firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Its now possible to define port range at 'Allow extern service from given local network' instead of a single port.

Browse Source
This commit is contained in:
Christoph
2026-03-03 15:50:51 +01:00
parent a5b226284a
commit 1f5c01d8c9
4 changed files with 36 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
ipt-firewall-gateway
View File

@@ -2564,7 +2564,17 @@ if [[ ${#allow_local_net_to_ext_service_arr[@]} -gt 0 ]] \
for _val in "${allow_local_net_to_ext_service_arr[@]}" ; do
IFS=':' read -a _val_arr <<< "${_val}"
$ipt -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
# Is a port range given?
#
if [[ "${_val_arr[2]}" =~ ^[^-]*-[^-]*$ ]]; then
_ports="${_val_arr[2]/-/:}"
else
_ports="${_val_arr[2]}"
fi
$ipt -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} \
-m multiport --dports ${_ports} -m conntrack --ctstate NEW -j ACCEPT
# - Note:
# - If (local) alias interfaces like eth1:0 in use, youe need a further
@@ -2572,8 +2582,8 @@ if [[ ${#allow_local_net_to_ext_service_arr[@]} -gt 0 ]] \
# -
if $local_alias_interfaces ; then
if [[ "${_val_arr[3]}" = "tcp" ]]; then
$ipt -A FORWARD -p tcp -d ${_val_arr[1]} --dport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
$ipt -A FORWARD -p tcp -s ${_val_arr[1]} --sport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
$ipt -A FORWARD -p tcp -d ${_val_arr[1]} -m multiport --dports ${_ports} --tcp-flag ACK ACK -j ACCEPT
$ipt -A FORWARD -p tcp -s ${_val_arr[1]} -m multiport --sports ${_ports} --tcp-flag ACK ACK -j ACCEPT
fi
fi
done