firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Its now possible to define port range at 'Allow extern service from given local network' instead of a single port.

Browse Source
This commit is contained in:
Christoph
2026-03-03 15:50:51 +01:00
parent a5b226284a
commit 1f5c01d8c9
4 changed files with 36 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
ip6t-firewall-gateway
View File

@@ -1823,7 +1823,17 @@ if [[ ${#allow_local_net_to_ext_service_arr[@]} -gt 0 ]] \
for _val in "${allow_local_net_to_ext_service_arr[@]}" ; do
IFS=',' read -a _val_arr <<< "${_val}"
$ip6t -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
# if the port range is specified with a hyphen instead of a colon
#
if [[ "${_val_arr[2]}" =~ ^[^-]*-[^-]*$ ]]; then
_ports="${_val_arr[2]/-/:}"
else
_ports="${_val_arr[2]}"
fi
$ip6t -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} \
-m multiport --dports ${_ports} -m conntrack --ctstate NEW -j ACCEPT
# - Note:
# - If (local) alias interfaces like eth1:0 in use, youe need a further
@@ -1831,8 +1841,10 @@ if [[ ${#allow_local_net_to_ext_service_arr[@]} -gt 0 ]] \
# -
if $local_alias_interfaces ; then
if [[ "${_val_arr[3]}" = "tcp" ]]; then
$ip6t -A FORWARD -p ${_val_arr[3]} -d ${_val_arr[1]} --dport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[1]} --sport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p ${_val_arr[3]} -d ${_val_arr[1]} \
-m multiport --dports ${_ports} --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[1]} \
-m multiport --sports ${_ports} --tcp-flag ACK ACK -j ACCEPT
fi
fi
done