firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix errors for special local network rules as local_net_to_local_ip.

Browse Source
This commit is contained in:
Christoph 2017-04-07 18:36:23 +02:00
parent 62bf18a5f0
commit c21758eb14
2 changed files with 13 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
ip6t-firewall-gateway
View File

@ -798,8 +798,7 @@ fi
echononl "\tAllow these local networks any access to the internet" echononl "\tAllow these local networks any access to the internet"
if [[ ${#any_access_to_inet_network_arr[@]} -gt 0 ]] \ if [[ ${#any_access_to_inet_network_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces \ && $kernel_forward_between_interfaces ; then
&& ! $permit_local_net_to_inet ; then
for _net in ${any_access_to_inet_network_arr[@]}; do for _net in ${any_access_to_inet_network_arr[@]}; do
for _dev in ${ext_if_arr[@]} ; do for _dev in ${ext_if_arr[@]} ; do
@ -819,8 +818,7 @@ fi
echononl "\tAllow local services from given local networks" echononl "\tAllow local services from given local networks"
if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] \ if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces \ && $kernel_forward_between_interfaces ; then
&& ! $permit_local_net_to_inet ; then
for _val in "${allow_local_net_to_local_service_arr[@]}" ; do for _val in "${allow_local_net_to_local_service_arr[@]}" ; do
IFS=',' read -a _val_arr <<< "${_val}" IFS=',' read -a _val_arr <<< "${_val}"
@ -852,8 +850,7 @@ fi
echononl "\tAllow all traffic from local network to local ip-address" echononl "\tAllow all traffic from local network to local ip-address"
if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] \ if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces \ && $kernel_forward_between_interfaces ; then
&& ! $permit_between_local_networks ; then
for _val in ${allow_local_net_to_local_ip_arr[@]} ; do for _val in ${allow_local_net_to_local_ip_arr[@]} ; do
IFS=',' read -a _val_arr <<< "${_val}" IFS=',' read -a _val_arr <<< "${_val}"
@ -882,8 +879,7 @@ fi
echononl "\tAllow all traffic from local ip-address to local network" echononl "\tAllow all traffic from local ip-address to local network"
if [[ ${#allow_local_ip_to_local_net_arr[@]} -gt 0 ]] \ if [[ ${#allow_local_ip_to_local_net_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces \ && $kernel_forward_between_interfaces ; then
&& ! $permit_between_local_networks ; then
for _val in ${allow_local_ip_to_local_net_arr[@]} ; do for _val in ${allow_local_ip_to_local_net_arr[@]} ; do
IFS=',' read -a _val_arr <<< "${_val}" IFS=',' read -a _val_arr <<< "${_val}"
@ -912,8 +908,7 @@ fi
echononl "\tAllow all traffic from local network to (another) local network" echononl "\tAllow all traffic from local network to (another) local network"
if [[ ${#allow_local_net_to_local_net_arr[@]} -gt 0 ]] \ if [[ ${#allow_local_net_to_local_net_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces \ && $kernel_forward_between_interfaces ; then
&& ! $permit_between_local_networks ; then
for _val in ${allow_local_net_to_local_net_arr[@]} ; do for _val in ${allow_local_net_to_local_net_arr[@]} ; do
IFS=',' read -a _val_arr <<< "${_val}" IFS=',' read -a _val_arr <<< "${_val}"
@ -942,8 +937,7 @@ fi
echononl "\tAllow local ip address from given local interface" echononl "\tAllow local ip address from given local interface"
if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] \ if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces \ && $kernel_forward_between_interfaces ; then
&& ! $permit_between_local_networks ; then
for _val in ${allow_local_if_to_local_ip_arr[@]} ; do for _val in ${allow_local_if_to_local_ip_arr[@]} ; do
IFS=',' read -a _val_arr <<< "${_val}" IFS=',' read -a _val_arr <<< "${_val}"

