Add Support for IPMI access from outside.

conf/default_basic_behavior.conf

@@ -27,6 +27,7 @@ allow_silc_request_out=true
 allow_irc_request_out=true
 allow_mysql_request_out=true
 allow_ipmi_request_out=true
+allow_ipmi_request_in=false
 allow_remote_console_request_out=true
 allow_mumble_request_out=true
 allow_outbound_streaming=true

conf/main_ipv4.conf.sample

@@ -1420,6 +1420,18 @@ ipmi_server_ips=""
 ipmi_udp_ports="161 623"
 ipmi_tcp_ports="80 161 443 623 3520 5120 5123 5900 5901 5985"
 
+# - Allow Access to IPMI Interfaces from outside
+# -
+# - Note:
+# -    In addition, ports
+# -
+# -       TCP :443, 3520, 5900
+# -       UDP: 623
+# -
+# -    must be forwarded to the IP address of the IPMI network interface in the router (e.g., Fritzbox).
+# -
+allow_ipmi_request_in=false
+
 
 # =============
 # - Rsync Out for given src ip-addresses

conf/main_ipv6.conf.sample

@@ -1394,6 +1394,18 @@ ipmi_server_ips=""
 ipmi_udp_ports="161 623"
 ipmi_tcp_ports="80 161 443 623 3520 5120 5123 5900 5901 5985"
 
+# - Allow Access to IPMI Interfaces from outside
+# -
+# - Note:
+# -    In addition, ports
+# -
+# -       TCP :443, 3520, 5900
+# -       UDP: 623
+# -
+# -    must be forwarded to the IP address of the IPMI network interface in the router (e.g., Fritzbox).
+# -
+allow_ipmi_request_in=false
+
 
 # =============
 # - Rsync Out for given src ip-addresses

ip6t-firewall-gateway

@@ -4928,6 +4928,40 @@ else
 fi
 
 
+# ---
+# - IPMI Tools (e.g. IPMIView) in (from outside)
+# ---
+
+echononl "\t\tIPMI Tools (e.g. IPMIView) in (from outside)"
+
+if $allow_ipmi_request_in ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      for _port in ${ipmi_udp_port_arr[@]} ; do
+         $ip6t -A INPUT -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      for _port in ${ipmi_tcp_port_arr[@]} ; do
+         $ip6t -A INPUT -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      if $kernel_forward_between_interfaces ; then
+
+         for _port in ${ipmi_udp_port_arr[@]} ; do
+            $ip6t -A FORWARD -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         for _port in ${ipmi_tcp_port_arr[@]} ; do
+            $ip6t -A FORWARD -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
 # ---
 # - IPMI Tools (e.g. IPMIView) local Networks
 # ---

ipt-firewall-gateway

@@ -5729,6 +5729,40 @@ else
 fi
 
 
+# ---
+# - IPMI Tools (e.g. IPMIView) in (from outside)
+# ---
+
+echononl "\t\tIPMI Tools (e.g. IPMIView) in (from outside)"
+
+if $allow_ipmi_request_in ; then
+   for _dev in ${ext_if_arr[@]} ; do
+      for _port in ${ipmi_udp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      for _port in ${ipmi_tcp_port_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+
+      if $kernel_activate_forwarding ; then
+         
+         for _port in ${ipmi_udp_port_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+         for _port in ${ipmi_tcp_port_arr[@]} ; do
+            $ipt -A FORWARD -i $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         done
+      fi
+
+   done
+
+   echo_done
+else
+   echo_skipped
+fi 
+
+
 # ---
 # - IPMI Tools (e.g. IPMIView) local Networks
 # ---