From 8b8060f0fa26ba1f5ab845cfa80dc65de48a0f07 Mon Sep 17 00:00:00 2001
From: Christoph <ckubu@oopen.de>
Date: Tue, 23 Sep 2025 16:46:05 +0200
Subject: [PATCH] Add Support for IPMI access from outside.

---
 conf/default_basic_behavior.conf |  1 +
 conf/main_ipv4.conf.sample       | 12 +++++++++++
 conf/main_ipv6.conf.sample       | 12 +++++++++++
 ip6t-firewall-gateway            | 34 ++++++++++++++++++++++++++++++++
 ipt-firewall-gateway             | 34 ++++++++++++++++++++++++++++++++
 5 files changed, 93 insertions(+)

diff --git a/conf/default_basic_behavior.conf b/conf/default_basic_behavior.conf
index de580e6..0a6fa4b 100644
--- a/conf/default_basic_behavior.conf
+++ b/conf/default_basic_behavior.conf
@@ -27,6 +27,7 @@ allow_silc_request_out=true
 allow_irc_request_out=true
 allow_mysql_request_out=true
 allow_ipmi_request_out=true
+allow_ipmi_request_in=false
 allow_remote_console_request_out=true
 allow_mumble_request_out=true
 allow_outbound_streaming=true
diff --git a/conf/main_ipv4.conf.sample b/conf/main_ipv4.conf.sample
index 667026b..89a8859 100644
--- a/conf/main_ipv4.conf.sample
+++ b/conf/main_ipv4.conf.sample
@@ -1420,6 +1420,18 @@ ipmi_server_ips=""
 ipmi_udp_ports="161 623"
 ipmi_tcp_ports="80 161 443 623 3520 5120 5123 5900 5901 5985"
 
+# - Allow Access to IPMI Interfaces from outside
+# -
+# - Note:
+# -    In addition, ports
+# -
+# -       TCP :443, 3520, 5900
+# -       UDP: 623
+# -
+# -    must be forwarded to the IP address of the IPMI network interface in the router (e.g., Fritzbox).
+# -
+allow_ipmi_request_in=false
+
 
 # =============
 # - Rsync Out for given src ip-addresses
diff --git a/conf/main_ipv6.conf.sample b/conf/main_ipv6.conf.sample
index be24a3d..1b66447 100644
--- a/conf/main_ipv6.conf.sample
+++ b/conf/main_ipv6.conf.sample
@@ -1394,6 +1394,18 @@ ipmi_server_ips=""
 ipmi_udp_ports="161 623"
 ipmi_tcp_ports="80 161 443 623 3520 5120 5123 5900 5901 5985"
 
+# - Allow Access to IPMI Interfaces from outside
+# -
+# - Note:
+# -    In addition, ports
+# -
+# -       TCP :443, 3520, 5900
+# -       UDP: 623
+# -
+# -    must be forwarded to the IP address of the IPMI network interface in the router (e.g., Fritzbox).
+# -
+allow_ipmi_request_in=false
+
 
 # =============
 # - Rsync Out for given src ip-addresses
diff --git a/ip6t-firewall-gateway b/ip6t-firewall-gateway
index dafa834..56b5175 100755
--- a/ip6t-firewall-gateway
+++ b/ip6t-firewall-gateway
@@ -4928,6 +4928,40 @@ else
 fi
 
 
+# ---
+# - IPMI Tools (e.g. IPMIView) in (from outside)
+# ---
+
+echononl "\t\tIPMI Tools (e.g. IPMIView) in (from outside)"
+
+if $allow_ipmi_request_in ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      for _port in ${ipmi_udp_port_arr[@]} ; do
+         $ip6t -A INPUT -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      for _port in ${ipmi_tcp_port_arr[@]} ; do
+         $ip6t -A INPUT -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      if $kernel_forward_between_interfaces ; then
+
+         for _port in ${ipmi_udp_port_arr[@]} ; do
+            $ip6t -A FORWARD -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         for _port in ${ipmi_tcp_port_arr[@]} ; do
+            $ip6t -A FORWARD -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
 # ---
 # - IPMI Tools (e.g. IPMIView) local Networks
 # ---
diff --git a/ipt-firewall-gateway b/ipt-firewall-gateway
index 7e1d994..cc98a20 100755
--- a/ipt-firewall-gateway
+++ b/ipt-firewall-gateway
@@ -5729,6 +5729,40 @@ else
 fi
 
 
+# ---
+# - IPMI Tools (e.g. IPMIView) in (from outside)
+# ---
+
+echononl "\t\tIPMI Tools (e.g. IPMIView) in (from outside)"
+
+if $allow_ipmi_request_in ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      for _port in ${ipmi_udp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      for _port in ${ipmi_tcp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      if $kernel_activate_forwarding ; then
+         
+         for _port in ${ipmi_udp_port_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         for _port in ${ipmi_tcp_port_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+   done
+
+   echo_done
+else
+   echo_skipped
+fi 
+
+
 # ---
 # - IPMI Tools (e.g. IPMIView) local Networks
 # ---