- Fix protocol SNMP
- Minor fixes on firewall execution scripts ip6t-firewall-gateway - Add rules "local ip-address to local network" - Add rules "local network to (another) local network"
This commit is contained in:
@ -797,7 +797,10 @@ fi
|
||||
# ---
|
||||
|
||||
echononl "\tAllow these local networks any access to the internet"
|
||||
if [[ ${#any_access_to_inet_network_arr[@]} -gt 0 ]] && $kernel_forward_between_interfaces ; then
|
||||
if [[ ${#any_access_to_inet_network_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_forward_between_interfaces \
|
||||
&& ! $permit_local_net_to_inet ; then
|
||||
|
||||
for _net in ${any_access_to_inet_network_arr[@]}; do
|
||||
for _dev in ${ext_if_arr[@]} ; do
|
||||
$ip6t -A FORWARD -o $_dev -p ALL -s $_net -m conntrack --ctstate NEW -j ACCEPT
|
||||
@ -815,7 +818,10 @@ fi
|
||||
# ---
|
||||
|
||||
echononl "\tAllow local services from given local networks"
|
||||
if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] && $kernel_forward_between_interfaces ; then
|
||||
if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_forward_between_interfaces \
|
||||
&& ! $permit_local_net_to_inet ; then
|
||||
|
||||
for _val in "${allow_local_net_to_local_service_arr[@]}" ; do
|
||||
IFS=',' read -a _val_arr <<< "${_val}"
|
||||
$ip6t -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
|
||||
@ -824,7 +830,7 @@ if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] && $kernel_forward_be
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $kernel_activate_forwarding && $local_alias_interfaces ; then
|
||||
if $local_alias_interfaces ; then
|
||||
if [[ "${_val_arr[3]}" = "tcp" ]]; then
|
||||
$ip6t -A FORWARD -p ${_val_arr[3]} -d ${_val_arr[1]} --dport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
|
||||
$ip6t -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[1]} --sport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
|
||||
@ -840,12 +846,16 @@ fi
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow local ip address from given local network
|
||||
# - Allow all traffic from local network to local ip-address
|
||||
# ---
|
||||
|
||||
echononl "\tAllow local ip address from given local network"
|
||||
if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] && $kernel_forward_between_interfaces ; then
|
||||
for _val in ${allow_local_net_to_local_service_arr[@]} ; do
|
||||
echononl "\tAllow all traffic from local network to local ip-address"
|
||||
|
||||
if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_forward_between_interfaces \
|
||||
&& ! $permit_between_local_networks ; then
|
||||
|
||||
for _val in ${allow_local_net_to_local_ip_arr[@]} ; do
|
||||
IFS=',' read -a _val_arr <<< "${_val}"
|
||||
$ip6t -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
@ -853,7 +863,67 @@ if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] && $kernel_forward_between
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $kernel_activate_forwarding && $local_alias_interfaces ; then
|
||||
if $local_alias_interfaces ; then
|
||||
$ip6t -A FORWARD -p tcp -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
$ip6t -A FORWARD -p tcp -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
done
|
||||
echo_ok
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow all traffic from local ip-address to local network
|
||||
# ---
|
||||
|
||||
echononl "\tAllow all traffic from local ip-address to local network"
|
||||
|
||||
if [[ ${#allow_local_ip_to_local_net_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_forward_between_interfaces \
|
||||
&& ! $permit_between_local_networks ; then
|
||||
|
||||
for _val in ${allow_local_ip_to_local_net_arr[@]} ; do
|
||||
IFS=',' read -a _val_arr <<< "${_val}"
|
||||
$ip6t -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# - Note:
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $local_alias_interfaces ; then
|
||||
$ip6t -A FORWARD -p tcp -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
$ip6t -A FORWARD -p tcp -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
done
|
||||
echo_ok
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow all traffic from (one) local network to (another) local network
|
||||
# ---
|
||||
|
||||
echononl "\tAllow all traffic from local network to (another) local network"
|
||||
|
||||
if [[ ${#allow_local_net_to_local_net_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_forward_between_interfaces \
|
||||
&& ! $permit_between_local_networks ; then
|
||||
|
||||
for _val in ${allow_local_net_to_local_net_arr[@]} ; do
|
||||
IFS=',' read -a _val_arr <<< "${_val}"
|
||||
$ip6t -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# - Note:
