firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add 'allow_to_ext_net' and 'allow_to_ext_service'.

Browse Source
This commit is contained in:
Christoph 2020-09-19 13:40:39 +02:00
parent a9961a5dde
commit 4b97303acd
5 changed files with 257 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
conf/main_ipv4.conf.sample
View File

@ -382,6 +382,50 @@ allow_local_net_to_ext_net=""
# =============
# - Allow extern service
# =============
# - allow_to_ext_service
# -
# - allow_to_ext_service="<ext-ip:port:protocol> [ext-ip:port:protocol> [.."
# -
# - All traffic to the given (extern) service is allowed
# -
# - Example:
# - allow_to_ext_service="83.223.86.98:3306:tcp
# - 83.223.86.98:10194:udp"
# -
# - Blank separated list
# -
allow_to_ext_service=""
# =============
# - Allow extern network
# =============
# - allow_to_ext_net
# -
# - Allow all traffic to given extern network
# -
# - allow_to_ext_net="<ext-net> [<ext-net> [.."
# -
# - All traffic to the given (extern) network is allowed
# -
# - Example:
# - allow_to_ext_net="83.223.86.98/32
# - 83.223.86.101/32
# - 192.68.11.81/27"
# -
# - Blank separated list
# -
allow_to_ext_net=""
# =============
# --- Separate local Networks
# =============

44
conf/main_ipv6.conf.sample
View File

@ -370,6 +370,50 @@ allow_local_net_to_ext_net=""
# =============
# - Allow extern service
# =============
# - allow_to_ext_service
# -
# - Allow all traffic to given extern service
# -
# - allow_to_ext_service="<ext-ip,port,protocol> [ext-ip,port,protocol> [.."
# -
# - All traffic to the given (extern) service is allowed
# -
# - Example:
# - allow_to_ext_service="2a01:30:0:13:211:84ff:feb7:7f9c,3306,tcp
# - 2a01:30:0:13:211:84ff:feb7:7f9c,10194,tcp"
# -
# - Blank separated list
# -
allow_to_ext_service=""
# =============
# - Allow extern network
# =============
# - allow_to_ext_net
# -
# - Allow all traffic to given extern network
# -
# - allow_to_ext_net="<local-net,ext-net> [<local-net,ext-net> [.."
# -
# - All traffic from the given (local) network to the given (extern) network is allowed
# -
# - Example:
# - allow_to_ext_net="2a01:30:0:13:211:84ff:feb7:7f9c/64
# - 2001:678:a40:3000::/64"
# -
# - Blank separated list
# -
allow_to_ext_net=""
# =============
# --- Separate local Networks
# =============

16
conf/post_decalrations.conf
View File

@ -197,6 +197,22 @@ for _val in $allow_local_net_to_ext_net ; do
allow_local_net_to_ext_net_arr+=("$_val")
done
# ---
# - Allow extern service
# ---
declare -a allow_to_ext_service_arr
for _val in $allow_to_ext_service ; do
allow_to_ext_service_arr+=("$_val")
done
# ---
# - Allow extern network
# ---
declare -a allow_to_ext_net_arr
for _val in $allow_to_ext_net ; do
allow_to_ext_net_arr+=("$_val")
done
# ---
# - Separate local Networks
# ---

77
ip6t-firewall-gateway
View File

@ -861,6 +861,11 @@ if $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p ALL -m conntrack --ctstate NEW -j ACCEPT
fi
done
if $local_alias_interfaces && $kernel_forward_between_interfaces; then
$ip6t -A FORWARD -p tcp --tcp-flag ACK ACK -j ACCEPT
fi
echo_done
else
echo_skipped
@ -1320,6 +1325,78 @@ fi
# ---
# - Allow extern service
# ---
echononl "\tAllow extern service"
if [[ ${#allow_to_ext_service_arr[@]} -gt 0 ]] ; then
for _val in "${allow_to_ext_service_arr[@]}" ; do
IFS=',' read -a _val_arr <<< "${_val}"
for _dev in ${ext_if_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
fi
done
if $local_alias_interfaces && $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
if [[ "${_val_arr[2]}" = "tcp" ]]; then
$ip6t -A FORWARD -p tcp -d ${_val_arr[0]} --dport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -s ${_val_arr[0]} --sport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
fi
fi
done
echo_done
else
echo_skipped
fi
# ---
# - Allow extern network
# ---
echononl "\tAllow extern network"
if [[ ${#allow_to_ext_net_arr[@]} -gt 0 ]] ; then
for _net in "${allow_to_ext_net_arr[@]}" ; do
for _dev in ${ext_if_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -d $_net -m conntrack --ctstate NEW -j ACCEPT
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -d $_net -m conntrack --ctstate NEW -j ACCEPT
fi
done
if $local_alias_interfaces && $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
if [[ "${_val_arr[2]}" = "tcp" ]]; then
$ip6t -A FORWARD -p tcp -d $_net --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -s $_net --tcp-flag ACK ACK -j ACCEPT
fi
fi
done
echo_done
else
echo_skipped
fi
# ---
# - Separate local networks
# ---

76
ipt-firewall-gateway
View File

@ -1409,6 +1409,11 @@ if $permit_local_net_to_inet ; then
$ipt -A FORWARD -o $_dev -p ALL -m conntrack --ctstate NEW -j ACCEPT
fi
done
if $local_alias_interfaces && $kernel_activate_forwarding ; then
$ipt -A FORWARD -p tcp --tcp-flag ACK ACK -j ACCEPT
fi
echo_done
else
echo_skipped
@ -1948,6 +1953,77 @@ fi
# ---
# - Allow extern service
# ---
echononl "\tAllow extern service"
if [[ ${#allow_to_ext_service_arr[@]} -gt 0 ]] ; then
for _val in "${allow_to_ext_service_arr[@]}" ; do
IFS=':' read -a _val_arr <<< "${_val}"
for _dev in ${ext_if_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
$ipt -A FORWARD -o $_dev -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
fi
done
if $local_alias_interfaces ; then
if [[ "${_val_arr[2]}" = "tcp" ]]; then
$ipt -A FORWARD -p tcp -d ${_val_arr[0]} --dport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
$ipt -A FORWARD -p tcp -s ${_val_arr[0]} --sport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
fi
fi
done
echo_done
else
echo_skipped
fi
# ---
# - Allow extern network
# ---
echononl "\tAllow extern network"
if [[ ${#allow_to_ext_net_arr[@]} -gt 0 ]] ; then
for _net in "${allow_to_ext_net_arr[@]}" ; do
for _dev in ${ext_if_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -d $_net -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
$ipt -A FORWARD -o $_dev -d $_net -m conntrack --ctstate NEW -j ACCEPT
fi
done
if $local_alias_interfaces ; then
$ipt -A FORWARD -p tcp -d $_net --tcp-flag ACK ACK -j ACCEPT
$ipt -A FORWARD -p tcp -s $_net --tcp-flag ACK ACK -j ACCEPT
fi
done
echo_done
else
echo_skipped
fi
# ---
# - Separate local networks
# ---