- Fix protocol SNMP
- Minor fixes on firewall execution scripts ip6t-firewall-gateway - Add rules "local ip-address to local network" - Add rules "local network to (another) local network"
This commit is contained in:
@ -1144,7 +1144,10 @@ fi
|
||||
# ---
|
||||
|
||||
echononl "\tAllow these local networks any access to the internet"
|
||||
if [[ ${#any_access_to_inet_network_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
|
||||
if [[ ${#any_access_to_inet_network_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_activate_forwarding \
|
||||
&& ! $permit_local_net_to_inet ; then
|
||||
|
||||
for _net in ${any_access_to_inet_network_arr[@]}; do
|
||||
for _dev in ${ext_if_arr[@]} ; do
|
||||
$ipt -A FORWARD -o $_dev -p ALL -s $_net -m conntrack --ctstate NEW -j ACCEPT
|
||||
@ -1162,7 +1165,10 @@ fi
|
||||
# ---
|
||||
|
||||
echononl "\tAllow local services from given local networks"
|
||||
if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
|
||||
if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_activate_forwarding \
|
||||
&& ! $permit_between_local_networks ; then
|
||||
|
||||
for _val in "${allow_local_net_to_local_service_arr[@]}" ; do
|
||||
IFS=':' read -a _val_arr <<< "${_val}"
|
||||
$ipt -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
|
||||
@ -1171,7 +1177,7 @@ if [[ ${#allow_local_net_to_local_service_arr[@]} -gt 0 ]] && $kernel_activate_f
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $kernel_activate_forwarding && $local_alias_interfaces ; then
|
||||
if $local_alias_interfaces ; then
|
||||
if [[ "${_val_arr[3]}" = "tcp" ]]; then
|
||||
$ipt -A FORWARD -p tcp -d ${_val_arr[1]} --dport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
|
||||
$ipt -A FORWARD -p tcp -s ${_val_arr[1]} --sport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
|
||||
@ -1187,12 +1193,16 @@ fi
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow local ip address from given local network
|
||||
# - Allow all traffic from local network to local ip-address
|
||||
# ---
|
||||
|
||||
echononl "\tAllow local ip address from given local network"
|
||||
if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
|
||||
for _val in ${allow_local_net_to_local_service_arr[@]} ; do
|
||||
echononl "\tAllow all traffic from local network to local ip-address"
|
||||
|
||||
if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_activate_forwarding \
|
||||
&& ! $permit_between_local_networks ; then
|
||||
|
||||
for _val in ${allow_local_net_to_local_ip_arr[@]} ; do
|
||||
IFS=':' read -a _val_arr <<< "${_val}"
|
||||
$ipt -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
@ -1200,7 +1210,67 @@ if [[ ${#allow_local_net_to_local_ip_arr[@]} -gt 0 ]] && $kernel_activate_forwar
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $kernel_activate_forwarding && $local_alias_interfaces ; then
|
||||
if $local_alias_interfaces ; then
|
||||
$ipt -A FORWARD -p tcp -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
$ipt -A FORWARD -p tcp -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
done
|
||||
echo_ok
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow all traffic from local ip-address to local network
|
||||
# ---
|
||||
|
||||
echononl "\tAllow all traffic from local ip-address to local network"
|
||||
|
||||
if [[ ${#allow_local_ip_to_local_net_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_activate_forwarding \
|
||||
&& ! $permit_between_local_networks ; then
|
||||
|
||||
for _val in ${allow_local_ip_to_local_net_arr[@]} ; do
|
||||
IFS=':' read -a _val_arr <<< "${_val}"
|
||||
$ipt -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# - Note:
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $local_alias_interfaces ; then
|
||||
$ipt -A FORWARD -p tcp -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
$ipt -A FORWARD -p tcp -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
done
|
||||
echo_ok
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow all traffic from (one) local network to (another) local network
|
||||
# ---
|
||||
|
||||
echononl "\tAllow all traffic from local network to (another) local network"
|
||||
|
||||
if [[ ${#allow_local_net_to_local_net_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_activate_forwarding \
|
||||
&& ! $permit_between_local_networks ; then
|
||||
|
||||
for _val in ${allow_local_net_to_local_net_arr[@]} ; do
|
||||
IFS=':' read -a _val_arr <<< "${_val}"
|
||||
$ipt -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# - Note:
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $local_alias_interfaces ; then
|
||||
$ipt -A FORWARD -p tcp -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
$ipt -A FORWARD -p tcp -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
@ -1217,7 +1287,10 @@ fi
|
||||
# ---
|
||||
|
||||
echononl "\tAllow local ip address from given local interface"
|
||||
if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
|
||||
|
||||
if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_activate_forwarding \
|
||||
&& ! $permit_between_local_networks ; then
|
||||
for _val in ${allow_local_if_to_local_ip_arr[@]} ; do
|
||||
IFS=':' read -a _val_arr <<< "${_val}"
|
||||
$ipt -A FORWARD -p ALL -i ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
|
||||
@ -1226,7 +1299,7 @@ if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] && $kernel_activate_forward
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $kernel_activate_forwarding && $local_alias_interfaces ; then
|
||||
if $local_alias_interfaces ; then
|
||||
$ipt -A FORWARD -p tcp -i ${_val_arr[0]} -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
$ipt -A FORWARD -p tcp -o ${_val_arr[0]} -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
@ -2947,7 +3020,7 @@ fi
|
||||
|
||||
echononl "\t\tRsync Out from given local machines"
|
||||
|
||||
if [[ ${#rsync_out_ip_arr[@]} -gt 0 ]] && $kernel_activate_forwarding $$ ! $permit_local_net_to_inet; then
|
||||
if [[ ${#rsync_out_ip_arr[@]} -gt 0 ]] && $kernel_activate_forwarding && ! $permit_local_net_to_inet; then
|
||||
for _port in ${rsync_port_arr[@]} ; do
|
||||
for _ip in ${rsync_out_ip_arr[@]} ; do
|
||||
$ipt -A FORWARD -p tcp -s $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
@ -2965,12 +3038,13 @@ fi
|
||||
|
||||
echononl "\t\tSNMP Services local Networks"
|
||||
|
||||
if [[ ${#snmp_server_ip_arr[@]} -gt 0 ]] ; then
|
||||
if [[ ${#snmp_server_ip_arr[@]} -gt 0 ]] && ! $permit_between_local_networks; then
|
||||
for _ip in ${snmp_server_ip_arr[@]} ; do
|
||||
$ipt -A OUTPUT -p tcp -d $_ip --dport $snmp_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ipt -A OUTPUT -p udp -d $_ip --dport $snmp_trap_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
|
||||
for _dev in ${local_if_arr[@]} ; do
|
||||
$ipt -A FORWARD -i $_dev -p tcp -d $_ip --dport $snmp_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ipt -A FORWARD -i $_dev -p udp -s $_ip --dport $snmp_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ipt -A FORWARD -i $_dev -p udp -d $_ip --dport $snmp_trap_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
fi
|
||||
done
|
||||
|
||||
Reference in New Issue
Block a user