mirror of
git://projects.qi-hardware.com/openwrt-xburst.git
synced 2024-10-02 17:30:43 +03:00
[package] firewall: properly handle negated ports in nat reflection
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27334 3c298f89-4303-0410-b956-a3cf2f4a3e73
This commit is contained in:
parent
9d43dbd716
commit
9179216cd8
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
|
|||||||
PKG_NAME:=firewall
|
PKG_NAME:=firewall
|
||||||
|
|
||||||
PKG_VERSION:=2
|
PKG_VERSION:=2
|
||||||
PKG_RELEASE:=27
|
PKG_RELEASE:=28
|
||||||
|
|
||||||
include $(INCLUDE_DIR)/package.mk
|
include $(INCLUDE_DIR)/package.mk
|
||||||
|
|
||||||
|
@ -91,23 +91,31 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
|
|||||||
[ "${inthost#!}" = "$inthost" ] || return 0
|
[ "${inthost#!}" = "$inthost" ] || return 0
|
||||||
[ "${exthost#!}" = "$exthost" ] || return 0
|
[ "${exthost#!}" = "$exthost" ] || return 0
|
||||||
|
|
||||||
|
[ "${epmin#!}" != "$epmin" ] && \
|
||||||
|
extport="! --dport ${epmin#!}${epmax:+:$epmax}" || \
|
||||||
|
extport="--dport $epmin${epmax:+:$epmax}"
|
||||||
|
|
||||||
|
[ "${ipmin#!}" != "$ipmin" ] && \
|
||||||
|
intport="! --dport ${ipmin#!}${ipmax:+:$ipmax}" || \
|
||||||
|
intport="--dport $ipmin${ipmax:+:$ipmax}"
|
||||||
|
|
||||||
local p
|
local p
|
||||||
for p in ${proto:-tcp udp}; do
|
for p in ${proto:-tcp udp}; do
|
||||||
case "$p" in
|
case "$p" in
|
||||||
tcp|udp)
|
tcp|udp)
|
||||||
iptables -t nat -A nat_reflection_in \
|
iptables -t nat -A nat_reflection_in \
|
||||||
-s $lanip/$lanmk -d $exthost \
|
-s $lanip/$lanmk -d $exthost \
|
||||||
-p $p --dport $epmin${epmax:+:$epmax} \
|
-p $p $extport \
|
||||||
-j DNAT --to $inthost:$ipmin${ipmax:+-$ipmax}
|
-j DNAT --to $inthost:${ipmin#!}${ipmax:+-$ipmax}
|
||||||
|
|
||||||
iptables -t nat -A nat_reflection_out \
|
iptables -t nat -A nat_reflection_out \
|
||||||
-s $lanip/$lanmk -d $inthost \
|
-s $lanip/$lanmk -d $inthost \
|
||||||
-p $p --dport $ipmin${ipmax:+:$ipmax} \
|
-p $p $intport \
|
||||||
-j SNAT --to-source $lanip
|
-j SNAT --to-source $lanip
|
||||||
|
|
||||||
iptables -t filter -A nat_reflection_fwd \
|
iptables -t filter -A nat_reflection_fwd \
|
||||||
-s $lanip/$lanmk -d $inthost \
|
-s $lanip/$lanmk -d $inthost \
|
||||||
-p $p --dport $ipmin${ipmax:+:$ipmax} \
|
-p $p $intport \
|
||||||
-j ACCEPT
|
-j ACCEPT
|
||||||
;;
|
;;
|
||||||
esac
|
esac
|
||||||
|
Loading…
Reference in New Issue
Block a user