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $local_alias_interfaces ; then
|
||||
$ip6t -A FORWARD -p tcp -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
$ip6t -A FORWARD -p tcp -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
@ -870,7 +940,11 @@ fi
|
||||
# ---
|
||||
|
||||
echononl "\tAllow local ip address from given local interface"
|
||||
if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] && $kernel_forward_between_interfaces ; then
|
||||
|
||||
if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_forward_between_interfaces \
|
||||
&& ! $permit_between_local_networks ; then
|
||||
|
||||
for _val in ${allow_local_if_to_local_ip_arr[@]} ; do
|
||||
IFS=',' read -a _val_arr <<< "${_val}"
|
||||
$ip6t -A FORWARD -p ALL -i ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
|
||||
@ -879,7 +953,7 @@ if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] && $kernel_forward_between_
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $kernel_activate_forwarding && $local_alias_interfaces ; then
|
||||
if $local_alias_interfaces ; then
|
||||
$ip6t -A FORWARD -p tcp -i ${_val_arr[0]} -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
$ip6t -A FORWARD -p tcp -o ${_val_arr[0]} -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
@ -1038,7 +1112,7 @@ for _dev in ${ext_if_arr[@]} ; do
|
||||
$ip6t -A OUTPUT -o $_dev -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
|
||||
#$ip6t -A OUTPUT -o $_dev -p tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# - Only useful (needed) if kernel forwarding is activated (kernel_activate_forwarding=true)
|
||||
# - Only useful (needed) if kernel forwarding is activated (kernel_forward_between_interfaces=true)
|
||||
if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
|
||||
# - forward from virtual mashine(s)
|
||||
$ip6t -A FORWARD -o $_dev -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
|
||||
@ -1164,7 +1238,7 @@ if [[ ${#ssh_server_only_local_ip_arr[@]} -gt 0 ]] ; then
|
||||
|
||||
$ip6t -A OUTPUT -p tcp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
|
||||
if $kernel_forward_between_interfaces && ! $permit_between_local_networks ; then
|
||||
for _dev in ${local_if_arr[@]} ; do
|
||||
$ip6t -A FORWARD -i $_dev -p tcp -d $_ip -dport $_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
@ -1174,7 +1248,7 @@ if [[ ${#ssh_server_only_local_ip_arr[@]} -gt 0 ]] ; then
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $kernel_activate_forwarding && $local_alias_interfaces ; then
|
||||
if $kernel_forward_between_interfaces && $local_alias_interfaces ; then
|
||||
$ip6t -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
|
||||
$ip6t -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
@ -1224,7 +1298,7 @@ if [[ ${#ssh_server_dmz_arr[@]} -gt 0 ]] ; then
|
||||
|
||||
# - Rule is needed if (local) interface aliases in use (like eth0:1)
|
||||
# -
|
||||
if $kernel_activate_forwarding && $local_alias_interfaces ; then
|
||||
if $kernel_forward_between_interfaces && $local_alias_interfaces ; then
|
||||
for _port in ${ssh_port_arr[@]} ; do
|
||||
$ip6t -A FORWARD -p tcp -d $_ip --dport $_port --tcp-flag ACK ACK -j ACCEPT
|
||||
$ip6t -A FORWARD -p tcp -s $_ip --sport $_port --tcp-flag ACK ACK -j ACCEPT
|
||||
@ -2546,10 +2620,11 @@ echononl "\t\tSNMP Services local Networks"
|
||||
|
||||
if [[ ${#snmp_server_ip_arr[@]} -gt 0 ]] ; then
|
||||
for _ip in ${snmp_server_ip_arr[@]} ; do
|
||||
$ip6t -A OUTPUT -p tcp -d $_ip --dport $snmp_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ip6t -A OUTPUT -p udp -d $_ip --dport $snmp_trap_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
if $kernel_forward_between_interfaces && ! $permit_between_local_networks ; then
|
||||
for _dev in ${local_if_arr[@]} ; do
|
||||
$ip6t -A FORWARD -i $_dev -p tcp -d $_ip --dport $snmp_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ip6t -A FORWARD -i $_dev -p udp -s $_ip --dport $snmp_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ip6t -A FORWARD -i $_dev -p udp -d $_ip --dport $snmp_trap_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
fi
|
||||
done
|
||||
@ -2658,7 +2733,7 @@ if [[ ${#unifi_controller_gateway_ip_arr[@]} -gt 0 ]] || [[ ${#unify_controller_
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $kernel_activate_forwarding && $local_alias_interfaces ; then
|
||||
if $kernel_forward_between_interfaces && $local_alias_interfaces ; then
|
||||
$ip6t -A FORWARD -p tcp -d $_ip_ctl -m multiport --dports $unify_controller_ports --tcp-flag ACK ACK -j ACCEPT
|
||||
$ip6t -A FORWARD -p tcp -s $_ip_ctl -m multiport --sports $unify_controller_ports --tcp-flag ACK ACK -j ACCEPT
|
||||
if $provide_hotspot ; then
|
||||
|
||||
Reference in New Issue
Block a user