firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add support for 'Skype for Business Online' and 'Microsoft Teams'.

Browse Source
This commit is contained in:
Christoph 2022-02-02 21:24:53 +01:00
parent 0f2676eea6
commit 577eaa27c4
6 changed files with 184 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
conf/default_ports.conf
View File

@ -208,6 +208,25 @@ standard_webex_udp_ports="9000"
standard_webex_tcp_fall_back_ports="5004"
# - Skype for Business Online und Microsoft Teams
# -
# - see: https://docs.microsoft.com/de-de/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide#skype-for-business-online-and-microsoft-teams
# -
# - TCP 80,443
# -
# - UDP 3478,3479,3480,3481 --> 13.107.64.0/18, 52.112.0.0/14, 52.120.0.0/14
# -
standard_ms_skype_teams_tcp_ports="80,443"
standard_ms_skype_teams_udp4_ports="3478,3479,3480,3481"
standard_ms_skype_teams_udp4_hosts="
13.107.64.0/18
52.112.0.0/14
52.120.0.0/14
"
standard_ms_skype_teams_udp6_ports=""
standard_ms_skype_teams_udp6_hosts=""
# - Zoom Meeting - Video Conference Service
# -
# - TCP 80,443 A ll Zoom Clients and *.zoom.us

15
conf/main_ipv4.conf.sample
View File

@ -920,6 +920,20 @@ bigbluebutton_tcp_ports="$standard_bigbluebutton_tcp_ports"
bigbluebutton_udp_ports="$standard_bigbluebutton_udp_port_range"
# ======
# - Skype for Business Online und Microsoft Teams
# ======
# - Skype for Business Online und Microsoft Teams
# -
# - TCP 80,443
# -
# - UDP 3478,3479,3480,3481 --> 13.107.64.0/18, 52.112.0.0/14, 52.120.0.0/14
# -
ms_skype_teams_tcp_ports="$standard_ms_skype_teams_tcp_ports"
ms_skype_teams_udp4_ports="$standard_ms_skype_teams_udp6_ports"
ms_skype_teams_udp4_hosts="$standard_ms_skype_teams_udp4_hosts"
# ======
# - Webex Meeting
@ -1550,6 +1564,7 @@ allow_mumble_request_out=true
allow_outbound_streaming=true
allow_echo360_video_streaming=true
allow_bigbluebutton_video_conference_out=true
allow_ms_skype_teams_out=true
allow_webex_video_conference_out=true
allow_zoom_video_conference_out=true
allow_jitsi_video_conference_out=true

13
conf/main_ipv6.conf.sample
View File

@ -891,6 +891,18 @@ bigbluebutton_tcp_ports="$standard_bigbluebutton_tcp_ports"
bigbluebutton_udp_ports="$standard_bigbluebutton_udp_port_range"
# ======
# - Skype for Business Online und Microsoft Teams
# ======
# - Skype for Business Online und Microsoft Teams
# -
# - TCP 80,443
# -
ms_skype_teams_tcp_ports="$standard_ms_skype_teams_tcp_ports"
ms_skype_teams_udp6_ports="$standard_ms_skype_teams_udp6_ports"
ms_skype_teams_udp6_hosts="$standard_ms_skype_teams_udp6_hosts"
# ======
# - Webex Meeting
@ -1466,6 +1478,7 @@ allow_outbound_streaming=true
allow_echo360_video_streaming=true
allow_alfaview_video_conference_out=true
allow_bigbluebutton_video_conference_out=true
allow_ms_skype_teams_out=true
allow_webex_video_conference_out=true
allow_zoom_video_conference_out=true
allow_jitsi_video_conference_out=true

