firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add support for unifi devices outside internal network.

Browse Source
This commit is contained in:
Christoph 2019-08-01 17:22:48 +02:00
parent 8e94cdcd3b
commit 14b72b2ad2
5 changed files with 78 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
conf/main_ipv4.conf.sample
View File

@ -1000,6 +1000,12 @@ local_unifi_controller_service=false
# -
unifi_ap_local_ips=""
# Note:
# in contrast to devices at local networks, devices hosted at extern network
# are only be seen, if the device is part of this array 'unifi_ap_extern_ip_arr'
#
unifi_ap_extern_ips=""
# - UniFi Controllers on local network (other than this machine)
# -

6
conf/main_ipv6.conf.sample
View File

@ -970,6 +970,12 @@ local_unifi_controller_service=false
# -
unifi_ap_local_ips=""
# Note:
# in contrast to devices at local networks, devices hosted at extern network
# are only be seen, if the device is part of this array 'unifi_ap_extern_ip_arr'
#
unifi_ap_extern_ips=""
# - UniFi Controllers on local network (other than this machine)
# -

4
conf/post_decalrations.conf
View File

@ -374,6 +374,10 @@ declare -a unifi_ap_local_ip_arr
for _ip in $unifi_ap_local_ips ; do
unifi_ap_local_ip_arr+=("$_ip")
done
declare -a unifi_ap_extern_ip_arr
for _ip in $unifi_ap_extern_ips ; do
unifi_ap_extern_ip_arr+=("$_ip")
done
declare -a unifi_controller_gateway_ip_arr
for _ip in $unifi_controller_gateway_ips ; do
unifi_controller_gateway_ip_arr+=("$_ip")

38
ip6t-firewall-gateway
View File

@ -3398,7 +3398,7 @@ fi
# ---
# - Ubiquiti Unifi Controller (Accesspoints) Gateway
# - Ubiquiti Unifi Controller Gateway
# ---
@ -3411,13 +3411,30 @@ if $local_unifi_controller_service ; then
$ip6t -A INPUT -p udp -i $_dev -m multiport --dports $unify_udp_ports -m conntrack --ctstate NEW -j ACCEPT
done
# Note:
# in contrast to devices at local networks, devices hosted at extern network
# are only be seen, if the device is part of this array 'unifi_ap_extern_ip_arr'
#
if [[ ${#unifi_ap_extern_ip_arr[@]} -gt 0 ]]; then
for _ip in ${unifi_ap_extern_ip_arr[@]} ; do
$ip6t -A INPUT -p udp -s $_ip -m multiport --dports $unify_broadcast_udp_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A INPUT -p tcp -s $_ip -m multiport --dports $unify_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A INPUT -p udp -s $_ip -m multiport --dports $unify_udp_ports -m conntrack --ctstate NEW -j ACCEPT
done
fi
echo_done
else
echo_skipped
fi
echononl "\t\tUbiquiti Unifi Controller Gateway - STUN to Unifi APs"
if $local_unifi_controller_service ; then
if $local_unifi_controller_service \
&& [[ ${#unifi_ap_local_ip_arr[@]} -gt 0 ]] \
&& [[ ${#unifi_ap_extern_ip_arr[@]} -gt 0 ]] ; then
if [[ ${#unifi_ap_local_ip_arr[@]} -gt 0 ]] ; then
@ -3427,11 +3444,20 @@ if $local_unifi_controller_service ; then
done
echo_done
else
echo_skipped
warn "Local Unifi Controller is defined, but no Unifi APs!"
fi
if [[ ${#unifi_ap_extern_ip_arr[@]} -gt 0 ]] ; then
for _ip_ap in ${unifi_ap_local_ip_arr[@]} ; do
$ip6t -A OUTPUT -p udp -d $_ip_ap -m multiport --sports $unify_udp_ports -m conntrack --ctstate NEW -j ACCEPT
done
fi
echo_done
else
echo_skipped
fi

35
ipt-firewall-gateway
View File

@ -4119,6 +4119,20 @@ if $local_unifi_controller_service ; then
$ipt -A INPUT -p udp -i $_dev -m multiport --dports $unify_udp_ports -m conntrack --ctstate NEW -j ACCEPT
done
# Note:
# in contrast to devices at local networks, devices hosted at extern network
# are only be seen, if the device is part of this array 'unifi_ap_extern_ip_arr'
#
if [[ ${#unifi_ap_extern_ip_arr[@]} -gt 0 ]]; then
for _ip in ${unifi_ap_extern_ip_arr[@]} ; do
$ipt -A INPUT -p udp -s $_ip -m multiport --dports $unify_broadcast_udp_ports -m conntrack --ctstate NEW -j ACCEPT
$ipt -A INPUT -p tcp -s $_ip -m multiport --dports $unify_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
$ipt -A INPUT -p udp -s $_ip -m multiport --dports $unify_udp_ports -m conntrack --ctstate NEW -j ACCEPT
done
fi
echo_done
else
echo_skipped
@ -4126,7 +4140,9 @@ fi
echononl "\t\tUbiquiti Unifi Controller Gateway - STUN to Unifi APs"
if $local_unifi_controller_service ; then
if $local_unifi_controller_service \
&& [[ ${#unifi_ap_local_ip_arr[@]} -gt 0 ]] \
&& [[ ${#unifi_ap_extern_ip_arr[@]} -gt 0 ]] ; then
if [[ ${#unifi_ap_local_ip_arr[@]} -gt 0 ]] ; then
@ -4136,11 +4152,20 @@ if $local_unifi_controller_service ; then
done
echo_done
else
echo_skipped
warn "Local Unifi Controller is defined, but no Unifi APs!"
fi
if [[ ${#unifi_ap_extern_ip_arr[@]} -gt 0 ]] ; then
for _ip_ap in ${unifi_ap_local_ip_arr[@]} ; do
$ipt -A OUTPUT -p udp -d $_ip_ap -m multiport --sports $unify_udp_ports -m conntrack --ctstate NEW -j ACCEPT
done
fi
echo_done
else
echo_skipped
fi