firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix rules for 'allow_ext_net_to_local_service'

Browse Source
This commit is contained in:
Christoph 2017-05-10 00:22:13 +02:00
parent a2fe7ce5ff
commit ddff7f8345
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ip6t-firewall-gateway
View File

@ -839,6 +839,11 @@ if [[ ${#allow_ext_net_to_local_service_arr[@]} -gt 0 ]] \
for _val in "${allow_ext_net_to_local_service_arr[@]}" ; do for _val in "${allow_ext_net_to_local_service_arr[@]}" ; do
IFS=',' read -a _val_arr <<< "${_val}" IFS=',' read -a _val_arr <<< "${_val}"
for _dev in ${ext_if_arr[@]} ; do for _dev in ${ext_if_arr[@]} ; do
if containsElement "${_val_arr[1]}" "${gateway_ipv6_address_arr[@]}" ; then
$ip6t -A INPUT -i $_dev -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
fi
$ip6t -A FORWARD -i $_dev -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT $ip6t -A FORWARD -i $_dev -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
done done

4
ipt-firewall-gateway
View File

@ -1220,6 +1220,10 @@ if [[ ${#allow_ext_net_to_local_service_arr[@]} -gt 0 ]] \
IFS=':' read -a _val_arr <<< "${_val}" IFS=':' read -a _val_arr <<< "${_val}"
for _dev in ${ext_if_arr[@]} ; do for _dev in ${ext_if_arr[@]} ; do
if containsElement "${_val_arr[1]}" "${gateway_ipv4_address_arr[@]}" ; then
$ipt -A INPUT -i $_dev -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
fi
# - Traffic recieved on natted interfaces will be ommitted! # - Traffic recieved on natted interfaces will be ommitted!
# - # -
if containsElement "$_dev" "${nat_device_arr[@]}" ; then if containsElement "$_dev" "${nat_device_arr[@]}" ; then