44
conf/post_decalrations.conf
View File

@ -632,7 +632,7 @@ _tmp_tcp_ports="$bigbluebutton_tcp_ports"
bigbluebutton_tcp_ports=""
declare -i count=0
IFS=',' ; for _port in $_tmp_tcp_ports ; do
if containsElement "${_port}" "${standard_http_port_arr[@]}" ; then
if $allow_http_request_out && containsElement "${_port}" "${standard_http_port_arr[@]}" ; then
continue
fi
if [[ $count -eq 0 ]]; then
@ -645,6 +645,48 @@ done
IFS="$CUR_IFS"
# ---
# - Skype for Business Online und Microsoft Teams
# ---
CUR_IFS="$IFS"
declare -a ms_skype_teams_udp4_host_arr
declare -a ms_skype_teams_udp6_host_arr
declare -a ms_skype_teams_udp4_port_arr
declare -a ms_skype_teams_udp6_port_arr
declare -a ms_skype_teams_tcp_port_arr
if [[ -n "$ms_skype_teams_udp4_hosts" ]]; then
for _host in $ms_skype_teams_udp4_hosts ; do
ms_skype_teams_udp4_host_arr+=("$_host")
done
fi
if [[ -n "$ms_skype_teams_udp6_hosts" ]]; then
for _host in $ms_skype_teams_udp6_hosts ; do
ms_skype_teams_udp6_host_arr+=("$_host")
done
fi
IFS=',' ; for _port in $ms_skype_teams_udp4_ports ; do
if containsElement "${_port}" "${standard_turn_service_port_arr[@]}" ; then
continue
fi
ms_skype_teams_udp_port4_arr+=("$_port")
done
IFS="$CUR_IFS"
IFS=',' ; for _port in $ms_skype_teams_udp6_ports ; do
if containsElement "${_port}" "${standard_turn_service_port_arr[@]}" ; then
continue
fi
ms_skype_teams_udp_port6_arr+=("$_port")
done
IFS="$CUR_IFS"
IFS=',' ; for _port in $ms_skype_teams_tcp_ports ; do
if $allow_http_request_out && containsElement "${_port}" "${standard_http_port_arr[@]}" ; then
continue
fi
ms_skype_teams_tcp_port_arr+=("$_port")
done
IFS="$CUR_IFS"
# ---
# Zoom Meetings - Video Conference - adjust 'zoom_tcp_ports'
# ---

47
ip6t-firewall-gateway
View File

@ -3120,6 +3120,7 @@ if $allow_outbound_streaming \
|| $allow_echo360_video_streaming \
|| $allow_bigbluebutton_video_conference_out \
|| $allow_webex_video_conference_out \
|| $allow_ms_skype_teams_out \
|| $allow_zoom_video_conference_out \
|| $allow_jitsi_video_conference_out \
|| $allow_alfaview_video_conference_out \
@ -3206,6 +3207,52 @@ else
fi
# ---
# - Skype for Business Online und Microsoft Teams
# ---
echononl "\t\tSkype for Business Online und Microsoft Teams"
if $allow_ms_skype_teams_out \
&& ( [[ ${#ms_skype_teams_udp6_host_arr[@]} -gt 0 ]] && [[ ${#ms_skype_teams_udp_port_arr[@]} -gt 0 ]] ) \
|| [[ ${#ms_skype_teams_tcp_port_arr[@]} -gt 0 ]] ; then
for _dev in ${ext_if_arr[@]} ; do
if [[ ${#ms_skype_teams_udp6_host_arr[@]} -gt 0 ]] && [[ ${#ms_skype_teams_udp_port_arr[@]} -gt 0 ]] ; then
for _host in ${ms_skype_teams_udp6_host_arr[@]} ; do
for _port in ${ms_skype_teams_udp_port_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT
fi
done
done
fi
if [[ ${#ms_skype_teams_tcp_port_arr[@]} -gt 0 ]] ; then
for _port in ${ms_skype_teams_tcp_port_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT
fi
done
fi
done # for _dev in ${ext_if_arr[@]} ; do
echo_done
else
echo_skipped
fi
# ---
# - Webex Meeting Video Conference Service out only
# ---

47
ipt-firewall-gateway
View File

@ -3873,6 +3873,7 @@ echononl "\t\tTurn/Stun Service"
if $allow_outbound_streaming \
|| $allow_echo360_video_streaming \
|| $allow_bigbluebutton_video_conference_out \
|| $allow_ms_skype_teams_out \
|| $allow_webex_video_conference_out \
|| $allow_zoom_video_conference_out \
|| $allow_jitsi_video_conference_out \
@ -3959,6 +3960,52 @@ else
fi
# ---
# - Skype for Business Online und Microsoft Teams
# ---
echononl "\t\tSkype for Business Online und Microsoft Teams"
if $allow_ms_skype_teams_out \
&& ( [[ ${#ms_skype_teams_udp4_host_arr[@]} -gt 0 ]] && [[ ${#ms_skype_teams_udp_port_arr[@]} -gt 0 ]] ) \
|| [[ ${#ms_skype_teams_tcp_port_arr[@]} -gt 0 ]]) ; then
for _dev in ${ext_if_arr[@]} ; do
if [[ ${#ms_skype_teams_udp4_host_arr[@]} -gt 0 ]] && [[ ${#ms_skype_teams_udp_port_arr[@]} -gt 0 ]] ; then
for _host in ${ms_skype_teams_udp4_host_arr[@]} ; do
for _port in ${ms_skype_teams_udp_port_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
$ipt -A FORWARD -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT
fi
done
done
fi
if [[ ${#ms_skype_teams_tcp_port_arr[@]} -gt 0 ]] ; then
for _port in ${ms_skype_teams_tcp_port_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
$ipt -A FORWARD -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT
fi
done
fi
done # for _dev in ${ext_if_arr[@]} ; do
echo_done
else
echo_skipped
fi
# ---
# - Webex Meeting Video Conference Service out only
# ---