firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

allow those ssh ports out, which are also allowed for incoming traffic.

Browse Source
This commit is contained in:
Christoph 2021-10-26 11:02:59 +02:00
parent c78edd01be
commit 2d07d39a55
2 changed files with 67 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
ip6t-firewall-server
View File

@ -1268,11 +1268,41 @@ for _dev in ${ext_if_arr[@]} ; do
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -o $_dev -p tcp --dport $standard_ssh_port -m state --state NEW -j ACCEPT
fi
if [[ ${#ssh_port_arr[@]} -gt 0 ]] ; then
for _port in ${ssh_port_arr[@]} ; do
[[ "$_port" = "$standard_ssh_port" ]] && continue
$ip6t -A OUTPUT -o $_dev -p tcp --dport $_port -m state --state NEW -j ACCEPT
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -o $_dev -p tcp --dport $_port -m state --state NEW -j ACCEPT
fi
done
fi
done
for _dev in ${local_if_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -p tcp --dport $standard_ssh_port -m state --state NEW -j ACCEPT
done
if [[ ${#local_if_arr[@]} -gt 0 ]] ; then
for _dev in ${local_if_arr[@]} ; do
$ip6t -A OUTPUT -o $_dev -p tcp --dport $standard_ssh_port -m state --state NEW -j ACCEPT
if [[ ${#ssh_port_arr[@]} -gt 0 ]] ; then
for _port in ${ssh_port_arr[@]} ; do
[[ "$_port" = "$standard_ssh_port" ]] && continue
$ip6t -A OUTPUT -o $_dev -p tcp --dport $_port -m state --state NEW -j ACCEPT
if $kernel_forward_between_interfaces ; then
$ip6t -A FORWARD -i $_dev -p tcp --dport $_port -m state --state NEW -j ACCEPT
fi
done
fi
done
fi
echo_done

37
ipt-firewall-server
View File

@ -1436,11 +1436,42 @@ for _dev in ${ext_if_arr[@]} ; do
if $kernel_activate_forwarding ; then
$ipt -A FORWARD -o $_dev -p tcp --dport $standard_ssh_port -m state --state NEW -j ACCEPT
fi
if [[ ${#ssh_port_arr[@]} -gt 0 ]] ; then
for _port in ${ssh_port_arr[@]} ; do
[[ "$_port" = "$standard_ssh_port" ]] && continue
$ipt -A OUTPUT -o $_dev -p tcp --dport $_port -m state --state NEW -j ACCEPT
if $kernel_activate_forwarding ; then
$ipt -A FORWARD -o $_dev -p tcp --dport $_port -m state --state NEW -j ACCEPT
fi
done
fi
done
for _dev in ${local_if_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p tcp --dport $standard_ssh_port -m state --state NEW -j ACCEPT
done
if [[ ${#local_if_arr[@]} -gt 0 ]] ; then
for _dev in ${local_if_arr[@]} ; do
$ipt -A OUTPUT -o $_dev -p tcp --dport $standard_ssh_port -m state --state NEW -j ACCEPT
if [[ ${#ssh_port_arr[@]} -gt 0 ]] ; then
for _port in ${ssh_port_arr[@]} ; do
[[ "$_port" = "$standard_ssh_port" ]] && continue
$ipt -A OUTPUT -o $_dev -p tcp --dport $_port -m state --state NEW -j ACCEPT
if $kernel_activate_forwarding ; then
$ipt -A FORWARD -i $_dev -p tcp --dport $_port -m state --state NEW -j ACCEPT
fi
done
fi
done
fi
echo_done