Add support for 'Webex Meeting'.

conf/default_ports.conf

@@ -65,6 +65,23 @@ standard_mailuser_ports="587,465,110,995,143,993"
 standard_bigbluebutton_tcp_ports="$standard_http_ports"
 standard_bigbluebutton_udp_port_range="16384:32768"
 
+# - Webex Meeting
+# -
+# - TCP 80/443:   Outbound Client Zugriffsport und Webes Events (Audiostreaming)
+# -
+# - UDP 9000:     Outbound (VoIP and RTP)
+# -
+# - ---
+# -
+# - TCP 5004:     Fall-back ports for media connectivity when UDP port 9000
+# -               is not open in the firewall
+# -
+standard_webex_tcp_ports="$standard_http_ports"
+standard_webex_udp_ports="9000"
+
+standard_webex_tcp_fall_back_ports="5004"
+
+
 # - Jitsi Video Conference Service
 # -
 standard_jitsi_tcp_ports="$standard_http_ports"

conf/main_ipv4.conf.sample

@@ -890,6 +890,28 @@ bigbluebutton_tcp_ports="$standard_bigbluebutton_tcp_ports"
 bigbluebutton_udp_ports="$standard_bigbluebutton_udp_port_range"
 
 
+
+# ======
+# - Webex Meeting
+# ======
+
+# - Webex Meeting (Videokonferenz)
+# -
+# - TCP 80/443:   Outbound Client Zugriffsport und Webes Events (Audiostreaming)
+# -
+# - UDP 9000:     Outbound (VoIP and RTP)
+# -
+# - ---
+# -
+# - TCP 5004:     Fall-back ports for media connectivity when UDP port 9000
+# -               is not open in the firewall
+# -
+webex_tcp_ports="$standard_webex_tcp_ports"
+webex_udp_ports="$standard_webex_udp_ports"
+
+webex_tcp_fall_back_ports="$standard_webex_tcp_fall_back_ports"
+
+
 # ======
 # - Jitsi Video Conference Service
 # ======
@@ -1409,6 +1431,7 @@ allow_ipmi_request_out=true
 allow_remote_console_request_out=true
 allow_mumble_request_out=true
 allow_bigbluebutton_video_conference_out=true
+allow_webex_video_conference_out=true
 allow_jitsi_video_conference_out=true
 allow_alfaview_video_conference_out=true
 allow_nc_talk_out=true

conf/main_ipv6.conf.sample

@@ -861,6 +861,28 @@ bigbluebutton_tcp_ports="$standard_bigbluebutton_tcp_ports"
 bigbluebutton_udp_ports="$standard_bigbluebutton_udp_port_range"
 
 
+
+# ======
+# - Webex Meeting
+# ======
+
+# - Webex Meeting (Videokonferenz)
+# -
+# - TCP 80/443:   Outbound Client Zugriffsport und Webes Events (Audiostreaming)
+# -
+# - UDP 9000:     Outbound (VoIP and RTP)
+# -
+# - ---
+# -
+# - TCP 5004:     Fall-back ports for media connectivity when UDP port 9000
+# -               is not open in the firewall
+# -
+webex_tcp_ports="$standard_webex_tcp_ports"
+webex_udp_ports="$standard_webex_udp_ports"
+
+webex_tcp_fall_back_ports="$standard_webex_tcp_fall_back_ports"
+
+
 # ======
 # - Jitsi Video Conference Service
 # ======
@@ -1354,6 +1376,7 @@ allow_ipmi_request_out=true
 allow_remote_console_request_out=true
 allow_mumble_request_out=true
 allow_bigbluebutton_video_conference_out=true
+allow_webex_video_conference_out=true
 allow_jitsi_video_conference_out=true
 allow_nc_talk_out=true
 

ip6t-firewall-gateway

@@ -352,7 +352,7 @@ if $block_upnp_traffic_in ; then
       fi
       $ip6t -A INPUT -i $_dev -p udp --dport 1900 -j DROP
 
-      if $kernel_activate_forwarding ; then
+      if $kernel_forward_between_interfaces ; then
          $ip6t -A FORWARD -i $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
       fi
       $ip6t -A FORWARD -i $_dev -p udp --dport 1900 -j DROP
@@ -371,7 +371,7 @@ if $block_upnp_traffic_out ; then
       fi
       $ip6t -A OUTPUT -o $_dev -p udp --dport 1900 -j DROP
 
-      if $kernel_activate_forwarding ; then
+      if $kernel_forward_between_interfaces ; then
          $ip6t -A FORWARD -o $_dev -p udp --dport 1900 -j $LOG_TARGET $tag_log_prefix "$log_prefix Block UPnP in ${_if}: "
       fi
       $ip6t -A FORWARD -o $_dev -p udp --dport 1900 -j DROP
@@ -928,7 +928,7 @@ if [[ ${#allow_all_ext_traffic_to_local_service_arr[@]} -gt 0 ]] \
             continue
          fi
 
-         if $kernel_activate_forwarding ; then
+         if $kernel_forward_between_interfaces ; then
 
             # - Nat if interface is on a dsl line
             # -
@@ -943,7 +943,7 @@ if [[ ${#allow_all_ext_traffic_to_local_service_arr[@]} -gt 0 ]] \
 
