firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add support for 'Webex Meeting'.

Browse Source
This commit is contained in:
Christoph
2021-03-18 20:32:18 +01:00
parent 5918f50bdb
commit b005fff18f
5 changed files with 148 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
ip6t-firewall-gateway
View File

@ -352,7 +352,7 @@ if $block_upnp_traffic_in ; then
fi
$ip6t -A INPUT -i $_dev -p udp --dport 1900 -j DROP
if $kernel_activate_forwarding ; then
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -i $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
fi
$ip6t -A FORWARD -i $_dev -p udp --dport 1900 -j DROP
@ -371,7 +371,7 @@ if $block_upnp_traffic_out ; then
fi
$ip6t -A OUTPUT -o $_dev -p udp --dport 1900 -j DROP
if $kernel_activate_forwarding ; then
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -o $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
fi
$ip6t -A FORWARD -o $_dev -p udp --dport 1900 -j DROP
@ -928,7 +928,7 @@ if [[ ${#allow_all_ext_traffic_to_local_service_arr[@]} -gt 0 ]] \
continue
fi
if $kernel_activate_forwarding ; then
if $kernel_forward_between_interfaces ; then
# - Nat if interface is on a dsl line
# -
@ -943,7 +943,7 @@ if [[ ${#allow_all_ext_traffic_to_local_service_arr[@]} -gt 0 ]] \
# - Rule is needed if (local) interface aliases in use (like eth0:1)
# -
if $kernel_activate_forwarding && $local_alias_interfaces ; then
if $kernel_forward_between_interfaces && $local_alias_interfaces ; then
$ip6t -A FORWARD -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p ${_val_arr[2]} -s ${_val_arr[0]} --sport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
fi
@ -2996,7 +2996,7 @@ if $allow_bigbluebutton_video_conference_out ; then
if [[ "$bigbluebutton_tcp_ports" != "$standard_http_ports" ]] ; then
$ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $bigbluebutton_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $bigbluebutton_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
fi
fi
@ -3014,6 +3014,43 @@ else
fi
# ---
# - Webex Meeting Video Conference Service out only
# ---
echononl "\t\tWebex Meeting Video Conference Service out only"
if $allow_webex_video_conference_out ; then
for _dev in ${ext_if_arr[@]} ; do
if [[ "$webex_tcp_ports" != "$standard_http_ports" ]] ; then
$ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $webex_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $webex_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
fi
fi
if [[ -n "$webex_tcp_fall_back_ports" ]] ; then
$ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $webex_tcp_fall_back_ports -m conntrack --ctstate NEW -j ACCEPT
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $webex_tcp_fall_back_ports -m conntrack --ctstate NEW -j ACCEPT
fi
fi
$ip6t -A OUTPUT -o $_dev -p udp -m multiport --dports $webex_udp_ports -m conntrack --ctstate NEW -j ACCEPT
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p udp -m multiport --dports $webex_udp_ports -m conntrack --ctstate NEW -j ACCEPT
fi
done
echo_done
else
echo_skipped
fi
# ---
# - Jitsi Video Conference Service out only
# ---
@ -3025,7 +3062,7 @@ if $allow_jitsi_video_conference_out ; then
if [[ "$jitsi_tcp_ports" != "$standard_http_ports" ]] ; then
$ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $jitsi_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $jitsi_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
fi
fi
@ -3056,18 +3093,18 @@ if $allow_alfaview_video_conference_out && ! $permit_local_net_to_inet ; then
#
if ! $allow_http_request_out ; then
$ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding ; then
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT
fi
fi
$ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $alfaview_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding ; then
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $alfaview_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
fi
$ip6t -A OUTPUT -o $_dev -p udp -m multiport --dports $alfaview_udp_ports -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding ; then
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
$ip6t -A FORWARD -o $_dev -p udp -m multiport --dports $alfaview_udp_ports -m conntrack --ctstate NEW -j ACCEPT
fi