firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add: Allow all traffic from local ip to the internet

Browse Source
This commit is contained in:
Christoph 2019-07-09 15:47:48 +02:00
parent 45b144f416
commit f535a29ca6
5 changed files with 93 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
conf/main_ipv4.conf.sample
View File

@ -146,6 +146,18 @@ block_all_ext_to_local_net=""
# =============
# - Allow all traffic from local ip to the internet
# =============
# - allow_local_ip_to_inet
# -
# - Blank separated list of ip-adresses
# -
allow_local_ip_to_inet=""
# =============
# - Allow local services from given local networks
# =============

15
conf/main_ipv6.conf.sample
View File

@ -130,6 +130,21 @@ block_all_ext_to_local_net=""
# =============
# - Allow all traffic from local ip to the internet
# =============
# - allow_local_ip_to_inet
# -
# - Example:
# - allow_local_ip_to_inet="2a01:30:1fff:fd01::1/64 2a01:505:1fff:fd04::1"
# -
# - Blank separated list of ip-adresses
# -
allow_local_ip_to_inet=""
# =============
# - Allow local services from given local networks
# =============

8
conf/post_decalrations.conf
View File

@ -109,6 +109,14 @@ for _net in $block_all_ext_to_local_net ; do
block_all_ext_to_local_net_arr+=("$_net")
done
# ---
# - Allow all traffic from local ip to the internet
# ---
declare -a allow_local_ip_to_inet_arr
for _ip in $allow_local_ip_to_inet ; do
allow_local_ip_to_inet_arr+=("$_ip")
done
# ---
# - Allow local services from given local networks
# ---

28
ip6t-firewall-gateway
View File

@ -916,6 +916,34 @@ fi
# ---
# - Allow all traffic from local ip to the internet
# ---
echononl "\tAllow all traffic from local ip to the internet"
if [[ ${#allow_local_ip_to_inet_arr[@]} -gt 0 ]] \
&& $kernel_forward_between_interfaces ; then
for _ip in ${allow_local_ip_to_inet_arr[@]} ; do
$ip6t -A FORWARD -p ALL -s $_ip -m conntrack --ctstate NEW -j ACCEPT
# - Note:
# - If (local) alias interfaces like eth1:0 in use, youe need a further
# - special rule.
# -
if $local_alias_interfaces ; then
$ip6t -A FORWARD -p tcp -d $_ip --tcp-flag ACK ACK -j ACCEPT
$ip6t -A FORWARD -p tcp -s $_ip --tcp-flag ACK ACK -j ACCEPT
fi
done
echo_done
else
echo_skipped
fi
# ---
# - Allow local services from given local networks
# ---

32
ipt-firewall-gateway
View File

@ -1532,6 +1532,34 @@ fi
# ---
# - Allow all traffic from local ip to the internet
# ---
echononl "\tAllow all traffic from local ip to the internet"
if [[ ${#allow_local_ip_to_inet_arr[@]} -gt 0 ]] \
&& $kernel_activate_forwarding ; then
for _ip in ${allow_local_ip_to_inet_arr[@]} ; do
$ipt -A FORWARD -p ALL -s $_ip -m conntrack --ctstate NEW -j ACCEPT
# - Note:
# - If (local) alias interfaces like eth1:0 in use, youe need a further
# - special rule.
# -
if $local_alias_interfaces ; then
$ipt -A FORWARD -p tcp -d $_ip --tcp-flag ACK ACK -j ACCEPT
$ipt -A FORWARD -p tcp -s $_ip --tcp-flag ACK ACK -j ACCEPT
fi
done
echo_done
else
echo_skipped
fi
# ---
# - Allow local services from given local networks
# ---
@ -1623,7 +1651,7 @@ if [[ ${#allow_local_ip_to_local_net_arr[@]} -gt 0 ]] \
$ipt -A FORWARD -p tcp -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
fi
done
echo_ok
echo_done
else
echo_skipped
fi
@ -1688,7 +1716,7 @@ if [[ ${#allow_local_if_to_local_ip_arr[@]} -gt 0 ]] \
$ipt -A FORWARD -p tcp -o ${_val_arr[0]} -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
fi
done
echo_ok
echo_done
else
echo_skipped
fi