From c21758eb141c14d0a539634c5687ecd5d4275522 Mon Sep 17 00:00:00 2001
From: Christoph <ckubu@oopen.de>
Date: Fri, 7 Apr 2017 18:36:23 +0200
Subject: [PATCH] Fix errors for special local network rules as
 local_net_to_local_ip.

---
 ip6t-firewall-gateway | 18 ++++++------------
 ipt-firewall-gateway  | 19 +++++++------------
 2 files changed, 13 insertions(+), 24 deletions(-)

diff --git a/ip6t-firewall-gateway b/ip6t-firewall-gateway
index eae15b0..aa0222c 100755
--- a/ip6t-firewall-gateway
+++ b/ip6t-firewall-gateway
@@ -798,8 +798,7 @@ fi
 
 echononl "\tAllow these local networks any access to the internet"
 if [[ ${#any_access_to_inet_network_arr[@]} -gt 0 ]] \
-      && $kernel_forward_between_interfaces \
-      && ! $permit_local_net_to_inet ; then
+      && $kernel_forward_between_interfaces ; then
 
    for _net in ${any_access_to_inet_network_arr[@]}; do
       for _dev in ${ext_if_arr[@]} ; do
@@ -819,8 +818,7 @@ fi
 
 echononl "\tAllow local services from given local networks"
 if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] \
-      && $kernel_forward_between_interfaces \
-      && ! $permit_local_net_to_inet ; then
+      && $kernel_forward_between_interfaces ; then
 
    for _val in "${allow_local_net_to_local_service_arr[@]}" ; do
       IFS=',' read -a _val_arr <<< "${_val}"
@@ -852,8 +850,7 @@ fi
 echononl "\tAllow all traffic from local network to local ip-address"
 
 if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] \
-      && $kernel_forward_between_interfaces \
-      && ! $permit_between_local_networks ; then
+      && $kernel_forward_between_interfaces ; then
 
    for _val in ${allow_local_net_to_local_ip_arr[@]} ; do
       IFS=',' read -a _val_arr <<< "${_val}"
@@ -882,8 +879,7 @@ fi
 echononl "\tAllow all traffic from local ip-address to local network"
 
 if [[ ${#allow_local_ip_to_local_net_arr[@]} -gt 0 ]] \
-      && $kernel_forward_between_interfaces \
-      && ! $permit_between_local_networks ; then
+      && $kernel_forward_between_interfaces ; then
 
    for _val in ${allow_local_ip_to_local_net_arr[@]} ; do
       IFS=',' read -a _val_arr <<< "${_val}"
@@ -912,8 +908,7 @@ fi
 echononl "\tAllow all traffic from local network to (another) local network"
 
 if [[ ${#allow_local_net_to_local_net_arr[@]} -gt 0 ]] \
-      && $kernel_forward_between_interfaces \
-      && ! $permit_between_local_networks ; then
+      && $kernel_forward_between_interfaces ; then
 
    for _val in ${allow_local_net_to_local_net_arr[@]} ; do
       IFS=',' read -a _val_arr <<< "${_val}"
@@ -942,8 +937,7 @@ fi
 echononl "\tAllow local ip address from given local interface"
 
 if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] \
-      && $kernel_forward_between_interfaces \
-      && ! $permit_between_local_networks ; then
+      && $kernel_forward_between_interfaces ; then
 
    for _val in ${allow_local_if_to_local_ip_arr[@]} ; do
       IFS=',' read -a _val_arr <<< "${_val}"
diff --git a/ipt-firewall-gateway b/ipt-firewall-gateway
index 50a7156..3f0aa1a 100755
--- a/ipt-firewall-gateway
+++ b/ipt-firewall-gateway
@@ -1145,8 +1145,7 @@ fi
 
 echononl "\tAllow these local networks any access to the internet"
 if [[ ${#any_access_to_inet_network_arr[@]} -gt 0 ]] \
-      && $kernel_activate_forwarding \
-      && ! $permit_local_net_to_inet ; then
+      && $kernel_activate_forwarding ; then
 
    for _net in ${any_access_to_inet_network_arr[@]}; do
       for _dev in ${ext_if_arr[@]} ; do
@@ -1166,8 +1165,7 @@ fi
 
 echononl "\tAllow local services from given local networks"
 if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] \
-      && $kernel_activate_forwarding \
-      && ! $permit_between_local_networks ; then
+      && $kernel_activate_forwarding ; then
 
    for _val in "${allow_local_net_to_local_service_arr[@]}" ; do
       IFS=':' read -a _val_arr <<< "${_val}"
@@ -1199,8 +1197,7 @@ fi
 echononl "\tAllow all traffic from local network to local ip-address"
 
 if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] \
-      && $kernel_activate_forwarding \
-      && ! $permit_between_local_networks ; then
+      && $kernel_activate_forwarding ; then
 
    for _val in ${allow_local_net_to_local_ip_arr[@]} ; do
       IFS=':' read -a _val_arr <<< "${_val}"
@@ -1229,8 +1226,7 @@ fi
 echononl "\tAllow all traffic from local ip-address to local network"
 
 if [[ ${#allow_local_ip_to_local_net_arr[@]} -gt 0 ]] \
-      && $kernel_activate_forwarding \
-      && ! $permit_between_local_networks ; then
+      && $kernel_activate_forwarding ; then
 
    for _val in ${allow_local_ip_to_local_net_arr[@]} ; do
       IFS=':' read -a _val_arr <<< "${_val}"
@@ -1259,8 +1255,7 @@ fi
 echononl "\tAllow all traffic from local network to (another) local network"
 
 if [[ ${#allow_local_net_to_local_net_arr[@]} -gt 0 ]] \
-      && $kernel_activate_forwarding \
-      && ! $permit_between_local_networks ; then
+      && $kernel_activate_forwarding ; then
 
    for _val in ${allow_local_net_to_local_net_arr[@]} ; do
       IFS=':' read -a _val_arr <<< "${_val}"
@@ -1289,8 +1284,8 @@ fi
 echononl "\tAllow local ip address from given local interface"
 
 if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] \
-      && $kernel_activate_forwarding \
-      && ! $permit_between_local_networks ; then
+      && $kernel_activate_forwarding ; then
+
    for _val in ${allow_local_if_to_local_ip_arr[@]} ; do
       IFS=':' read -a _val_arr <<< "${_val}"
       $ipt -A FORWARD -p ALL -i ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT