Add support for restricted VPN networks.

ipt-firewall-gateway

@@ -1486,6 +1486,155 @@ fi
 echo_done
 
 
+echo ""
+
+unset restricted_vpn_network_arr
+unset restricted_vpn_target_network_arr
+declare -a restricted_vpn_network_arr
+declare -a restricted_vpn_target_network_arr
+
+
+# ---
+# - Restrict VPN Network to local Service
+# ---
+
+echononl "\tRestrict VPN Network to local Service"
+if [[ ${#restrict_vpn_net_to_local_service_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   for _val in "${restrict_vpn_net_to_local_service_arr[@]}" ; do
+
+      IFS=':' read -a _val_arr <<< "${_val}"
+
+      if ! containsElement "${_val_arr[0]}" "${restricted_vpn_network_arr[@]}" ; then
+         restricted_vpn_network_arr+=("${_val_arr[0]}")
+      fi
+
+      if ! containsElement "${_val_arr[1]}" "${restricted_vpn_target_network_arr[@]}" ; then
+         restricted_vpn_target_network_arr+=("${_val_arr[1]}")
+      fi
+
+      if containsElement "${_val_arr[1]}" "${gateway_ipv4_address_arr[@]}" ; then
+
+         $ipt -A INPUT -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
+
+         # Allow also ICMP (ping)
+         $ipt -A INPUT -p icmp -s ${_val_arr[0]} -d ${_val_arr[1]} -j ACCEPT
+$ipt -A INPUT -s $_net
+      else
+
+         $ipt -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
+
+         # Allow also ICMP (ping) to these target networks/hosts
+         $ipt -A FORWARD -p icmp -s ${_val_arr[0]} -d ${_val_arr[1]} -j ACCEPT
+
+      fi
+
+      # - Note:
+      # - If (local) alias interfaces like eth1:0 in use, youe need a further
+      # - special rule.
+      # -
+      if $local_alias_interfaces ; then
+         if [[ "${_val_arr[3]}" = "tcp" ]]; then
+            $ipt -A FORWARD -p tcp -d ${_val_arr[1]} --dport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
+            $ipt -A FORWARD -p tcp -s ${_val_arr[1]} --sport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
+         fi
+      fi
+
+   done
+
+   echo_done
+   
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Restrict VPN Network to local (Sub) network
+# ---
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+echononl "\tRestrict VPN Network to local (Sub) network"
+
+if [[ ${#restrict_vpn_net_to_local_subnet_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   for _val in ${restrict_vpn_net_to_local_subnet_arr[@]} ; do
+
+      IFS=':' read -a _val_arr <<< "${_val}"
+
+      if ! containsElement "${_val_arr[0]}" "${restricted_vpn_network_arr[@]}" ; then
+         restricted_vpn_network_arr+=("${_val_arr[0]}")
+      fi
+
+      if ! containsElement "${_val_arr[1]}" "${restricted_vpn_target_network_arr[@]}" ; then
+         restricted_vpn_target_network_arr+=("${_val_arr[1]}")
+      fi
+
+      $ipt -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+      #$ipt -A FORWARD -p icmp -s ${_val_arr[0]} -d ${_val_arr[1]} -j ACCEPT
+
+   done
+
+   echo_done
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Allow local DNS Service for restricted VPN Networks
+# ---
+
+echononl "\tAllow local DNS Service for restricted VPN Networks"
+if [[ ${#restricted_vpn_network_arr[@]} -gt 0 ]] ; then
+
+   for _net in "${restricted_vpn_network_arr[@]}" ; do
+
+
+      for _ip in "${gateway_ipv4_address_arr[@]}" ; do
+
+         $ipt -A INPUT -p udp -s $_net -d $_ip --dport 53 -m conntrack --ctstate NEW -j ACCEPT   
+
+         $ipt -A INPUT -p icmp -s $_net -d $_ip -j ACCEPT
+         
+      done 
+
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Block further traffic from Restrict VPN Networks
+# ---
+
+echononl "\tBlock further traffic from Restrict VPN Networks"
+if [[ ${#restricted_vpn_network_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   for _net in ${restricted_vpn_network_arr[@]} ; do
+
+      #$ipt -A INPUT -p ALL -s $_net -m conntrack --ctstate NEW -j DROP
+      #$ipt -A FORWARD -p ALL -s $_net -m conntrack --ctstate NEW -j DROP
+      $ipt -A INPUT -p ALL -s $_net -j DROP
+      $ipt -A FORWARD -p ALL -s $_net -j DROP
+
+   done
+
+   echo_done
+
+else
+   echo_skipped
+fi
+
 echo ""