Update 'NONE-CKUBU'.
This commit is contained in:
@ -258,9 +258,9 @@ if [[ ${#nat_network_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
|
||||
continue
|
||||
fi
|
||||
|
||||
# - ?? - Don't know which rule is the right one
|
||||
# - ?? - Don't know which rule is the right one , maybe both..
|
||||
# -
|
||||
#$ipt -t nat -A POSTROUTING -o ${_val_arr[1]} -d ${_val_arr[0]} -j MASQUERADE
|
||||
$ipt -t nat -A POSTROUTING -o ${_val_arr[1]} -d ${_val_arr[0]} -j MASQUERADE
|
||||
$ipt -t nat -A POSTROUTING -o ${_val_arr[1]} -s ${_val_arr[0]} -j MASQUERADE
|
||||
done
|
||||
fi
|
||||
@ -1644,6 +1644,7 @@ fi
|
||||
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow local ip address from given local interface
|
||||
# ---
|
||||
@ -1676,6 +1677,126 @@ fi
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow extern service from given local interface
|
||||
# ---
|
||||
|
||||
echononl "\tAllow extern service from given local interface"
|
||||
|
||||
if [[ ${#allow_local_if_to_ext_service_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_activate_forwarding ; then
|
||||
|
||||
for _val in "${allow_local_if_to_ext_service_arr[@]}" ; do
|
||||
IFS=':' read -a _val_arr <<< "${_val}"
|
||||
$ipt -A FORWARD -p ${_val_arr[3]} -i ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# - Note:
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $local_alias_interfaces ; then
|
||||
if [[ "${_val_arr[3]}" = "tcp" ]]; then
|
||||
$ipt -A FORWARD -p tcp -i ${_val_arr[0]} -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
$ipt -A FORWARD -p tcp -o ${_val_arr[0]} -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow extern network from given local interface
|
||||
# ---
|
||||
|
||||
echononl "\tAllow extern network from given local interface"
|
||||
|
||||
if [[ ${#allow_local_if_to_ext_net_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_activate_forwarding ; then
|
||||
|
||||
for _val in ${allow_local_if_to_ext_net_arr[@]} ; do
|
||||
IFS=':' read -a _val_arr <<< "${_val}"
|
||||
$ipt -A FORWARD -p ALL -i ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# - Note:
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $local_alias_interfaces ; then
|
||||
$ipt -A FORWARD -p tcp -i ${_val_arr[0]} -d ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
$ipt -A FORWARD -p tcp -o ${_val_arr[0]} -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
done
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow extern service from given local network
|
||||
# ---
|
||||
|
||||
echononl "\tAllow extern service from given local network"
|
||||
if [[ ${#allow_local_net_to_ext_service_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_activate_forwarding ; then
|
||||
|
||||
for _val in "${allow_local_net_to_ext_service_arr[@]}" ; do
|
||||
IFS=':' read -a _val_arr <<< "${_val}"
|
||||
$ipt -A FORWARD -p ${_val_arr[3]} -s ${_val_arr[0]} -d ${_val_arr[1]} --dport ${_val_arr[2]} -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# - Note:
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $local_alias_interfaces ; then
|
||||
if [[ "${_val_arr[3]}" = "tcp" ]]; then
|
||||
$ipt -A FORWARD -p tcp -d ${_val_arr[1]} --dport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
|
||||
$ipt -A FORWARD -p tcp -s ${_val_arr[1]} --sport ${_val_arr[2]} --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# - Allow extern network from given local network
|
||||
# ---
|
||||
|
||||
echononl "\tAllow extern network from given local network"
|
||||
if [[ ${#allow_local_net_to_ext_net_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_activate_forwarding ; then
|
||||
|
||||
for _val in ${allow_local_net_to_ext_net_arr[@]} ; do
|
||||
IFS=':' read -a _val_arr <<< "${_val}"
|
||||
$ipt -A FORWARD -p ALL -s ${_val_arr[0]} -d ${_val_arr[1]} -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# - Note:
