Add support for Portforwarding TCP/UDP using socat.

conf/main_ipv4.conf.sample

@@ -503,6 +503,49 @@ udp_out_ports=""
 forward_udp_out_ports=""
 
 
+
+# =============
+# --- Portforwarding
+# =============
+
+# - Portforwarding TCP
+# -
+# - portforward_tcp="<device-in>:<src-ip>:<port-in>:<ip-to-forward>:<port-out>"
+# -
+# - Multiple declarations (blank separated list) are possible
+# -
+# - Example:
+# -    portforward_tcp="${ext_if_1}:83.223.86.95:9997:192.168.52.25:22
+# -                     ${ext_if_1}:${ext_1_ip}:80:83.223.86.98:80
+# -                     ${ext_if_1}:${ext_1_ip}:443:83.223.86.98:443
+# -                     "
+# -
+# - Note!
+# -    be careful if you use a variable (e.g. ext_1_ip) that it contains NO SPACES.
+# -
+# - Blank separated list
+# -
+portforward_tcp=""
+
+
+# - Portforwarding UDP
+# -
+# - portforward_udp="<device-in>:<src-ip>:<udp-port-in>:<ip-to-forward>:<udp-port-out>"
+# -
+# - Multiple declarations (blank separated list) are possible
+# -
+# - Example:
+# -    portforward_udp="
+# -       ${ext_if_1}:${ext_1_ip}:1194:192.168.52.25:1194
+# -       ${ext_if_1}:${ext_1_ip}:1195:192.168.53.24:1195
+# -    "
+# -
+# - Blank separated list
+# -
+portforward_udp=""
+
+
+
 # -------------
 # --- Block IP's / IP-Ranges
 # -------------

conf/main_ipv6.conf.sample

@@ -522,6 +522,50 @@ udp_out_ports=""
 forward_udp_out_ports=""
 
 
+
+# =============
+# --- Portforwarding
+# =============
+
+# - Portforwarding TCP
+# -
+# - portforward_tcp="<device-in>,<src-ip>,<port-in>,<ip-to-forward>,<port-out>"
+# -
+# - Multiple declarations (blank separated list) are possible
+# -
+# - Example:
+# -    portforward_tcp="${ext_if_1},${ext_1_ip},9997,2a01:30:0:13:5054:ff:fe83:dbda,c22
+# -                     ${ext_if_1},${ext_1_ip},80,2a01:30:0:13:211:84ff:feb7:7f9c,80
+# -                     ${ext_if_1},2a01:30:0:13:2d1:2bff:fec1:aed0,80,2a01:30:0:13:211:84ff:feb7:7f9c,80
+# -                     ${ext_if_1},2a01:30:0:13:2d1:2bff:fec1:aed0,443,2a01:30:0:13:211:84ff:feb7:7f9c,443
+# -                     "
+# -
+# - Note!
+# -    be careful if you use a variable (e.g. ext_1_ip) that it contains NO SPACES.
+# -
+# - Blank separated list
+# -
+portforward_tcp=""
+
+
+# - Portforwarding UDP
+# -
+# - portforward_udp="<device-in>,<src-ip>,<udp-port-in>,<ip-to-forward>,<udp-port-out>"
+# -
+# - Multiple declarations (blank separated list) are possible
+# -
+# - Example:
+# -    portforward_udp="
+# -       ${ext_if_1},${ext_1_ip},1094,,1094
+# -       ${ext_if_1},${ext_1_ip},1095,,1095
+# -    "
+# -
+# - Blank separated list
+# -
+portforward_udp=""
+
+
+
 # -------------
 # --- Block IP's / IP-Ranges
 # -------------

conf/post_decalrations.conf

@@ -462,3 +462,19 @@ for _port in $forward_udp_out_ports ; do
 done
 
 
+# ---
+# - Portforwrds TCP
+# ---
+declare -a portforward_tcp_arr
+for _str in $portforward_tcp ; do
+   portforward_tcp_arr+=("$_str")
+done
+
+# ---
+# - Portforwrds UDP
+# ---
+declare -a portforward_udp_arr
+for _str in $portforward_udp ; do
+   portforward_udp_arr+=("$_str")
+done
+

ip6t-firewall-server

@@ -938,7 +938,7 @@ echononl "\t\tAllow (non-standard) local Services"
 if [[ ${#allow_local_service_arr[@]} -gt 0 ]] ; then
    for _dev in "${ext_if_arr[@]}" ; do
       for _val in "${allow_local_service_arr[@]}" ; do
-         IFS=':' read -a _val_arr <<< "${_val}"
+         IFS=',' read -a _val_arr <<< "${_val}"
          $ip6t -A INPUT -i $_dev -p ${_val_arr[1]} --dport ${_val_arr[0]} -m state --state NEW -j ACCEPT
       done
    done
@@ -2062,6 +2062,81 @@ fi
 
