qi-hardware/openwrt-xburst
1
0
Fork 0
mirror of git://projects.qi-hardware.com/openwrt-xburst.git synced 2024-11-23 22:34:04 +02:00
Code

[backfire] firewall: backport NAT reflection from trunk

Browse Source 
git-svn-id: svn://svn.openwrt.org/openwrt/branches/backfire@22907 3c298f89-4303-0410-b956-a3cf2f4a3e73
This commit is contained in:
jow 2010-09-04 17:45:13 +00:00
parent e23ef5f491
commit 80f33c889e
2 changed files with 104 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
package/firewall/Makefile
View File

@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=firewall
PKG_VERSION:=1
PKG_RELEASE:=13
PKG_RELEASE:=14
include $(INCLUDE_DIR)/package.mk
@ -43,6 +43,8 @@ define Package/firewall/install
$(INSTALL_BIN) ./files/firewall.init $(1)/etc/init.d/firewall
$(INSTALL_DIR) $(1)/etc/hotplug.d/iface
$(INSTALL_DATA) ./files/20-firewall $(1)/etc/hotplug.d/iface
$(INSTALL_DIR) $(1)/etc/hotplug.d/firewall
$(INSTALL_DATA) ./files/reflection.hotplug $(1)/etc/hotplug.d/firewall/10-nat-reflection
$(INSTALL_DIR) $(1)/etc
$(INSTALL_DATA) ./files/firewall.user $(1)/etc
endef

101
package/firewall/files/reflection.hotplug Normal file
View File

@ -0,0 +1,101 @@
#!/bin/sh
. /etc/functions.sh
if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
local wanip=$(uci -P/var/state get network.wan.ipaddr)
iptables -t nat -F nat_reflection_in 2>/dev/null || {
iptables -t nat -N nat_reflection_in
iptables -t nat -A prerouting_rule -j nat_reflection_in
}
iptables -t nat -F nat_reflection_out 2>/dev/null || {
iptables -t nat -N nat_reflection_out
iptables -t nat -A postrouting_rule -j nat_reflection_out
}
find_networks() {
find_networks_cb() {
local cfg="$1"
local zone="$2"
local name
config_get name "$cfg" name
[ "$name" = "$zone" ] && {
local network
config_get network "$cfg" network
echo ${network:-$zone}
return 1
}
}
config_foreach find_networks_cb zone "$1"
}
setup_fwd() {
local cfg="$1"
local src
config_get src "$cfg" src
[ "$src" = wan ] && {
local dest
config_get dest "$cfg" dest "lan"
local net
for net in $(find_networks "$dest"); do
local lanip=$(uci -P/var/state get network.$net.ipaddr)
local lanmk=$(uci -P/var/state get network.$net.netmask)
local proto
config_get proto "$cfg" proto
local epmin epmax extport
config_get extport "$cfg" src_dport
[ -n "$extport" ] || return
epmin="${extport%[-:]*}"; epmax="${extport#*[-:]}"
[ "$epmin" != "$epmax" ] || epmax=""
local ipmin ipmax intport
config_get intport "$cfg" dest_port "$extport"
ipmin="${intport%[-:]*}"; ipmax="${intport#*[-:]}"
[ "$ipmin" != "$ipmax" ] || ipmax=""
local exthost
config_get exthost "$cfg" src_dip "$wanip"
local inthost
config_get inthost "$cfg" dest_ip
[ -n "$inthost" ] || return
[ "$proto" = tcpudp ] && proto="tcp udp"
local p
for p in ${proto:-tcp udp}; do
case "$p" in
tcp|udp)
iptables -t nat -A nat_reflection_in \
-s $lanip/$lanmk -d $exthost \
-p $p --dport $epmin${epmax:+:$epmax} \
-j DNAT --to $inthost:$ipmin${ipmax:+-$ipmax}
iptables -t nat -A nat_reflection_out \
-s $lanip/$lanmk -d $inthost \
-p $p --dport $ipmin${ipmax:+:$ipmax} \
-j SNAT --to-source $lanip
;;
esac
done
done
}
}
config_load firewall
config_foreach setup_fwd redirect
fi