|
||||
# - If (local) alias interfaces like eth1:0 in use, youe need a further
|
||||
# - special rule.
|
||||
# -
|
||||
if $local_alias_interfaces ; then
|
||||
$ipt -A FORWARD -p tcp -d ${_val_arr[1]} -s ${_val_arr[0]} --tcp-flag ACK ACK -j ACCEPT
|
||||
$ipt -A FORWARD -p tcp -d ${_val_arr[0]} -s ${_val_arr[1]} --tcp-flag ACK ACK -j ACCEPT
|
||||
fi
|
||||
done
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
|
||||
# ---
|
||||
# - Separate local networks
|
||||
# ---
|
||||
@ -2640,6 +2761,12 @@ else
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
# - FTP common
|
||||
# ---
|
||||
ftp_helper_output_defined=false
|
||||
ftp_helper_prerouting_defined=false
|
||||
|
||||
# ---
|
||||
# - FTP out only
|
||||
# ---
|
||||
@ -2647,20 +2774,116 @@ fi
|
||||
echononl "\t\tFTP out only"
|
||||
|
||||
if $allow_ftp_request_out ; then
|
||||
|
||||
# - Used for different ftpdata recent lists 'ftpdata_$i'
|
||||
# -
|
||||
declare -i i=1
|
||||
|
||||
if ! $ftp_helper_output_defined ; then
|
||||
$ipt -A OUTPUT -t raw -p tcp --dport 21 -j CT --helper ftp
|
||||
ftp_helper_output_defined=true
|
||||
fi
|
||||
if $kernel_activate_forwarding && ! $ftp_helper_prerouting_defined ; then
|
||||
$ipt -A PREROUTING -t raw -p tcp --dport 21 -j CT --helper ftp
|
||||
ftp_helper_prerouting_defined=true
|
||||
fi
|
||||
|
||||
for _dev in ${ext_if_arr[@]} ; do
|
||||
$ipt -A OUTPUT -o $_dev -p tcp --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ipt -A OUTPUT -o $_dev -p tcp --sport $unprivports --dport $unprivports -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# - Open FTP connection and add the destination ip (--rdest) to ftpdata recent list 'ftpdata_$i'.
|
||||
# -
|
||||
$ipt -A OUTPUT -o $_dev -p tcp --dport 21 -m state --state NEW -m recent --name ftpdata_$i --rdest --set -j ACCEPT
|
||||
|
||||
# - (2)
|
||||
# - - Accept packets if the destination ip-address (--rdest) is in the 'ftpdata_$i' list (--update)
|
||||
# - and the destination ip-address was seen within the last 1800 seconds (--seconds 1800).
|
||||
# -
|
||||
# - - If matched, the "last seen" timestamp of the destination address will be updated (--update).
|
||||
# -
|
||||
# - - Entries in the ftpdata list not seen in the last 1800 will be removed (--reap).
|
||||
# -
|
||||
$ipt -A OUTPUT -o $_dev -p tcp -m state --state NEW --dport 1024: \
|
||||
-m recent --name ftpdata_$i --rdest --update --seconds 1800 --reap -j ACCEPT
|
||||
|
||||
((i++))
|
||||
|
||||
# - Accept (helper ftp) related connections
|
||||
# -
|
||||
$ipt -A OUTPUT -m conntrack --ctstate RELATED -m helper --helper ftp -o $_dev -p tcp --dport 1024: -j ACCEPT
|
||||
$ipt -A INPUT -m conntrack --ctstate RELATED -m helper --helper ftp -i $_dev -p tcp --dport 1024: -j ACCEPT
|
||||
|
||||
if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
|
||||
$ipt -A FORWARD -o $_dev -p tcp --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ipt -A FORWARD -o $_dev -p tcp --sport $unprivports --dport $unprivports -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# =====
|
||||
# -
|
||||
# - ip_conntrack_ftp cannot see the TLS-encrypted traffic
|
||||
# - ======================================================
|
||||
# -
|
||||
# - Workaround:
|
||||
# - (1) add (!) desitnatin ip to a 'recent list' named 'ftpdata_$i! if ftp control connections appear
|
||||
# - (2) accept packets of the formaly created recent list 'ftpdata_$i!
|
||||
# -
|
||||
# - Note:
|
||||
# - Use flag '--rdest' to match destination address
|
||||
# -
|
||||
# =====
|
||||
|
||||
# - (1)
|
||||
# -
|
||||
# - Open FTP connection and add the destination ip (--rdest) to ftpdata recent list 'ftpdata_$i'.
|
||||
# -
|
||||
$ipt -A FORWARD -o $_dev -p tcp --dport 21 -m state --state NEW \
|
||||
-m recent --name ftpdata_$i --rdest --set -j ACCEPT
|
||||
|
||||
# - (2)
|
||||
# - - Accept packets if the destination ip-address (--rdest) is in the 'ftpdata_$i' list (--update)
|
||||
# - and the destination ip-address was seen within the last 1800 seconds (--seconds 1800).
|
||||
# -
|
||||
# - - If matched, the "last seen" timestamp of the destination address will be updated (--update).
|
||||
# -
|
||||
# - - Entries in the ftpdata list not seen in the last 1800 will be removed (--reap).
|
||||
# -
|
||||
$ipt -A FORWARD -o $_dev -p tcp -m state --state NEW --dport 1024: \
|
||||
-m recent --name ftpdata_$i --rdest --update --seconds 1800 --reap -j ACCEPT
|
||||
|
||||
((i++))
|
||||
|
||||
|
||||
# - Accept (helper ftp) related connections
|
||||
# -
|
||||
$ipt -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp -o $_dev -p tcp --dport 1024: -j ACCEPT
|
||||
$ipt -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp -i $_dev -p tcp --dport 1024: -j ACCEPT
|
||||
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
echo_done
|
||||
else
|
||||
echo_done
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
#if $allow_ftp_request_out ; then
|
||||
# for _dev in ${ext_if_arr[@]} ; do
|
||||
# $ipt -A OUTPUT -o $_dev -p tcp --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
||||
# $ipt -A OUTPUT -o $_dev -p tcp --sport $unprivports --dport $unprivports -m conntrack --ctstate NEW -j ACCEPT
|
||||
# # - Allow active FTP connections from local network
|
||||
# # -
|
||||
# $ipt -A INPUT -i $_dev -p tcp --sport 20 -m conntrack --ctstate NEW -j ACCEPT
|
||||
# if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
|
||||
# $ipt -A FORWARD -o $_dev -p tcp --dport 21 -m conntrack --ctstate NEW -j ACCEPT
|
||||
# $ipt -A FORWARD -o $_dev -p tcp --sport $unprivports --dport $unprivports -m conntrack --ctstate NEW -j ACCEPT
|
||||
# fi
|
||||
# # - Allow active FTP connections from local network
|
||||
# # -
|
||||
# $ipt -A FORWARD -i $_dev -p tcp --sport 20 -m conntrack --ctstate NEW -j ACCEPT
|
||||
# done
|
||||
#
|
||||
# echo_done
|
||||
#else
|
||||
# echo_done
|
||||
#fi
|
||||
|
||||
|
||||
# ---
|
||||
# - FTP Service Gateway
|
||||
@ -2669,7 +2892,50 @@ fi
|
||||
echononl "\t\tFTP Service Gateway"
|
||||
|
||||
if $local_ftp_service ; then
|
||||
$ipt -A INPUT -p tcp --dport $standard_ftp_port --sport $unprivports -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
# =====
|
||||
# -
|
||||
# - ip_conntrack_ftp cannot see the TLS-encrypted traffic
|
||||
# - ======================================================
|
||||
# -
|
||||
# - Workaround:
|
||||
# - (1) add source ip to a 'recent list' named 'ftpservice! if ftp control connections appear
|
||||
# - (2) accept packets of the formaly created recent list 'ftpservice!
|
||||
# -
|
||||
# =====
|
||||
|
||||
# - (Re)define helper
|
||||
# -
|
||||
# - !! Note: !!
|
||||
# - for both, local FTP server (ftp_server_ip_arr)
|
||||
# - and forward to (extern) FTP server (forward_ftp_server_ip_arr)
|
||||
# -
|
||||
if ! $ftp_helper_prerouting_defined ; then
|
||||
$ipt -A PREROUTING -t raw -p tcp --dport 21 -j CT --helper ftp
|
||||
ftp_helper_prerouting_defined=true
|
||||
fi
|
||||
|
||||
# - (1)
|
||||
# -
|
||||
# - Accept initial FTP connection and add the source ip to ftpdata recent list 'ftpservice'.
|
||||
# -
|
||||
$ipt -A INPUT -p tcp -m state --state NEW --dport 21 -m recent --name ftpservice --set -j ACCEPT
