firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add Support for IPMI access from outside.

Browse Source
This commit is contained in:
Christoph
2025-09-23 16:46:05 +02:00
parent b547d5dc0e
commit 8b8060f0fa
5 changed files with 93 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
conf/default_basic_behavior.conf
View File

@@ -27,6 +27,7 @@ allow_silc_request_out=true
allow_irc_request_out=true
allow_mysql_request_out=true
allow_ipmi_request_out=true
allow_ipmi_request_in=false
allow_remote_console_request_out=true
allow_mumble_request_out=true
allow_outbound_streaming=true

12
conf/main_ipv4.conf.sample
View File

@@ -1420,6 +1420,18 @@ ipmi_server_ips=""
ipmi_udp_ports="161 623"
ipmi_tcp_ports="80 161 443 623 3520 5120 5123 5900 5901 5985"
# - Allow Access to IPMI Interfaces from outside
# -
# - Note:
# - In addition, ports
# -
# - TCP :443, 3520, 5900
# - UDP: 623
# -
# - must be forwarded to the IP address of the IPMI network interface in the router (e.g., Fritzbox).
# -
allow_ipmi_request_in=false
# =============
# - Rsync Out for given src ip-addresses

12
conf/main_ipv6.conf.sample
View File

@@ -1394,6 +1394,18 @@ ipmi_server_ips=""
ipmi_udp_ports="161 623"
ipmi_tcp_ports="80 161 443 623 3520 5120 5123 5900 5901 5985"
# - Allow Access to IPMI Interfaces from outside
# -
# - Note:
# - In addition, ports
# -
# - TCP :443, 3520, 5900
# - UDP: 623
# -
# - must be forwarded to the IP address of the IPMI network interface in the router (e.g., Fritzbox).
# -
allow_ipmi_request_in=false
# =============
# - Rsync Out for given src ip-addresses

34
ip6t-firewall-gateway
View File

@@ -4928,6 +4928,40 @@ else
fi
# ---
# - IPMI Tools (e.g. IPMIView) in (from outside)
# ---
echononl "\t\tIPMI Tools (e.g. IPMIView) in (from outside)"
if $allow_ipmi_request_in ; then
for _dev in ${ext_if_arr[@]} ; do
for _port in ${ipmi_udp_port_arr[@]} ; do
$ip6t -A INPUT -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
for _port in ${ipmi_tcp_port_arr[@]} ; do
$ip6t -A INPUT -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
if $kernel_forward_between_interfaces ; then
for _port in ${ipmi_udp_port_arr[@]} ; do
$ip6t -A FORWARD -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
for _port in ${ipmi_tcp_port_arr[@]} ; do
$ip6t -A FORWARD -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
fi
done
echo_done
else
echo_skipped
fi
# ---
# - IPMI Tools (e.g. IPMIView) local Networks
# ---

34
ipt-firewall-gateway
View File

@@ -5729,6 +5729,40 @@ else
fi
# ---
# - IPMI Tools (e.g. IPMIView) in (from outside)
# ---
echononl "\t\tIPMI Tools (e.g. IPMIView) in (from outside)"
if $allow_ipmi_request_in ; then
for _dev in ${ext_if_arr[@]} ; do
for _port in ${ipmi_udp_port_arr[@]} ; do
$ipt -A INPUT -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
for _port in ${ipmi_tcp_port_arr[@]} ; do
$ipt -A INPUT -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
if $kernel_activate_forwarding ; then
for _port in ${ipmi_udp_port_arr[@]} ; do
$ipt -A FORWARD -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
for _port in ${ipmi_tcp_port_arr[@]} ; do
$ipt -A FORWARD -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
done
fi
done
echo_done
else
echo_skipped
fi
# ---
# - IPMI Tools (e.g. IPMIView) local Networks
# ---