1
0
mirror of git://projects.qi-hardware.com/openwrt-xburst.git synced 2024-12-24 19:49:54 +02:00

[package] firewall: also establish forward rules when setting up nat reflection, back out early if reflection is disabled

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23201 3c298f89-4303-0410-b956-a3cf2f4a3e73
This commit is contained in:
jow 2010-10-03 18:11:59 +00:00
parent 8c5fdf2ae8
commit b592e5c373
2 changed files with 16 additions and 7 deletions

View File

@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=firewall PKG_NAME:=firewall
PKG_VERSION:=2 PKG_VERSION:=2
PKG_RELEASE:=18 PKG_RELEASE:=19
include $(INCLUDE_DIR)/package.mk include $(INCLUDE_DIR)/package.mk

View File

@ -15,6 +15,11 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
iptables -t nat -A postrouting_rule -j nat_reflection_out iptables -t nat -A postrouting_rule -j nat_reflection_out
} }
iptables -t filter -F nat_reflection_fwd 2>/dev/null || {
iptables -t filter -N nat_reflection_fwd
iptables -t filter -A forwarding_rule -j nat_reflection_fwd
}
find_networks() { find_networks() {
find_networks_cb() { find_networks_cb() {
local cfg="$1" local cfg="$1"
@ -34,10 +39,14 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
config_foreach find_networks_cb zone "$1" config_foreach find_networks_cb zone "$1"
} }
setup_fwd() { setup_fwd() {
local cfg="$1" local cfg="$1"
local reflection
config_get_bool reflection "$cfg" reflection 1
[ "$reflection" == 1 ] || return
local src local src
config_get src "$cfg" src config_get src "$cfg" src
@ -56,10 +65,6 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
local proto local proto
config_get proto "$cfg" proto config_get proto "$cfg" proto
local reflection
config_get_bool reflection "$cfg" reflection 1
[ "$reflection" == 1 ] || return
local epmin epmax extport local epmin epmax extport
config_get extport "$cfg" src_dport config_get extport "$cfg" src_dport
[ -n "$extport" ] || return [ -n "$extport" ] || return
@ -98,6 +103,11 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
-s $lanip/$lanmk -d $inthost \ -s $lanip/$lanmk -d $inthost \
-p $p --dport $ipmin${ipmax:+:$ipmax} \ -p $p --dport $ipmin${ipmax:+:$ipmax} \
-j SNAT --to-source $lanip -j SNAT --to-source $lanip
iptables -t filter -A nat_reflection_fwd \
-s $lanip/$lanmk -d $inthost \
-p $p --dport $ipmin${ipmax:+:$ipmax} \
-j ACCEPT
;; ;;
esac esac
done done
@ -108,4 +118,3 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
config_load firewall config_load firewall
config_foreach setup_fwd redirect config_foreach setup_fwd redirect
fi fi