firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add some extern resources from local network / local interfaces.

Browse Source
This commit is contained in:
Christoph
2019-02-23 18:02:24 +01:00
parent e9f1c30ad2
commit 57ed8ceca5
5 changed files with 435 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

122
ip6t-firewall-gateway
View File

@ -1046,6 +1046,128 @@ fi
# ---
# - Allow extern service from given local interface
# ---
echononl "\tAllow extern service from given local interface"
if [[ ${#allow_local_if_to_ext_service_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces ; then
for _val in "${#allow_local_if_to_ext_service_arr[@]}" ; do
IFS=',' read -a _val_arr <<< "${_val}"
$ip6t -A FORWARD -p ${_val_arr[3]} -i ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
# - Note:
# - If (local) alias interfaces like eth1:0 in use, youe need a further
# - special rule.
# -
if $local_alias_interfaces ; then
if [[ "${_val_arr[3]}" = "tcp" ]]; then
$ip6t -A FORWARD -p tcp -i ${_val_arr[0]} -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -o ${_val_arr[0]} -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
fi
fi
done
echo_ok
else
echo_skipped
fi
# ---
# - Allow extern network from given local interface
# ---
echononl "\tAllow extern network from given local interface"
if [[ ${#allow_local_if_to_ext_net_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces ; then
for _val in ${allow_local_if_to_ext_net_arr[@]} ; do
IFS=',' read -a _val_arr <<< "${_val}"
$ip6t -A FORWARD -p ALL -i ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
# - Note:
# - If (local) alias interfaces like eth1:0 in use, youe need a further
# - special rule.
# -
if $local_alias_interfaces ; then
$ip6t -A FORWARD -p tcp -i ${_val_arr[0]} -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -o ${_val_arr[0]} -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
fi
done
echo_ok
else
echo_skipped
fi
# ---
# - Allow extern service from given local network
# ---
echononl "\tAllow extern service from given local network"
if [[ ${#allow_local_net_to_ext_service_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces ; then
for _val in "${allow_local_net_to_ext_service_arr[@]}" ; do
IFS=',' read -a _val_arr <<< "${_val}"
$ip6t -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
# - Note:
# - If (local) alias interfaces like eth1:0 in use, youe need a further
# - special rule.
# -
if $local_alias_interfaces ; then
if [[ "${_val_arr[3]}" = "tcp" ]]; then
$ip6t -A FORWARD -p ${_val_arr[3]} -d ${_val_arr[1]} --dport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[1]} --sport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
fi
fi
done
echo_done
else
echo_skipped
fi
# ---
# - Allow extern network from given local network
# ---
echononl "\tAllow extern network from given local network"
if [[ ${#allow_local_net_to_ext_net_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces ; then
for _val in ${allow_local_net_to_ext_net_arr[@]} ; do
IFS=',' read -a _val_arr <<< "${_val}"
$ip6t -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
# - Note:
# - If (local) alias interfaces like eth1:0 in use, youe need a further
# - special rule.
# -
if $local_alias_interfaces ; then
$ip6t -A FORWARD -p tcp -d ${_val_arr[1]} -s ${_val_arr[0]} --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -d ${_val_arr[0]} -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
fi
done
echo_ok
else
echo_skipped
fi
# ---
# - Separate local networks
# ---