Add options 'restrict_local_service_to_net' and 'restrict_local_net_to_net'

ip6t-firewall-server

@@ -513,8 +513,8 @@ echo_done
 # - VPN
 # ---
 
+echononl "\tPermit all traffic through VPN lines.."
 if [[ ${#vpn_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_vpn_server_ip_arr[@]} -gt 0 ]] ; then
-   echononl "\tPermit all traffic through VPN lines.."
    if [[ ${#vpn_server_ip_arr[@]} -gt 0 ]] ; then
       for _ip in ${vpn_server_ip_arr[@]} ; do
          for _port in ${vpn_port_arr[@]} ; do
@@ -543,6 +543,53 @@ else
    echo_skipped
 fi
 
+echo
+
+
+# -------------
+# ---- Restrict local Servive to given (extern) IP-Address/Network
+# -------------
+
+echononl "\tRestrict local Servive to given (extern) IP-Address/Network"
+if [[ ${#restrict_local_service_to_net_arr[@]} -gt 0 ]] ; then
+
+   for _val in "${restrict_local_service_to_net_arr[@]}" ; do
+      IFS=',' read -a _val_arr <<< "${_val}"
+
+      for _dev in ${ext_if_arr[@]} ; do
+         $ip6t -A INPUT -i $_dev -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
+         $ip6t -A INPUT -p ${_val_arr[3]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -j DROP
+      done
+
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# -------------
+# ---- Restrict local Network to given extern IP-Address/Network
+# -------------
+
+echononl "\tRestrict local Address/Network to given extern Address/Network"
+if [[ ${#restrict_local_net_to_net_arr[@]} -gt 0 ]] ; then
+   
+   for _val in "${restrict_local_net_to_net_arr[@]}" ; do
+      IFS=',' read -a _val_arr <<< "${_val}"
+      for _dev in ${ext_if_arr[@]} ; do
+         $ip6t -A INPUT -i $_dev -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+         $ip6t -A INPUT -i $_dev -d ${_val_arr[1]} -j DROP
+      done
+
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
 
 # -------------
 # --- Services