firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Support dhcp client on gateway on extern interfaces.

Browse Source
This commit is contained in:
Christoph 2017-05-20 02:55:06 +02:00
parent ccf7d7a81d
commit 8ed62f8377
5 changed files with 60 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
conf/main_ipv4.conf.sample
View File

@ -371,6 +371,15 @@ vpn_local_net_ports="1194"
# - DHCP Service
# ======
# - Ist this Gateway DHCP Client?
# -
# - local_dhcp_client_interfaces="<interface1> [<interface> [.."
# -
# - Example:
# - dhcp_client_interfaces="$ext_if_static_1"
# -
dhcp_client_interfaces=""
# - DHCP Server Gateway
# -
local_dhcp_service=true

9
conf/main_ipv6.conf.sample
View File

@ -352,6 +352,15 @@ vpn_local_net_ports="1194"
# - DHCP Service
# ======
# - Ist this Gateway DHCP Client?
# -
# - local_dhcp_client_interfaces="<interface1> [<interface> [.."
# -
# - Example:
# - dhcp_client_interfaces="$ext_if_static_1"
# -
dhcp_client_interfaces="$ext_if_static_1"
# - DHCP Server Gateway
# -
local_dhcp_service=true

8
conf/post_decalrations.conf
View File

@ -207,6 +207,14 @@ for _ip in $log_ips ; do
log_ip_arr+=("$_ip")
done
# ---
# - Network Devices local DHCP Client
# ---
declare -a dhcp_client_interfaces_arr
for _dev in $dhcp_client_interfaces ; do
dhcp_client_interfaces_arr+=("$_dev")
done
# ---
# - IP Addresses DHCP Failover Server
# ---

21
ip6t-firewall-gateway
View File

@ -186,6 +186,7 @@ $ip6t -F -t raw
$ip6t -X
$ip6t -Z
#$ip6t -t nat -A POSTROUTING -o $ext_if_static_1 -j MASQUERADE
$ip6t -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
echo_done # Flushing firewall iptable (IPv6)..
@ -1144,7 +1145,21 @@ echo -e "\t\033[37m\033[1mAdd Rules for Services..\033[m"
# - DHCP
# ---
echononl "\t\tDHCP"
echononl "\t\tLocal DHCP Client"
if [[ ${#dhcp_client_interfaces_arr[@]} -gt 0 ]] ; then
for _dev in ${dhcp_client_interfaces_arr[@]} ; do
$ip6t -A INPUT -i $_dev -p udp -m udp --dport 546 -j ACCEPT
$ip6t -A OUTPUT -o $_dev -p udp -m udp --dport 547 -j ACCEPT
done
echo_done
else
echo_skipped
fi
echononl "\t\tDHCP Service (local network only)"
if $local_dhcp_service ; then
for _dev in ${local_if_arr[@]} ; do
@ -1190,13 +1205,13 @@ echononl "\t\tDNS out only"
for _dev in ${ext_if_arr[@]} ; do
# - out from local and virtual mashine(s)
$ip6t -A OUTPUT -o $_dev -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
#$ip6t -A OUTPUT -o $_dev -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A OUTPUT -o $_dev -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
# - Only useful (needed) if kernel forwarding is activated (kernel_forward_between_interfaces=true)
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
# - forward from virtual mashine(s)
$ip6t -A FORWARD -o $_dev -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
#$ip6t -A FORWARD -o $_dev -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
$ip6t -A FORWARD -o $_dev -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
fi
done

18
ipt-firewall-gateway
View File

@ -1618,6 +1618,20 @@ fi
# - DHCP
# ---
echononl "\t\tLocal DHCP Client"
if [[ ${#dhcp_client_interfaces_arr[@]} -gt 0 ]] ; then
for _dev in ${dhcp_client_interfaces_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -p udp -m udp -d 255.255.255.255 --dport 67 -j ACCEPT
$ip6t -A INPUT -i $_dev -p udp -m udp --dport 68 -j ACCEPT
done
echo_done
else
echo_skipped
fi
echononl "\t\tDHCP"
if $local_dhcp_service ; then
@ -1662,13 +1676,13 @@ echononl "\t\tDNS out only"
for _dev in ${ext_if_arr[@]} ; do
# - out from local and virtual mashine(s)
$ipt -A OUTPUT -o $_dev -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
#$ipt -A OUTPUT -o $_dev -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
$ipt -A OUTPUT -o $_dev -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
# - Only useful (needed) if kernel forwarding is activated (kernel_activate_forwarding=true)
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
# - forward from virtual mashine(s)
$ipt -A FORWARD -o $_dev -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
#$ipt -A FORWARD -o $_dev -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
$ipt -A FORWARD -o $_dev -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
fi
done