diff --git a/conf/default_ports.conf b/conf/default_ports.conf index 7b09c2f..3ac262a 100644 --- a/conf/default_ports.conf +++ b/conf/default_ports.conf @@ -208,6 +208,25 @@ standard_webex_udp_ports="9000" standard_webex_tcp_fall_back_ports="5004" +# - Skype for Business Online und Microsoft Teams +# - +# - see: https://docs.microsoft.com/de-de/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide#skype-for-business-online-and-microsoft-teams +# - +# - TCP 80,443 +# - +# - UDP 3478,3479,3480,3481 --> 13.107.64.0/18, 52.112.0.0/14, 52.120.0.0/14 +# - +standard_ms_skype_teams_tcp_ports="80,443" +standard_ms_skype_teams_udp4_ports="3478,3479,3480,3481" +standard_ms_skype_teams_udp4_hosts=" + 13.107.64.0/18 + 52.112.0.0/14 + 52.120.0.0/14 +" +standard_ms_skype_teams_udp6_ports="" +standard_ms_skype_teams_udp6_hosts="" + + # - Zoom Meeting - Video Conference Service # - # - TCP 80,443 A ll Zoom Clients and *.zoom.us diff --git a/conf/main_ipv4.conf.sample b/conf/main_ipv4.conf.sample index 1cbe68c..f15230a 100644 --- a/conf/main_ipv4.conf.sample +++ b/conf/main_ipv4.conf.sample @@ -920,6 +920,20 @@ bigbluebutton_tcp_ports="$standard_bigbluebutton_tcp_ports" bigbluebutton_udp_ports="$standard_bigbluebutton_udp_port_range" +# ====== +# - Skype for Business Online und Microsoft Teams +# ====== + +# - Skype for Business Online und Microsoft Teams +# - +# - TCP 80,443 +# - +# - UDP 3478,3479,3480,3481 --> 13.107.64.0/18, 52.112.0.0/14, 52.120.0.0/14 +# - +ms_skype_teams_tcp_ports="$standard_ms_skype_teams_tcp_ports" +ms_skype_teams_udp4_ports="$standard_ms_skype_teams_udp6_ports" +ms_skype_teams_udp4_hosts="$standard_ms_skype_teams_udp4_hosts" + # ====== # - Webex Meeting @@ -1550,6 +1564,7 @@ allow_mumble_request_out=true allow_outbound_streaming=true allow_echo360_video_streaming=true allow_bigbluebutton_video_conference_out=true +allow_ms_skype_teams_out=true allow_webex_video_conference_out=true allow_zoom_video_conference_out=true allow_jitsi_video_conference_out=true diff --git a/conf/main_ipv6.conf.sample b/conf/main_ipv6.conf.sample index 422b00f..0554a03 100644 --- a/conf/main_ipv6.conf.sample +++ b/conf/main_ipv6.conf.sample @@ -891,6 +891,18 @@ bigbluebutton_tcp_ports="$standard_bigbluebutton_tcp_ports" bigbluebutton_udp_ports="$standard_bigbluebutton_udp_port_range" +# ====== +# - Skype for Business Online und Microsoft Teams +# ====== + +# - Skype for Business Online und Microsoft Teams +# - +# - TCP 80,443 +# - +ms_skype_teams_tcp_ports="$standard_ms_skype_teams_tcp_ports" +ms_skype_teams_udp6_ports="$standard_ms_skype_teams_udp6_ports" +ms_skype_teams_udp6_hosts="$standard_ms_skype_teams_udp6_hosts" + # ====== # - Webex Meeting @@ -1466,6 +1478,7 @@ allow_outbound_streaming=true allow_echo360_video_streaming=true allow_alfaview_video_conference_out=true allow_bigbluebutton_video_conference_out=true +allow_ms_skype_teams_out=true allow_webex_video_conference_out=true allow_zoom_video_conference_out=true allow_jitsi_video_conference_out=true diff --git a/conf/post_decalrations.conf b/conf/post_decalrations.conf index 0b2226c..b03a8f9 100644 --- a/conf/post_decalrations.conf +++ b/conf/post_decalrations.conf @@ -632,7 +632,7 @@ _tmp_tcp_ports="$bigbluebutton_tcp_ports" bigbluebutton_tcp_ports="" declare -i count=0 IFS=',' ; for _port in $_tmp_tcp_ports ; do - if containsElement "${_port}" "${standard_http_port_arr[@]}" ; then + if $allow_http_request_out && containsElement "${_port}" "${standard_http_port_arr[@]}" ; then continue fi if [[ $count -eq 0 ]]; then @@ -645,6 +645,48 @@ done IFS="$CUR_IFS" +# --- +# - Skype for Business Online und Microsoft Teams +# --- +CUR_IFS="$IFS" +declare -a ms_skype_teams_udp4_host_arr +declare -a ms_skype_teams_udp6_host_arr +declare -a ms_skype_teams_udp4_port_arr +declare -a ms_skype_teams_udp6_port_arr +declare -a ms_skype_teams_tcp_port_arr +if [[ -n "$ms_skype_teams_udp4_hosts" ]]; then + for _host in $ms_skype_teams_udp4_hosts ; do + ms_skype_teams_udp4_host_arr+=("$_host") + done +fi +if [[ -n "$ms_skype_teams_udp6_hosts" ]]; then + for _host in $ms_skype_teams_udp6_hosts ; do + ms_skype_teams_udp6_host_arr+=("$_host") + done +fi +IFS=',' ; for _port in $ms_skype_teams_udp4_ports ; do + if containsElement "${_port}" "${standard_turn_service_port_arr[@]}" ; then + continue + fi + ms_skype_teams_udp_port4_arr+=("$_port") +done +IFS="$CUR_IFS" +IFS=',' ; for _port in $ms_skype_teams_udp6_ports ; do + if containsElement "${_port}" "${standard_turn_service_port_arr[@]}" ; then + continue + fi + ms_skype_teams_udp_port6_arr+=("$_port") +done +IFS="$CUR_IFS" +IFS=',' ; for _port in $ms_skype_teams_tcp_ports ; do + if $allow_http_request_out && containsElement "${_port}" "${standard_http_port_arr[@]}" ; then + continue + fi + ms_skype_teams_tcp_port_arr+=("$_port") +done +IFS="$CUR_IFS" + + # --- # Zoom Meetings - Video Conference - adjust 'zoom_tcp_ports' # --- diff --git a/ip6t-firewall-gateway b/ip6t-firewall-gateway index 2b1ca90..cd85a26 100755 --- a/ip6t-firewall-gateway +++ b/ip6t-firewall-gateway @@ -3120,6 +3120,7 @@ if $allow_outbound_streaming \ || $allow_echo360_video_streaming \ || $allow_bigbluebutton_video_conference_out \ || $allow_webex_video_conference_out \ + || $allow_ms_skype_teams_out \ || $allow_zoom_video_conference_out \ || $allow_jitsi_video_conference_out \ || $allow_alfaview_video_conference_out \ @@ -3206,6 +3207,52 @@ else fi +# --- +# - Skype for Business Online und Microsoft Teams +# --- + +echononl "\t\tSkype for Business Online und Microsoft Teams" + +if $allow_ms_skype_teams_out \ + && ( [[ ${#ms_skype_teams_udp6_host_arr[@]} -gt 0 ]] && [[ ${#ms_skype_teams_udp_port_arr[@]} -gt 0 ]] ) \ + || [[ ${#ms_skype_teams_tcp_port_arr[@]} -gt 0 ]] ; then + + for _dev in ${ext_if_arr[@]} ; do + + if [[ ${#ms_skype_teams_udp6_host_arr[@]} -gt 0 ]] && [[ ${#ms_skype_teams_udp_port_arr[@]} -gt 0 ]] ; then + + for _host in ${ms_skype_teams_udp6_host_arr[@]} ; do + + for _port in ${ms_skype_teams_udp_port_arr[@]} ; do + + $ip6t -A OUTPUT -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT + if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then + $ip6t -A FORWARD -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT + fi + done + + done + fi + + if [[ ${#ms_skype_teams_tcp_port_arr[@]} -gt 0 ]] ; then + + for _port in ${ms_skype_teams_tcp_port_arr[@]} ; do + + $ip6t -A OUTPUT -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT + if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then + $ip6t -A FORWARD -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT + fi + done + + fi + + done # for _dev in ${ext_if_arr[@]} ; do + echo_done +else + echo_skipped +fi + + # --- # - Webex Meeting Video Conference Service out only # --- diff --git a/ipt-firewall-gateway b/ipt-firewall-gateway index 47f75e1..540f47a 100755 --- a/ipt-firewall-gateway +++ b/ipt-firewall-gateway @@ -3873,6 +3873,7 @@ echononl "\t\tTurn/Stun Service" if $allow_outbound_streaming \ || $allow_echo360_video_streaming \ || $allow_bigbluebutton_video_conference_out \ + || $allow_ms_skype_teams_out \ || $allow_webex_video_conference_out \ || $allow_zoom_video_conference_out \ || $allow_jitsi_video_conference_out \ @@ -3959,6 +3960,52 @@ else fi +# --- +# - Skype for Business Online und Microsoft Teams +# --- + +echononl "\t\tSkype for Business Online und Microsoft Teams" + +if $allow_ms_skype_teams_out \ + && ( [[ ${#ms_skype_teams_udp4_host_arr[@]} -gt 0 ]] && [[ ${#ms_skype_teams_udp_port_arr[@]} -gt 0 ]] ) \ + || [[ ${#ms_skype_teams_tcp_port_arr[@]} -gt 0 ]]) ; then + + for _dev in ${ext_if_arr[@]} ; do + + if [[ ${#ms_skype_teams_udp4_host_arr[@]} -gt 0 ]] && [[ ${#ms_skype_teams_udp_port_arr[@]} -gt 0 ]] ; then + + for _host in ${ms_skype_teams_udp4_host_arr[@]} ; do + + for _port in ${ms_skype_teams_udp_port_arr[@]} ; do + + $ipt -A OUTPUT -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT + if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then + $ipt -A FORWARD -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT + fi + done + + done + fi + + if [[ ${#ms_skype_teams_tcp_port_arr[@]} -gt 0 ]] ; then + + for _port in ${ms_skype_teams_tcp_port_arr[@]} ; do + + $ipt -A OUTPUT -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT + if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then + $ipt -A FORWARD -o $_dev -p udp -d $_host -dport $_port -m conntrack --ctstate NEW -j ACCEPT + fi + done + + fi + + done # for _dev in ${ext_if_arr[@]} ; do + echo_done +else + echo_skipped +fi + + # --- # - Webex Meeting Video Conference Service out only # ---