firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add support for local service reachable from all extern networks.

Browse Source
This commit is contained in:
root 2020-07-30 16:05:01 +02:00
parent 5a958fa332
commit 3ff1d1c004
5 changed files with 161 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
conf/main_ipv4.conf.sample
View File

@ -73,6 +73,32 @@ any_access_to_inet_networks=""
any_access_from_inet_networks=""
# =============
# - Allow local services from ALL extern netwoks
# =============
# - allow_all_ext_traffic_to_local_service
# -
# - allow_all_ext_traffic_to_local_service="local-address:port:protocol [local-address:port:protocol] .."
# -
# - Note:
# - =====
# - - Only 'tcp' and 'udp' are allowed valuse for protocol.
# -
# - Example:
# - allow extern traffic to service at 83.223.73.210 on port 1036
# - allow extern traffic to https service at 83.223.73.204
# -
# - allow_ext_net_to_local_service="
# - 83.223.73.210:1036:tcp
# - 83.223.73.204:$standard_https_port:tcp
# - "
# -
# - Blank separated list
# -
allow_all_ext_traffic_to_local_service=""
# =============
# - Allow local services from given extern networks

27
conf/main_ipv6.conf.sample
View File

@ -70,6 +70,33 @@ any_access_from_inet_networks=""
# =============
# - Allow local services from ALL extern netwoks
# =============
# - allow_all_ext_traffic_to_local_service
# -
# - allow_all_ext_traffic_to_local_service="local-address,port,protocol [local-address,port,protocol] .."
# -
# - Note:
# - =====
# - - Only 'tcp' and 'udp' are allowed valuse for protocol.
# -
# - Example:
# - allow extern traffic to service at 2a01:30:1fff:fd00::210 on port 1036
# - allow extern traffic to https service at 2a01:30:1fff:fd00::204
# -
# - allow_ext_net_to_local_service="
# - 83.223.73.210,1036,tcp
# - 83.223.73.204,$standard_https_port,tcp
# - "
# -
# - Blank separated list
# -
allow_all_ext_traffic_to_local_service=""
# =============
# - Allow local services from given extern networks
# =============

8
conf/post_decalrations.conf
View File

@ -85,6 +85,14 @@ for _net in $any_access_from_inet_networks ; do
any_access_from_inet_network_arr+=("$_net")
done
# ---
# - Allow local services from ALL extern netwoks
# ---
declare -a allow_all_ext_traffic_to_local_service_arr
for _val in $allow_all_ext_traffic_to_local_service ; do
allow_all_ext_traffic_to_local_service_arr+=("$_val")
done
# ---
# - Allow local services from given extern networks
# ---

50
ip6t-firewall-gateway
View File

@ -903,6 +903,56 @@ fi
# ---
# - Allow local services from ALL extern netwoks
# ---
echononl "\tAllow local services from ALL extern netwoks"
if [[ ${#allow_all_ext_traffic_to_local_service_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces ; then
for _val in "${allow_all_ext_traffic_to_local_service_arr[@]}" ; do
IFS=',' read -a _val_arr <<< "${_val}"
for _dev in ${ext_if_arr[@]} ; do
if containsElement "${_val_arr[0]}" "${gateway_ipv4_address_arr[@]}" ; then
$ip6t -A INPUT -i $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
continue
fi
if $kernel_activate_forwarding ; then
# - Nat if interface is on a dsl line
# -
if containsElement "${_val_arr[0]}" "${nat_device_arr[@]}" ; then
$ip6t -t nat -A PREROUTING -i $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -j DNAT --to ${_val_arr[0]}:${_val_arr[1]}
fi
$ip6t -A FORWARD -i $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
fi
done
# - Rule is needed if (local) interface aliases in use (like eth0:1)
# -
if $kernel_activate_forwarding && $local_alias_interfaces ; then
$ip6t -A FORWARD -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p ${_val_arr[2]} -s ${_val_arr[0]} --sport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
fi
done
echo_done
else
echo_skipped
fi
# ---
# - Allow local services from given extern networks
# ---

50
ipt-firewall-gateway
View File

@ -1465,6 +1465,56 @@ fi
# ---
# - Allow local services from ALL extern netwoks
# ---
echononl "\tAllow local services from ALL extern netwoks"
if [[ ${#allow_all_ext_traffic_to_local_service_arr[@]} -gt 0 ]] \
&& $kernel_activate_forwarding ; then
for _val in "${allow_all_ext_traffic_to_local_service_arr[@]}" ; do
IFS=':' read -a _val_arr <<< "${_val}"
for _dev in ${ext_if_arr[@]} ; do
if containsElement "${_val_arr[0]}" "${gateway_ipv4_address_arr[@]}" ; then
$ipt -A INPUT -i $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
continue
fi
if $kernel_activate_forwarding ; then
# - Nat if interface is on a dsl line
# -
if containsElement "${_val_arr[0]}" "${nat_device_arr[@]}" ; then
$ipt -t nat -A PREROUTING -i $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -j DNAT --to ${_val_arr[0]}:${_val_arr[1]}
fi
$ipt -A FORWARD -i $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
fi
done
# - Rule is needed if (local) interface aliases in use (like eth0:1)
# -
if $kernel_activate_forwarding && $local_alias_interfaces ; then
$ipt -A FORWARD -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
$ipt -A FORWARD -p ${_val_arr[2]} -s ${_val_arr[0]} --sport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
fi
done
echo_done
else
echo_skipped
fi
# ---
# - Allow local services from given extern networks
# ---