Add options 'restrict_local_service_to_net' and 'restrict_local_net_to_net'

ipt-firewall-server

@@ -703,8 +703,8 @@ echo_done
 # - VPN
 # ---
 
+echononl "\tPermit all traffic through VPN lines.."
 if [[ ${#vpn_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_vpn_server_ip_arr[@]} -gt 0 ]] ; then
-   echononl "\tPermit all traffic through VPN lines.."
    if [[ ${#vpn_server_ip_arr[@]} -gt 0 ]] ; then
       for _ip in ${vpn_server_ip_arr[@]} ; do
          for _port in ${vpn_port_arr[@]} ; do
@@ -733,6 +733,53 @@ else
    echo_skipped
 fi
 
+echo
+
+
+# -------------
+# ---- Restrict local Servive to given (extern) IP-Address/Network
+# -------------
+
+echononl "\tRestrict local Servive to given (extern) IP-Address/Network"
+if [[ ${#restrict_local_service_to_net_arr[@]} -gt 0 ]] ; then
+
+   for _val in "${restrict_local_service_to_net_arr[@]}" ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+
+      for _dev in ${ext_if_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A INPUT -p ${_val_arr[3]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -j DROP
+      done
+
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# -------------
+# ---- Restrict local Network to given extern IP-Address/Network
+# -------------
+
+echononl "\tRestrict local Address/Network to given extern Address/Network"
+if [[ ${#restrict_local_net_to_net_arr[@]} -gt 0 ]] ; then
+   
+   for _val in "${restrict_local_net_to_net_arr[@]}" ; do
+      IFS=':' read -a _val_arr <<< "${_val}"
+      for _dev in ${ext_if_arr[@]} ; do
+         $ipt -A INPUT -i $_dev -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
+         $ipt -A INPUT -i $_dev -d ${_val_arr[1]} -j DROP
+      done
+
+   done
+
+   echo_done
+else
+   echo_skipped
+fi
+
 
 # -------------
 # --- Services