       # - Rule is needed if (local) interface aliases in use (like eth0:1)
       # -
-      if $kernel_activate_forwarding && $local_alias_interfaces ; then
+      if $kernel_forward_between_interfaces && $local_alias_interfaces ; then
          $ip6t -A FORWARD -p ${_val_arr[2]} -d ${_val_arr[0]} --dport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
          $ip6t -A FORWARD -p ${_val_arr[2]} -s ${_val_arr[0]} --sport ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
       fi
@@ -2996,7 +2996,7 @@ if $allow_bigbluebutton_video_conference_out ; then
 
       if [[ "$bigbluebutton_tcp_ports" != "$standard_http_ports" ]] ; then
          $ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $bigbluebutton_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
-         if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
             $ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $bigbluebutton_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
          fi
       fi
@@ -3014,6 +3014,43 @@ else
 fi
 
 
+# ---
+# - Webex Meeting Video Conference Service out only
+# ---
+
+echononl "\t\tWebex Meeting Video Conference Service out only"
+
+if $allow_webex_video_conference_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+
+      if [[ "$webex_tcp_ports" != "$standard_http_ports" ]] ; then
+         $ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $webex_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
+         if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
+            $ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $webex_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
+         fi
+      fi
+
+      if [[ -n "$webex_tcp_fall_back_ports" ]] ; then
+         $ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $webex_tcp_fall_back_ports -m conntrack --ctstate NEW -j ACCEPT
+         if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
+            $ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $webex_tcp_fall_back_ports -m conntrack --ctstate NEW -j ACCEPT
+         fi
+      fi
+
+      $ip6t -A OUTPUT -o $_dev -p udp -m multiport --dports $webex_udp_ports -m conntrack --ctstate NEW -j ACCEPT
+
+      if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
+         $ip6t -A FORWARD -o $_dev -p udp -m multiport --dports $webex_udp_ports -m conntrack --ctstate NEW -j ACCEPT
+      fi
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+
 # ---
 # - Jitsi Video Conference Service out only
 # ---
@@ -3025,7 +3062,7 @@ if $allow_jitsi_video_conference_out ; then
 
       if [[ "$jitsi_tcp_ports" != "$standard_http_ports" ]] ; then
          $ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $jitsi_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
-         if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
             $ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $jitsi_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
          fi
       fi
@@ -3056,18 +3093,18 @@ if $allow_alfaview_video_conference_out && ! $permit_local_net_to_inet ; then
       # 
       if ! $allow_http_request_out ; then
          $ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT
-         if $kernel_activate_forwarding ; then
+         if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
             $ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT
          fi
       fi
 
       $ip6t -A OUTPUT -o $_dev -p tcp -m multiport --dports $alfaview_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
-      if $kernel_activate_forwarding ; then
+      if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
          $ip6t -A FORWARD -o $_dev -p tcp -m multiport --dports $alfaview_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
       fi
 
       $ip6t -A OUTPUT -o $_dev -p udp -m multiport --dports $alfaview_udp_ports -m conntrack --ctstate NEW -j ACCEPT
-      if $kernel_activate_forwarding ; then
+      if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
          $ip6t -A FORWARD -o $_dev -p udp -m multiport --dports $alfaview_udp_ports -m conntrack --ctstate NEW -j ACCEPT
       fi
 

ipt-firewall-gateway

@@ -3723,6 +3723,42 @@ else
 fi
 
 
+# ---
+# - Webex Meeting Video Conference Service out only
+# ---
+
+echononl "\t\tWebex Meeting Video Conference Service out only"
+
+if $allow_webex_video_conference_out ; then
+   for _dev in ${ext_if_arr[@]} ; do
+
+      if [[ "$webex_tcp_ports" != "$standard_http_ports" ]] ; then
+         $ipt -A OUTPUT -o $_dev -p tcp -m multiport --dports $webex_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
+         if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+            $ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $webex_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
+         fi
+      fi
+
+      if [[ -n "$webex_tcp_fall_back_ports" ]] ; then
+         $ipt -A OUTPUT -o $_dev -p tcp -m multiport --dports $webex_tcp_fall_back_ports -m conntrack --ctstate NEW -j ACCEPT
+         if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+            $ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $webex_tcp_fall_back_ports -m conntrack --ctstate NEW -j ACCEPT
+         fi
+      fi
+
+      $ipt -A OUTPUT -o $_dev -p udp -m multiport --dports $webex_udp_ports -m conntrack --ctstate NEW -j ACCEPT
+
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+         $ipt -A FORWARD -o $_dev -p udp -m multiport --dports $webex_udp_ports -m conntrack --ctstate NEW -j ACCEPT
+      fi
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
 # ---
 # - Jitsi Video Conference Service out only
 # ---
@@ -3765,18 +3801,18 @@ if $allow_alfaview_video_conference_out && ! $permit_local_net_to_inet ; then
       # 
       if ! $allow_http_request_out ; then
          $ipt -A OUTPUT -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT
-         if $kernel_activate_forwarding ; then
+         if $kernel_activate_forwarding  && ! $permit_local_net_to_inet; then
             $ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT
          fi
       fi
 
       $ipt -A OUTPUT -o $_dev -p tcp -m multiport --dports $alfaview_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
-      if $kernel_activate_forwarding ; then
+      if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
          $ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $alfaview_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
       fi
 
       $ipt -A OUTPUT -o $_dev -p udp -m multiport --dports $alfaview_udp_ports -m conntrack --ctstate NEW -j ACCEPT
-      if $kernel_activate_forwarding ; then
+      if $kernel_activate_forwarding  && ! $permit_local_net_to_inet; then
          $ipt -A FORWARD -o $_dev -p udp -m multiport --dports $alfaview_udp_ports -m conntrack --ctstate NEW -j ACCEPT
       fi