|
||||
|
||||
# - (2)
|
||||
# - - Accept packets if the source ip-address is in the 'ftpservice' list (--update) and the
|
||||
# - source ip-address was seen within the last 1800 seconds (--seconds 1800).
|
||||
# -
|
||||
# - - If matched, the "last seen" timestamp of the source address will be updated (--update).
|
||||
# -
|
||||
# - - Entries in the ftpdata list not seen in the last 1800 will be removed (--reap).
|
||||
# -
|
||||
$ipt -A INPUT -p tcp -m state --state NEW --sport 1024: --dport $ftp_passive_port_range \
|
||||
-m recent --name ftpservice --update --seconds 1800 --reap -j ACCEPT
|
||||
|
||||
# - Accept (helper ftp) related connections
|
||||
# -
|
||||
$ipt -A INPUT -m conntrack --ctstate RELATED -m helper --helper ftp -p tcp --dport 1024: -j ACCEPT
|
||||
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
@ -2681,32 +2947,100 @@ fi
|
||||
# ---
|
||||
|
||||
echononl "\t\tFTP Service local Networks"
|
||||
|
||||
if [[ ${#ftp_server_only_local_ip_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
|
||||
|
||||
# - Used for different ftpdata recent lists 'ftpdata_local_$k'
|
||||
# -
|
||||
declare -i k=1
|
||||
|
||||
# - (Re)define helper
|
||||
# -
|
||||
if ! $ftp_helper_output_defined ; then
|
||||
$ipt -A OUTPUT -t raw -p tcp --dport 21 -j CT --helper ftp
|
||||
ftp_helper_output_defined=true
|
||||
fi
|
||||
if $kernel_activate_forwarding && ! $permit_between_local_networks && ! $ftp_helper_prerouting_defined ; then
|
||||
$ipt -A PREROUTING -t raw -p tcp --dport 21 -j CT --helper ftp
|
||||
ftp_helper_prerouting_defined=true
|
||||
fi
|
||||
|
||||
for _ip in ${ftp_server_only_local_ip_arr[@]} ; do
|
||||
$ipt -A OUTPUT -p tcp -d $_ip --dport 21 --sport $unprivports -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
if ! $permit_between_local_networks ; then
|
||||
$ipt -A FORWARD -p tcp -d $_ip --dport 21 --sport $unprivports -m conntrack --ctstate NEW -j ACCEPT
|
||||
# - (1)
|
||||
# -
|
||||
# - Open FTP connection and add the destination ip (--rdest) to ftpdata recent list 'ftpdata_$i'.
|
||||
# -
|
||||
$ipt -A OUTPUT -p tcp -d $_ip --dport 21 --sport 1024: -m state --state NEW \
|
||||
-m recent --name ftpdata_local_$k --rdest --set -j ACCEPT
|
||||
|
||||
$ipt -A FORWARD -d $_ip -p tcp --dport 21 -m state --state NEW \
|
||||
-m recent --name ftpdata_local_$k --rdest --set -j ACCEPT
|
||||
|
||||
# - (2)
|
||||
# - - Accept packets if the destination ip-address (--rdest) is in the 'ftpdata_$i' list (--update)
|
||||
# - and the destination ip-address was seen within the last 1800 seconds (--seconds 1800).
|
||||
# -
|
||||
# - - If matched, the "last seen" timestamp of the destination address will be updated (--update).
|
||||
# -
|
||||
# - - Entries in the ftpdata list not seen in the last 1800 will be removed (--reap).
|
||||
# -
|
||||
$ipt -A OUTPUT -d $_ip -p tcp -m state --state NEW --dport 1024: \
|
||||
-m recent --name ftpdata_local_$k --rdest --update --seconds 1800 --reap -j ACCEPT
|
||||
|
||||
if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
|
||||
$ipt -A FORWARD -d $_ip -p tcp -m state --state NEW --dport 1024: \
|
||||
-m recent --name ftpdata_local_$k --rdest --update --seconds 1800 --reap -j ACCEPT
|
||||
fi
|
||||
|
||||
if $local_alias_interfaces ; then
|
||||
# - Control Port
|
||||
$ipt -A FORWARD -p tcp -d $_ip --dport 21 --tcp-flag ACK ACK -j ACCEPT
|
||||
$ipt -A FORWARD -p tcp -s $_ip --sport 21 --tcp-flag ACK ACK -j ACCEPT
|
||||
# - Data Port activ
|
||||
$ipt -A FORWARD -p tcp -d $_ip --dport 20 --tcp-flag ACK ACK -j ACCEPT
