} -gt 0 ]] ; then
|
||||
if [[ ${#unifi_controller_gateway_ip_arr[@]} -gt 0 ]] ; then
|
||||
if $local_unifi_controller_service || [[ ${#unify_controller_local_net_ip_arr[@]} -gt 0 ]] ; then
|
||||
if $local_unifi_controller_service ; then
|
||||
|
||||
for _ip_ctl in ${unifi_controller_gateway_ip_arr[@]} ; do
|
||||
for _dev in ${local_if_arr[@]} ; do
|
||||
$ip6t -A INPUT -i $_dev -p tcp -d $_ip_ctl -m multiport --dports $unify_controller_ports -m conntrack --ctstate NEW -j ACCEPT
|
||||
if $provide_hotspot ; then
|
||||
$ip6t -A INPUT -i $_dev -p tcp -d $_ip_ctl -m multiport --dports $hotspot_ports -m conntrack --ctstate NEW -j ACCEPT
|
||||
fi
|
||||
done
|
||||
$ip6t -A INPUT -p udp -m multiport --dports $unify_broadcast_udp_ports -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
$ip6t -A INPUT -p tcp -m multiport --dports $unify_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ip6t -A INPUT -p udp -m multiport --dports $unify_udp_ports -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ ${#unify_controller_local_net_ip_arr[@]} -gt 0 ]] ; then
|
||||
for _ip_ctl in ${unify_controller_local_net_ip_arr[@]} ; do
|
||||
for _dev in ${local_if_arr[@]} ; do
|
||||
$ip6t -A FORWARD -i $_dev -p tcp -d $_ip_ctl -m multiport --dports $unify_controller_ports -m conntrack --ctstate NEW -j ACCEPT
|
||||
if $provide_hotspot ; then
|
||||
$ip6t -A FORWARD -i $_dev -p tcp -d $_ip_ctl -m multiport --dports $hotspot_ports -m conntrack --ctstate NEW -j ACCEPT
|
||||
fi
|
||||
$ip6t -A FORWARD -i $_dev -p udp -d $_ip_ctl -m multiport --dports $unify_broadcast_udp_ports -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
$ip6t -A FORWARD -i $_dev -p tcp -d $_ip_ctl -m multiport --dports $unify_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ip6t -A FORWARD -i $_dev -p udp -d $_ip_ctl -m multiport --dports $unify_udp_ports -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
|
||||
# - Note:
|
||||
@ -2752,12 +2730,8 @@ if [[ ${#unifi_controller_gateway_ip_arr[@]} -gt 0 ]] || [[ ${#unify_controller_
|
||||
# - special rule.
|
||||
# -
|
||||
if $kernel_forward_between_interfaces && $local_alias_interfaces ; then
|
||||
$ip6t -A FORWARD -p tcp -d $_ip_ctl -m multiport --dports $unify_controller_ports --tcp-flag ACK ACK -j ACCEPT
|
||||
$ip6t -A FORWARD -p tcp -s $_ip_ctl -m multiport --sports $unify_controller_ports --tcp-flag ACK ACK -j ACCEPT
|
||||
if $provide_hotspot ; then
|
||||
$ip6t -A FORWARD -p tcp -d $_ip_ctl -m multiport --dports $hotspot_ports --tcp-flag ACK ACK -j ACCEPT
|
||||
$ip6t -A FORWARD -p tcp -s $_ip_ctl -m multiport --sports $hotspot_ports --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
$ip6t -A FORWARD -p tcp -d $_ip_ctl -m multiport --dports $unify_tcp_ports --tcp-flag ACK ACK -j ACCEPT
|
||||
$ip6t -A FORWARD -p tcp -s $_ip_ctl -m multiport --sports $unify_tcp_ports --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
Reference in New Issue
Block a user