From 498b34741c3b6adcf2fc42b1e827dfdf344f222d Mon Sep 17 00:00:00 2001 From: Christoph Date: Wed, 3 Jun 2020 14:10:27 +0200 Subject: [PATCH] Add support for Portforwarding TCP/UDP using socat. --- conf/main_ipv4.conf.sample | 43 +++++++++++++++++++++ conf/main_ipv6.conf.sample | 44 +++++++++++++++++++++ conf/post_decalrations.conf | 16 ++++++++ ip6t-firewall-server | 77 ++++++++++++++++++++++++++++++++++++- ipt-firewall-server | 70 +++++++++++++++++++++++++++++++++ 5 files changed, 249 insertions(+), 1 deletion(-) diff --git a/conf/main_ipv4.conf.sample b/conf/main_ipv4.conf.sample index 5bfdfb8..ed77a8f 100644 --- a/conf/main_ipv4.conf.sample +++ b/conf/main_ipv4.conf.sample @@ -503,6 +503,49 @@ udp_out_ports="" forward_udp_out_ports="" + +# ============= +# --- Portforwarding +# ============= + +# - Portforwarding TCP +# - +# - portforward_tcp="::::" +# - +# - Multiple declarations (blank separated list) are possible +# - +# - Example: +# - portforward_tcp="${ext_if_1}:83.223.86.95:9997:192.168.52.25:22 +# - ${ext_if_1}:${ext_1_ip}:80:83.223.86.98:80 +# - ${ext_if_1}:${ext_1_ip}:443:83.223.86.98:443 +# - " +# - +# - Note! +# - be careful if you use a variable (e.g. ext_1_ip) that it contains NO SPACES. +# - +# - Blank separated list +# - +portforward_tcp="" + + +# - Portforwarding UDP +# - +# - portforward_udp="::::" +# - +# - Multiple declarations (blank separated list) are possible +# - +# - Example: +# - portforward_udp=" +# - ${ext_if_1}:${ext_1_ip}:1194:192.168.52.25:1194 +# - ${ext_if_1}:${ext_1_ip}:1195:192.168.53.24:1195 +# - " +# - +# - Blank separated list +# - +portforward_udp="" + + + # ------------- # --- Block IP's / IP-Ranges # ------------- diff --git a/conf/main_ipv6.conf.sample b/conf/main_ipv6.conf.sample index 4edefb4..67d0e24 100644 --- a/conf/main_ipv6.conf.sample +++ b/conf/main_ipv6.conf.sample @@ -522,6 +522,50 @@ udp_out_ports="" forward_udp_out_ports="" + +# ============= +# --- Portforwarding +# ============= + +# - Portforwarding TCP +# - +# - portforward_tcp=",,,," +# - +# - Multiple declarations (blank separated list) are possible +# - +# - Example: +# - portforward_tcp="${ext_if_1},${ext_1_ip},9997,2a01:30:0:13:5054:ff:fe83:dbda,c22 +# - ${ext_if_1},${ext_1_ip},80,2a01:30:0:13:211:84ff:feb7:7f9c,80 +# - ${ext_if_1},2a01:30:0:13:2d1:2bff:fec1:aed0,80,2a01:30:0:13:211:84ff:feb7:7f9c,80 +# - ${ext_if_1},2a01:30:0:13:2d1:2bff:fec1:aed0,443,2a01:30:0:13:211:84ff:feb7:7f9c,443 +# - " +# - +# - Note! +# - be careful if you use a variable (e.g. ext_1_ip) that it contains NO SPACES. +# - +# - Blank separated list +# - +portforward_tcp="" + + +# - Portforwarding UDP +# - +# - portforward_udp=",,,," +# - +# - Multiple declarations (blank separated list) are possible +# - +# - Example: +# - portforward_udp=" +# - ${ext_if_1},${ext_1_ip},1094,,1094 +# - ${ext_if_1},${ext_1_ip},1095,,1095 +# - " +# - +# - Blank separated list +# - +portforward_udp="" + + + # ------------- # --- Block IP's / IP-Ranges # ------------- diff --git a/conf/post_decalrations.conf b/conf/post_decalrations.conf index 45dc514..596d5da 100644 --- a/conf/post_decalrations.conf +++ b/conf/post_decalrations.conf @@ -462,3 +462,19 @@ for _port in $forward_udp_out_ports ; do done +# --- +# - Portforwrds TCP +# --- +declare -a portforward_tcp_arr +for _str in $portforward_tcp ; do + portforward_tcp_arr+=("$_str") +done + +# --- +# - Portforwrds UDP +# --- +declare -a portforward_udp_arr +for _str in $portforward_udp ; do + portforward_udp_arr+=("$_str") +done + diff --git a/ip6t-firewall-server b/ip6t-firewall-server index 2cc7018..7001d61 100755 --- a/ip6t-firewall-server +++ b/ip6t-firewall-server @@ -938,7 +938,7 @@ echononl "\t\tAllow (non-standard) local Services" if [[ ${#allow_local_service_arr[@]} -gt 0 ]] ; then for _dev in "${ext_if_arr[@]}" ; do for _val in "${allow_local_service_arr[@]}" ; do - IFS=':' read -a _val_arr <<< "${_val}" + IFS=',' read -a _val_arr <<< "${_val}" $ip6t -A INPUT -i $_dev -p ${_val_arr[1]} --dport ${_val_arr[0]} -m state --state NEW -j ACCEPT done done @@ -2062,6 +2062,81 @@ fi echo +# ------------- +# --- Portforwarding +# ------------- + +# --- +# - Portforwarding TCP +# --- + +echononl "\t\tPortforwarding TCP" + +if [[ ${#portforward_tcp_arr[@]} -gt 0 ]] ; then + for _val in "${portforward_tcp_arr[@]}" ; do + + # - Split value + # - + IFS=',' read -a _val_arr <<< "${_val}" + + # - Allow Packets IN + # - + $ip6t -A INPUT -i ${_val_arr[0]} -p tcp -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT + + # - Allow Packets FORWARD + # - + $ip6t -A FORWARD -i ${_val_arr[0]} -p tcp -d ${_val_arr[3]} --dport ${_val_arr[4]} -m conntrack --ctstate NEW -j ACCEPT + + _job_id="$(ps ax | grep "TCP6-LISTEN:${_val_arr[2]},fork,bind=\[${_val_arr[1]}\]" | grep -v grep | awk '{print$1}')" + if [[ -n "$_job_id" ]]; then + kill ${_job_id} > /dev/null 2>&1 + fi + + socat TCP6-LISTEN:${_val_arr[2]},fork,bind=[${_val_arr[1]}] TCP:[${_val_arr[3]}]:${_val_arr[4]} & + + done + echo_done +else + echo_skipped +fi + + +# --- +# - Portforwarding UDP +# --- + +echononl "\t\tPortforwarding UDP" + +if [[ ${#portforward_udp_arr[@]} -gt 0 ]] ; then + for _val in "${portforward_udp_arr[@]}" ; do + + # - Split value + # - + IFS=',' read -a _val_arr <<< "${_val}" + + # - Allow Packets IN + # - + $ip6t -A INPUT -i ${_val_arr[0]} -p udp -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT + + # - Allow Packets FORWARD + # - + $ip6t -A FORWARD -i ${_val_arr[0]} -p udp -d ${_val_arr[3]} --dport ${_val_arr[4]} -m conntrack --ctstate NEW -j ACCEPT + + _job_id="$(ps ax | grep "UDP6-LISTEN:${_val_arr[2]},fork,bind=\[${_val_arr[1]}\]" | grep -v grep | awk '{print$1}')" + if [[ -n "$_job_id" ]]; then + kill ${_job_id} > /dev/null 2>&1 + fi + + socat UDP6-LISTEN:${_val_arr[2]},fork,bind=[${_val_arr[1]}] UDP:[${_val_arr[3]}]:${_val_arr[4]} & + + done + echo_done +else + echo_skipped +fi + + +echo # --- # - UNIX Traceroute diff --git a/ipt-firewall-server b/ipt-firewall-server index 7d13637..53826a5 100755 --- a/ipt-firewall-server +++ b/ipt-firewall-server @@ -2310,6 +2310,76 @@ fi echo +# ------------- +# --- Portforwarding +# ------------- + +# --- +# - Portforwarding TCP +# --- + +echononl "\t\tPortforwarding TCP" + +if [[ ${#portforward_tcp_arr[@]} -gt 0 ]] ; then + for _val in "${portforward_tcp_arr[@]}" ; do + + # - Split value + # - + IFS=':' read -a _val_arr <<< "${_val}" + + # - Allow Packets IN + # - + $ipt -A INPUT -i ${_val_arr[0]} -p tcp -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT + + # - Allow Packets FORWARD + # - + $ipt -A FORWARD -i ${_val_arr[0]} -p tcp -d ${_val_arr[3]} --dport ${_val_arr[4]} -m conntrack --ctstate NEW -j ACCEPT + + _job_id="$(ps ax | grep "TCP4-LISTEN:${_val_arr[2]},fork,bind=${_val_arr[1]}" | grep -v grep | awk '{print$1}')" + if [[ -n "$_job_id" ]]; then + kill ${_job_id} > /dev/null 2>&1 + fi + + socat TCP4-LISTEN:${_val_arr[2]},fork,bind=${_val_arr[1]} TCP:${_val_arr[3]}:${_val_arr[4]} & + + done + echo_done +else + echo_skipped +fi + +echononl "\t\tPortforwarding UDP" + +if [[ ${#portforward_udp_arr[@]} -gt 0 ]] ; then + for _val in "${portforward_udp_arr[@]}" ; do + + # - Split value + # - + IFS=':' read -a _val_arr <<< "${_val}" + + # - Allow Packets IN + # - + $ipt -A INPUT -i ${_val_arr[0]} -p udp -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT + + # - Allow Packets FORWARD + # - + $ipt -A FORWARD -i ${_val_arr[0]} -p udp -d ${_val_arr[3]} --dport ${_val_arr[4]} -m conntrack --ctstate NEW -j ACCEPT + + _job_id="$(ps ax | grep "UDP4-LISTEN:${_val_arr[2]},fork,bind=${_val_arr[1]}" | grep -v grep | awk '{print$1}')" + if [[ -n "$_job_id" ]]; then + kill ${_job_id} > /dev/null 2>&1 + fi + + socat UDP4-LISTEN:${_val_arr[2]},fork,bind=${_val_arr[1]} UDP:${_val_arr[3]}:${_val_arr[4]} & + + done + echo_done +else + echo_skipped +fi + + +echo # --- # - UNIX Traceroute