|
||||
$ipt -A FORWARD -p tcp -s $_ip --sport 20 --tcp-flag ACK ACK -j ACCEPT
|
||||
# - Data Port passiv
|
||||
$ipt -A FORWARD -p tcp -d $_ip --sport $unprivports --dport $unprivports --tcp-flag ACK ACK -j ACCEPT
|
||||
((k++))
|
||||
|
||||
# - Accept (helper ftp) related connections
|
||||
# -
|
||||
$ipt -A OUTPUT -m conntrack --ctstate RELATED -m helper --helper ftp -o $_dev -p tcp --dport 1024: -j ACCEPT
|
||||
$ipt -A INPUT -m conntrack --ctstate RELATED -m helper --helper ftp -i $_dev -p tcp --dport 1024: -j ACCEPT
|
||||
|
||||
if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
|
||||
$ipt -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp -p tcp -d $_ip --dport 1024: -j ACCEPT
|
||||
$ipt -A FORWARD -m conntrack --ctstate RELATED -m helper --helper ftp -p tcp -s $_ip --dport 1024: -j ACCEPT
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
|
||||
#echononl "\t\tFTP Service local Networks"
|
||||
#if [[ ${#ftp_server_only_local_ip_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
|
||||
# for _ip in ${ftp_server_only_local_ip_arr[@]} ; do
|
||||
# $ipt -A OUTPUT -p tcp -d $_ip --dport 21 --sport $unprivports -m conntrack --ctstate NEW -j ACCEPT
|
||||
#
|
||||
# if ! $permit_between_local_networks ; then
|
||||
# $ipt -A FORWARD -p tcp -d $_ip --dport 21 --sport $unprivports -m conntrack --ctstate NEW -j ACCEPT
|
||||
# fi
|
||||
#
|
||||
# if $local_alias_interfaces ; then
|
||||
# # - Control Port
|
||||
# $ipt -A FORWARD -p tcp -d $_ip --dport 21 --tcp-flag ACK ACK -j ACCEPT
|
||||
# $ipt -A FORWARD -p tcp -s $_ip --sport 21 --tcp-flag ACK ACK -j ACCEPT
|
||||
# # - Data Port activ
|
||||
# $ipt -A FORWARD -p tcp -d $_ip --dport 20 --tcp-flag ACK ACK -j ACCEPT
|
||||
# $ipt -A FORWARD -p tcp -s $_ip --sport 20 --tcp-flag ACK ACK -j ACCEPT
|
||||
# # - Data Port passiv
|
||||
# $ipt -A FORWARD -p tcp -d $_ip --sport $unprivports --dport $unprivports --tcp-flag ACK ACK -j ACCEPT
|
||||
# fi
|
||||
# done
|
||||
#
|
||||
# echo_done
|
||||
#else
|
||||
# echo_skipped
|
||||
#fi
|
||||
|
||||
|
||||
# ---
|
||||
# - FTP Services DMZ
|
||||
# ---
|
||||
@ -2812,6 +3146,38 @@ else
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
# - Samba Service only out
|
||||
# ---
|
||||
|
||||
echononl "\t\tSamba Service only out"
|
||||
|
||||
if $allow_samba_requests_out && ! $permit_local_net_to_inet ; then
|
||||
for _dev in ${ext_if_arr[@]} ; do
|
||||
|
||||
for _port in ${samba_udp_ports[@]} ; do
|
||||
$ipt -A OUTPUT -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
for _port in ${samba_tcp_ports[@]} ; do
|
||||
$ipt -A OUTPUT -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
|
||||
if $kernel_activate_forwarding ; then
|
||||
|
||||
for _port in ${samba_udp_ports[@]} ; do
|
||||
$ipt -A FORWARD -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
for _port in ${samba_tcp_ports[@]} ; do
|
||||
$ipt -A FORWARD -o $_dev -p tcp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
done
|
||||
fi
|
||||
done
|
||||
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
# - Samba Service Gateway (only for local Networks)
|
||||
@ -3418,6 +3784,52 @@ else
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
# - Special TCP Ports OUT
|
||||
# ---
|
||||
|
||||
echononl "\t\tSpecial TCP Ports OUT"
|
||||
|
||||
if [[ ${#tcp_out_port_arr[@]} -gt 0 ]] ; then
|
||||
|
||||
for _dev in ${ext_if_arr[@]} ; do
|
||||
for _port in ${tcp_out_port_arr[@]} ; do
|
||||
$ipt -A OUTPUT -o $_dev -p tcp --dport $_port -m state --state NEW -j ACCEPT
|
||||
if $kernel_activate_forwarding ; then
|
||||
$ipt -A FORWARD -o $_dev -p tcp --dport $_port -m state --state NEW -j ACCEPT
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
# - Special UDP Ports OUT
|
||||
# ---
|
||||
|
||||
echononl "\t\tSpecial UDP Ports OUT"
|
||||
|
||||
if [[ ${#udp_out_port_arr[@]} -gt 0 ]] ; then
|
||||
|
||||
for _dev in ${ext_if_arr[@]} ; do
|
||||
for _port in ${udp_out_port_arr[@]} ; do
|
||||
$ipt -A OUTPUT -o $_dev -p udp --dport $_port -m state --state NEW -j ACCEPT
|
||||
if $kernel_activate_forwarding ; then
|
||||
$ipt -A FORWARD -o $_dev -p udp --dport $_port -m state --state NEW -j ACCEPT
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
# - Other local Services
|
||||
# ---
|
||||
@ -3548,12 +3960,14 @@ if [[ ${#pcns_server_ip_arr[@]} -gt 0 ]] && [[ -n "$usv_ip" ]] ; then
|
||||
|
||||
for _ip in ${pcns_server_ip_arr[@]} ; do
|
||||
if containsElement "$_ip" "${gateway_ipv4_address_arr[@]}" ; then
|
||||
$ipt -A OUTPUT -p tcp -s $_ip -d $usv_ip -m multiport --dports $http_ports -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ipt -A INPUT -p tcp -s $usv_ip --dport $pcns_tcp_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ipt -A INPUT -p udp -s $usv_ip --dport $pcns_udp_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ipt -A INPUT -p tcp --dport $pcns_web_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
fi
|
||||
|
||||
if $kernel_activate_forwarding && ! $permit_between_local_networks ; then
|
||||
$ipt -A FORWARD -p tcp -s $_ip -d $usv_ip -m multiport --dports $http_ports -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ipt -A FORWARD -p tcp -s $usv_ip -d $_ip --dport $pcns_tcp_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ipt -A FORWARD -p udp -s $usv_ip -d $_ip --dport $pcns_udp_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
$ipt -A FORWARD -p tcp -d $_ip --dport $pcns_web_port -m conntrack --ctstate NEW -j ACCEPT
|
||||
@ -3573,11 +3987,11 @@ fi
|
||||
|
||||
|
||||
# ---
|
||||
# - Ubiquiti Unifi Controler (Accesspoints) Gateway
|
||||
# - Ubiquiti Unifi Controller Gateway
|
||||
# ---
|
||||
|
||||
|
||||
echononl "\t\tUbiquiti Unifi Controler (Accesspoints) Gateway"
|
||||
echononl "\t\tUbiquiti Unifi Controller Gateway"
|
||||
if $local_unifi_controller_service ; then
|
||||
for _dev in ${local_if_arr[@]} ; do
|
||||
$ipt -A INPUT -p udp -i $_dev -m multiport --dports $unify_broadcast_udp_ports -m conntrack --ctstate NEW -j ACCEPT
|
||||
@ -3592,11 +4006,32 @@ else
|
||||
fi
|
||||
|
||||
|
||||
echononl "\t\tUbiquiti Unifi Controller Gateway - STUN to Unifi APs"
|
||||
if $local_unifi_controller_service ; then
|
||||
|
||||
if [[ ${#unifi_ap_local_ip_arr[@]} -gt 0 ]] ; then
|
||||
|
||||
for _ip_ap in ${unifi_ap_local_ip_arr[@]} ; do
|
||||
|
||||
$ipt -A OUTPUT -p udp -d $_ip_ap -m multiport --sports $unify_udp_ports -m conntrack --ctstate NEW -j ACCEPT
|
||||
|
||||
done
|
||||
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
warn "Local Unifi Controller is defined, but no Unifi APs!"
|
||||
fi
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
# ---
|
||||
# - Ubiquiti Unifi Controler (Accesspoints) local Network
|
||||
# - Ubiquiti Unifi Controller local Network
|
||||
# ---
|
||||
|
||||
echononl "\t\tUbiquiti Unifi Controler (Accesspoints) local Network"
|
||||
echononl "\t\tUbiquiti Unifi Controller local Network"
|
||||
if [[ ${#unify_controller_local_net_ip_arr[@]} -gt 0 ]] \
|
||||
&& $kernel_activate_forwarding \
|
||||
&& ! $permit_between_local_networks ; then
|
||||
|
||||
Reference in New Issue
Block a user