19
ipt-firewall-gateway
View File

@ -1145,8 +1145,7 @@ fi
echononl "\tAllow these local networks any access to the internet" echononl "\tAllow these local networks any access to the internet"
if [[ ${#any_access_to_inet_network_arr[@]} -gt 0 ]] \ if [[ ${#any_access_to_inet_network_arr[@]} -gt 0 ]] \
&& $kernel_activate_forwarding \ && $kernel_activate_forwarding ; then
&& ! $permit_local_net_to_inet ; then
for _net in ${any_access_to_inet_network_arr[@]}; do for _net in ${any_access_to_inet_network_arr[@]}; do
for _dev in ${ext_if_arr[@]} ; do for _dev in ${ext_if_arr[@]} ; do
@ -1166,8 +1165,7 @@ fi
echononl "\tAllow local services from given local networks" echononl "\tAllow local services from given local networks"
if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] \ if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] \
&& $kernel_activate_forwarding \ && $kernel_activate_forwarding ; then
&& ! $permit_between_local_networks ; then
for _val in "${allow_local_net_to_local_service_arr[@]}" ; do for _val in "${allow_local_net_to_local_service_arr[@]}" ; do
IFS=':' read -a _val_arr <<< "${_val}" IFS=':' read -a _val_arr <<< "${_val}"
@ -1199,8 +1197,7 @@ fi
echononl "\tAllow all traffic from local network to local ip-address" echononl "\tAllow all traffic from local network to local ip-address"
if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] \ if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] \
&& $kernel_activate_forwarding \ && $kernel_activate_forwarding ; then
&& ! $permit_between_local_networks ; then
for _val in ${allow_local_net_to_local_ip_arr[@]} ; do for _val in ${allow_local_net_to_local_ip_arr[@]} ; do
IFS=':' read -a _val_arr <<< "${_val}" IFS=':' read -a _val_arr <<< "${_val}"
@ -1229,8 +1226,7 @@ fi
echononl "\tAllow all traffic from local ip-address to local network" echononl "\tAllow all traffic from local ip-address to local network"
if [[ ${#allow_local_ip_to_local_net_arr[@]} -gt 0 ]] \ if [[ ${#allow_local_ip_to_local_net_arr[@]} -gt 0 ]] \
&& $kernel_activate_forwarding \ && $kernel_activate_forwarding ; then
&& ! $permit_between_local_networks ; then
for _val in ${allow_local_ip_to_local_net_arr[@]} ; do for _val in ${allow_local_ip_to_local_net_arr[@]} ; do
IFS=':' read -a _val_arr <<< "${_val}" IFS=':' read -a _val_arr <<< "${_val}"
@ -1259,8 +1255,7 @@ fi
echononl "\tAllow all traffic from local network to (another) local network" echononl "\tAllow all traffic from local network to (another) local network"
if [[ ${#allow_local_net_to_local_net_arr[@]} -gt 0 ]] \ if [[ ${#allow_local_net_to_local_net_arr[@]} -gt 0 ]] \
&& $kernel_activate_forwarding \ && $kernel_activate_forwarding ; then
&& ! $permit_between_local_networks ; then
for _val in ${allow_local_net_to_local_net_arr[@]} ; do for _val in ${allow_local_net_to_local_net_arr[@]} ; do
IFS=':' read -a _val_arr <<< "${_val}" IFS=':' read -a _val_arr <<< "${_val}"
@ -1289,8 +1284,8 @@ fi
echononl "\tAllow local ip address from given local interface" echononl "\tAllow local ip address from given local interface"
if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] \ if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] \
&& $kernel_activate_forwarding \ && $kernel_activate_forwarding ; then
&& ! $permit_between_local_networks ; then
for _val in ${allow_local_if_to_local_ip_arr[@]} ; do for _val in ${allow_local_if_to_local_ip_arr[@]} ; do
IFS=':' read -a _val_arr <<< "${_val}" IFS=':' read -a _val_arr <<< "${_val}"
$ipt -A FORWARD -p ALL -i ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT $ipt -A FORWARD -p ALL -i ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT