firewall/ipt-gateway
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add support for NC's Talk App (only client).

Browse Source
This commit is contained in:
Christoph
2020-03-21 15:11:39 +01:00
parent 1eeb01411e
commit fe55462803
5 changed files with 118 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
ipt-firewall-gateway
View File

@ -3577,22 +3577,17 @@ echononl "\t\tJitsi Video Conference Service out only"
if $allow_jitsi_video_conference_out ; then
for _dev in ${ext_if_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
$ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $standard_http_ports -m conntrack --ctstate NEW -j ACCEPT
fi
if [[ "$standard_jitsi_tcp_ports" != "$standard_http_ports" ]] ; then
$ipt -A OUTPUT -o $_dev -p tcp -m multiport --dports $standard_jitsi_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
fi
$ipt -A OUTPUT -o $_dev -p udp -m multiport --dports $standard_jitsi_udp_port_range -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
if [[ "$standard_jitsi_tcp_ports" != "$standard_http_ports" ]] ; then
$ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $standard_jitsi_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
if [[ "$jitsi_tcp_ports" != "$standard_http_ports" ]] ; then
$ipt -A OUTPUT -o $_dev -p tcp -m multiport --dports $jitsi_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
$ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $jitsi_tcp_ports -m conntrack --ctstate NEW -j ACCEPT
fi
$ipt -A FORWARD -o $_dev -p udp -m multiport --dports $standard_jitsi_udp_port_range -m conntrack --ctstate NEW -j ACCEPT
fi
$ipt -A OUTPUT -o $_dev -p udp -m multiport --dports $jitsi_udp_ports -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
$ipt -A FORWARD -o $_dev -p udp -m multiport --dports $jitsi_udp_ports -m conntrack --ctstate NEW -j ACCEPT
fi
done
@ -3602,6 +3597,33 @@ else
fi
# ---
# - TURN Server (Stun Server) (for Nextcloud 'talk' app)
# ---
echononl "\t\tTURN Server (Stun Server) (for Nextcloud 'talk' app)out only"
if $allow_nc_talk_out ; then
for _dev in ${ext_if_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p tcp -m multiport --dports $nc_turn_ports -m conntrack --ctstate NEW -j ACCEPT
$ipt -A OUTPUT -o $_dev -p udp -m multiport --dports $nc_turn_ports -m conntrack --ctstate NEW -j ACCEPT
$ipt -A OUTPUT -o $_dev -p udp -m multiport --dports $nc_turn_udp_ports -m conntrack --ctstate NEW -j ACCEPT
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
$ipt -A FORWARD -o $_dev -p tcp -m multiport --dports $nc_turn_ports -m conntrack --ctstate NEW -j ACCEPT
$ipt -A FORWARD -o $_dev -p udp -m multiport --dports $nc_turn_ports -m conntrack --ctstate NEW -j ACCEPT
$ipt -A FORWARD -o $_dev -p udp -m multiport --dports $nc_turn_udp_ports -m conntrack --ctstate NEW -j ACCEPT
fi
done
echo_done
else
echo_skipped
fi
# ---
# - PGP Keyserver out only
# ---