 echo
 
+# -------------
+# --- Portforwarding
+# -------------
+
+# ---
+# - Portforwarding TCP
+# ---
+
+echononl "\t\tPortforwarding TCP"
+
+if [[ ${#portforward_tcp_arr[@]} -gt 0 ]] ; then
+   for _val in "${portforward_tcp_arr[@]}" ; do
+
+      # - Split value
+      # -
+      IFS=',' read -a _val_arr <<< "${_val}"
+
+      # - Allow Packets IN
+      # -
+      $ip6t -A INPUT -i ${_val_arr[0]} -p tcp -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
+
+      # - Allow Packets FORWARD
+      # -
+      $ip6t -A FORWARD -i ${_val_arr[0]} -p tcp -d ${_val_arr[3]} --dport ${_val_arr[4]} -m conntrack --ctstate NEW -j ACCEPT
+
+      _job_id="$(ps ax | grep "TCP6-LISTEN:${_val_arr[2]},fork,bind=\[${_val_arr[1]}\]" | grep -v grep  | awk '{print$1}')"
+      if [[ -n "$_job_id" ]]; then
+         kill ${_job_id} > /dev/null 2>&1
+      fi
+
+      socat TCP6-LISTEN:${_val_arr[2]},fork,bind=[${_val_arr[1]}] TCP:[${_val_arr[3]}]:${_val_arr[4]} &
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Portforwarding UDP
+# ---
+
+echononl "\t\tPortforwarding UDP"
+
+if [[ ${#portforward_udp_arr[@]} -gt 0 ]] ; then
+   for _val in "${portforward_udp_arr[@]}" ; do
+
+      # - Split value
+      # -
+      IFS=',' read -a _val_arr <<< "${_val}"
+
+      # - Allow Packets IN
+      # -
+      $ip6t -A INPUT -i ${_val_arr[0]} -p udp -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
+
+      # - Allow Packets FORWARD
+      # -
+      $ip6t -A FORWARD -i ${_val_arr[0]} -p udp -d ${_val_arr[3]} --dport ${_val_arr[4]} -m conntrack --ctstate NEW -j ACCEPT
+
+      _job_id="$(ps ax | grep "UDP6-LISTEN:${_val_arr[2]},fork,bind=\[${_val_arr[1]}\]" | grep -v grep  | awk '{print$1}')"
+      if [[ -n "$_job_id" ]]; then
+         kill ${_job_id} > /dev/null 2>&1
+      fi
+
+      socat UDP6-LISTEN:${_val_arr[2]},fork,bind=[${_val_arr[1]}] UDP:[${_val_arr[3]}]:${_val_arr[4]} &
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+echo 
 
 # ---
 # - UNIX Traceroute

ipt-firewall-server

@@ -2310,6 +2310,76 @@ fi
 
 echo
 
+# -------------
+# --- Portforwarding
+# -------------
+
+# ---
+# - Portforwarding TCP
+# ---
+
+echononl "\t\tPortforwarding TCP"
+
+if [[ ${#portforward_tcp_arr[@]} -gt 0 ]] ; then
+   for _val in "${portforward_tcp_arr[@]}" ; do
+
+      # - Split value
+      # -
+      IFS=':' read -a _val_arr <<< "${_val}"
+
+      # - Allow Packets IN
+      # -
+      $ipt -A INPUT -i ${_val_arr[0]} -p tcp -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
+
+      # - Allow Packets FORWARD
+      # -
+      $ipt -A FORWARD -i ${_val_arr[0]} -p tcp -d ${_val_arr[3]} --dport ${_val_arr[4]} -m conntrack --ctstate NEW -j ACCEPT
+
+      _job_id="$(ps ax | grep "TCP4-LISTEN:${_val_arr[2]},fork,bind=${_val_arr[1]}" | grep -v grep  | awk '{print$1}')"
+      if [[ -n "$_job_id" ]]; then
+         kill ${_job_id} > /dev/null 2>&1
+      fi
+
+      socat TCP4-LISTEN:${_val_arr[2]},fork,bind=${_val_arr[1]} TCP:${_val_arr[3]}:${_val_arr[4]} &
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+echononl "\t\tPortforwarding UDP"
+
+if [[ ${#portforward_udp_arr[@]} -gt 0 ]] ; then
+   for _val in "${portforward_udp_arr[@]}" ; do
+
+      # - Split value
+      # -
+      IFS=':' read -a _val_arr <<< "${_val}"
+
+      # - Allow Packets IN
+      # -
+      $ipt -A INPUT -i ${_val_arr[0]} -p udp -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
+
+      # - Allow Packets FORWARD
+      # -
+      $ipt -A FORWARD -i ${_val_arr[0]} -p udp -d ${_val_arr[3]} --dport ${_val_arr[4]} -m conntrack --ctstate NEW -j ACCEPT
+
+      _job_id="$(ps ax | grep "UDP4-LISTEN:${_val_arr[2]},fork,bind=${_val_arr[1]}" | grep -v grep  | awk '{print$1}')"
+      if [[ -n "$_job_id" ]]; then
+         kill ${_job_id} > /dev/null 2>&1
+      fi
+
+      socat UDP4-LISTEN:${_val_arr[2]},fork,bind=${_val_arr[1]} UDP:${_val_arr[3]}:${_val_arr[4]} &
+
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+echo 
 
 # ---
 # - UNIX Traceroute