diff --git a/conf/default_settings.conf b/conf/default_settings.conf index d212560..b2fb46a 100644 --- a/conf/default_settings.conf +++ b/conf/default_settings.conf @@ -57,6 +57,7 @@ standard_prometheus_ports="9100,9256" # - Mattermost (MM) Service # - stansard_mattermost_udp_ports_in="8443" +stansard_mattermost_tcp_ports_in="8443" stansard_mattermost_udp_ports_out="3478" # - IPsec - Internet Security Association and diff --git a/conf/main_ipv4.conf.sample b/conf/main_ipv4.conf.sample index 3453055..9b21ae7 100644 --- a/conf/main_ipv4.conf.sample +++ b/conf/main_ipv4.conf.sample @@ -407,6 +407,7 @@ forward_mm_server_ips="" # - UDP Ports IN and OUT used by MM Servive # - mm_udp_ports_in="$stansard_mattermost_udp_ports_in" +mm_tcp_ports_in="$stansard_mattermost_tcp_ports_in" mm_udp_ports_out="$stansard_mattermost_udp_ports_out" diff --git a/conf/main_ipv6.conf.sample b/conf/main_ipv6.conf.sample index 1fce65d..c8c6173 100644 --- a/conf/main_ipv6.conf.sample +++ b/conf/main_ipv6.conf.sample @@ -423,6 +423,7 @@ forward_mm_server_ips="" # - UDP Ports IN and OUT used by MM Servive # - mm_udp_ports_in="$stansard_mattermost_udp_ports_in" +mm_tcp_ports_in="$stansard_mattermost_tcp_ports_in" mm_udp_ports_out="$stansard_mattermost_udp_ports_out" diff --git a/ip6t-firewall-server b/ip6t-firewall-server index 052a608..a9d9b7c 100755 --- a/ip6t-firewall-server +++ b/ip6t-firewall-server @@ -2089,12 +2089,22 @@ if [[ ${#mm_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_mm_server_ip_arr[@]} -gt if [[ ${#mm_server_ip_arr[@]} -gt 0 ]] ; then for _ip in ${mm_server_ip_arr[@]} ; do $ip6t -A INPUT -p udp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT + if [ -n ${mm_tcp_ports_in} ] ; then + $ip6t -A INPUT -p tcp -d $_ip -m multiport --dports $mm_tcp_ports_in -m conntrack --ctstate NEW -j ACCEPT + else + $ip6t -A INPUT -p tcp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT + fi $ip6t -A OUTPUT -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT done if [[ ${#forward_mm_server_ip_arr[@]} -gt 0 ]] && $kernel_forward_between_interfaces ; then for _ip in ${forward_mm_server_ip_arr[@]} ; do $ip6t -A FORWARD -p udp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT + if [ -n ${mm_tcp_ports_in} ] ; then + $ip6t -A FORWARD -p tcp -d $_ip -m multiport --dports $mm_tcp_ports_in -m conntrack --ctstate NEW -j ACCEPT + else + $ip6t -A FORWARD -p tcp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT + fi $ip6t -A FORWARD -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT done fi diff --git a/ipt-firewall-server b/ipt-firewall-server index ea05b4b..c9dbbbe 100755 --- a/ipt-firewall-server +++ b/ipt-firewall-server @@ -2273,12 +2273,22 @@ if [[ ${#mm_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_mm_server_ip_arr[@]} -gt if [[ ${#mm_server_ip_arr[@]} -gt 0 ]] ; then for _ip in ${mm_server_ip_arr[@]} ; do $ipt -A INPUT -p udp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT - $ipt -A OUTPUT -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT + if [ -n ${mm_tcp_ports_in} ] ; then + $ipt -A INPUT -p tcp -d $_ip -m multiport --dports $mm_tcp_ports_in -m conntrack --ctstate NEW -j ACCEPT + else + $ipt -A INPUT -p tcp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT + fi + $ipt -A OUTPUT -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT done if [[ ${#forward_mm_server_ip_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then for _ip in ${forward_mm_server_ip_arr[@]} ; do $ipt -A FORWARD -p udp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT + if [ -n ${mm_tcp_ports_in} ] ; then + $ipt -A FORWARD -p tcp -d $_ip -m multiport --dports $mm_tcp_ports_in -m conntrack --ctstate NEW -j ACCEPT + else + $ipt -A FORWARD -p tcp -d $_ip -m multiport --dports $mm_udp_ports_in -m conntrack --ctstate NEW -j ACCEPT + fi $ipt -A FORWARD -p udp -s $_ip -m multiport --dports $mm_udp_ports_out -m conntrack --ctstate NEW -j ACCEPT done fi