- Add 'any_access_from_inet_networks'

- Add 'allow_ext_net_to_local_service'
- Add 'allow_ext_net_to_local_net'
- Add 'block_all_ext_to_local_net'

ipt-firewall-gateway

@@ -1163,7 +1163,8 @@ fi
 
 echononl "\tAllow these local networks any access to the internet"
 if [[ ${#any_access_to_inet_network_arr[@]} -gt 0 ]] \
-      && $kernel_activate_forwarding ; then
+      && $kernel_activate_forwarding \
+      && ! $permit_local_net_to_inet ; then
 
    for _net in ${any_access_to_inet_network_arr[@]}; do
       for _dev in ${ext_if_arr[@]} ; do
@@ -1176,6 +1177,153 @@ else
 fi
 
 
+echononl "\tAllow these local networks any access from the internet"
+if [[ ${#any_access_from_inet_network_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   _found=false
+   for _net in ${any_access_from_inet_network_arr[@]}; do
+      for _dev in ${ext_if_arr[@]} ; do
+
+         # - Traffic recieved on natted interfaces will be ommitted!
+         # -
+         if containsElement "$_dev" "${nat_device_arr[@]}" ; then
+            continue
+         else
+            _found=true
+         fi
+
+         $ipt -A FORWARD -i $_dev -p ALL -d $_net -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+   if $_found ; then
+      echo_done
+   else
+      echo_skipped
+   fi
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Allow local services from given extern networks
+# ---
+
+echononl "\tAllow local services from given extern networks"
+if [[ ${#allow_ext_net_to_local_service_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   _found=false
+   for _val in "${allow_ext_net_to_local_service_arr[@]}" ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      for _dev in ${ext_if_arr[@]} ; do
+
+         # - Traffic recieved on natted interfaces will be ommitted!
+         # -
+         if containsElement "$_dev" "${nat_device_arr[@]}" ; then
+            continue
+         else
+            _found=true
+         fi
+
+         $ipt -A FORWARD -i $_dev -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
+
+      done
+
+   done
+
+   if $_found ; then
+      echo_done
+   else
+      echo_skipped
+   fi
+   
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Allow all traffic from extern address/network to local address/network
+# ---
+
+# - !! Note:
+# -    does NOT depend on settings 'permit_between_local_networks' !!
+# -
+echononl "\tAllow all traffic from extern to local network/address"
+
+if [[ ${#allow_ext_net_to_local_net_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   _found=false
+   for _val in ${allow_ext_net_to_local_net_arr[@]} ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      for _dev in ${ext_if_arr[@]} ; do
+
+         # - Traffic recieved on natted interfaces will be ommitted!
+         # -
+         if containsElement "$_dev" "${nat_device_arr[@]}" ; then
+            continue
+         else
+            _found=true
+         fi
+
+         $ipt -A FORWARD -p ALL -i $_dev -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+
+      done
+   done
+
+   if $_found ; then
+      echo_done
+   else
+      echo_skipped
+   fi
+
+else
+   echo_skipped
+fi
+
+
+
+# ---
+# - Block all extern traffic to (given) local network
+# ---
+
+echononl "\tBlock all extern traffic to (given) local network"
+if [[ ${#block_all_ext_to_local_net_arr[@]} -gt 0 ]] \
+      && $kernel_activate_forwarding ; then
+
+   _found=false
+   for _net in ${block_all_ext_to_local_net_arr[@]} ; do
+      for _dev in ${ext_if_arr[@]} ; do
+
+         # - Traffic recieved on natted interfaces will be ommitted!
+         # -
+         if containsElement "$_dev" "${nat_device_arr[@]}" ; then
+            continue
+         else
+            _found=true
+         fi
+
+         $ipt -A FORWARD -p ALL -i $_dev -d $_net -m conntrack --ctstate NEW -j DROP
+
+      done
+   done
+
+   if $_found ; then
+      echo_done
+   else
+      echo_skipped
+   fi
+
+else
+   echo_skipped
+fi
+
+
 
 # ---
 # - Allow local services from given local networks