brielle
/
SRFirewall
1
0
Fork 0
Code Issues Pull Requests Releases 1 Wiki Activity

Beginning work on v2.1

master
Brie Bruns 2014-11-29 11:50:34 -07:00
parent 127230fd38
commit 56af91fc6b
9 changed files with 57 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGELOG
View File

@ -1,3 +1,9 @@
2.1 Alpha 1 - 11/29/2014
- Added support for custom fields in NAT and ACL rules, as this allows
definition of Policy rules in the ACL files (mostly useful for IPSec)
- NAT rules no longer add accept state rules, should be added in forward.conf
manually
2.01 Alpha 1 - 07/27/2014 2.01 Alpha 1 - 07/27/2014
- Fix executable bits on .sh files in custom - Fix executable bits on .sh files in custom
- Make MSS clamp optional and allow setting MSS size manually - Make MSS clamp optional and allow setting MSS size manually

2
bin/srfirewall
View File

@ -19,7 +19,7 @@
# along with this program. If not, see <http://www.gnu.org/licenses/>. # along with this program. If not, see <http://www.gnu.org/licenses/>.
# Static config options, normally do not need to change # Static config options, normally do not need to change
FW_VERSION="2.0" FW_VERSION="2.1a1"
# Important directory locations # Important directory locations
FWPREFIX="/usr/local" FWPREFIX="/usr/local"

7
etc/ipv4/acl.conf
View File

@ -2,7 +2,7 @@
# Use this file to set up more complex access control lists. # Use this file to set up more complex access control lists.
# Use tabs or single space to separate # Use tabs or single space to separate
# #
# <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> <state> # <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> <state> <custom>
# #
# Direction: Required ( IN | OUT ) # Direction: Required ( IN | OUT )
# Action: Required (ACCEPT | DROP) # Action: Required (ACCEPT | DROP)
@ -14,10 +14,13 @@
# Protocol: Optional, Required if port is specified ( tcp | udp ) # Protocol: Optional, Required if port is specified ( tcp | udp )
# Syn: Optional, only match (not) syn packets (syn | notsyn ) # Syn: Optional, only match (not) syn packets (syn | notsyn )
# State: Optional, set the connection tracking states ( comma separated list ) # State: Optional, set the connection tracking states ( comma separated list )
# Custom: Optional, set custom section after the source/dest and before ACCEPT/DROP
# (must surround with quotes)
# You can use '-' for optional fields # You can use '-' for optional fields
#============================================================ #============================================================
#<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> <state> #<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> <state> <custom>
#IN ACCEPT eth0 10.0.0.1 22 - - tcp - #IN ACCEPT eth0 10.0.0.1 22 - - tcp -
#IN DROP - - - - 22 tcp syn #IN DROP - - - - 22 tcp syn
#IN ACCEPT eth0 192.168.0.0/24 - 192.168.1.0/24 - - - "-m policy --dir in --pol ipsec --proto esp"

7
etc/ipv4/forward.conf
View File

@ -2,7 +2,7 @@
# Use this file to set up network address translation rules # Use this file to set up network address translation rules
# Use tabs or single space to separate # Use tabs or single space to separate
# #
# <action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> <state> # <action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> <state> <custom>
# #
# Action: Required ( ACCEPT | DROP ) # Action: Required ( ACCEPT | DROP )
# Source Interface: Optional ( interface name, aka eth0 ) # Source Interface: Optional ( interface name, aka eth0 )
@ -17,13 +17,16 @@
# Protocol: Optional, required if port numbers specified ( tcp | udp ) # Protocol: Optional, required if port numbers specified ( tcp | udp )
# Syn: Optional, only match (not) syn packets (syn | notsyn ) # Syn: Optional, only match (not) syn packets (syn | notsyn )
# State: Optional, set the connection tracking states ( comma separated list ) # State: Optional, set the connection tracking states ( comma separated list )
# Custom: Optional, set custom section after the source/dest and before ACCEPT/DROP
# (must surround with quotes)
# #
# You can use '-' for optional fields # You can use '-' for optional fields
#============================================================ #============================================================
#<action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> <state> #<action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> <state> <custom>
#ACCEPT eth0 - eth1 - yes #ACCEPT eth0 - eth1 - yes
#DROP eth1 192.168.2.0/24 eth0 0/0 no #DROP eth1 192.168.2.0/24 eth0 0/0 no
#DROP eth0 - eth1 192.168.0.0/24 no - 1:1024 tcp syn NEW #DROP eth0 - eth1 192.168.0.0/24 no - 1:1024 tcp syn NEW
#ACCEPT eth1 - eth0 - no - - udp - NEW,ESTABLISHED,RELATED #ACCEPT eth1 - eth0 - no - - udp - NEW,ESTABLISHED,RELATED
#IN ACCEPT eth0 192.168.0.0/24 eth1 192.168.1.0/24 yes - - - - - "-m policy --dir in --pol ipsec --proto esp"

8
etc/ipv4/nat.conf
View File

@ -2,16 +2,18 @@
# Use this file to set up network address translation rules # Use this file to set up network address translation rules
# Use tabs or single space to separate # Use tabs or single space to separate
# #
# <type> <src-interface> <src-address> <dst-interface> <dst-address> # <type> <src-interface> <src-address> <dst-interface> <dst-address> <custom>
# #
# Type: Required ( SNAT | MASQ | NETMAP ) # Type: Required ( SNAT | MASQ | NETMAP | ACCEPT)
# Source Interface: Optional ( interface name, aka eth0 ) # Source Interface: Optional ( interface name, aka eth0 )
# Source Address: Optional ( IP address with optional netmask ) # Source Address: Optional ( IP address with optional netmask )
# Destination Interface: Optional for all but MASQ ( interface name, aka eth0 ) # Destination Interface: Optional for all but MASQ ( interface name, aka eth0 )
# Destination Address: Required for all but MASQ ( IP address with optional netmask ) # Destination Address: Required for all but MASQ ( IP address with optional netmask )
# Custom: Optional, set custom section after the source/dest and before ACCEPT/DROP
# (must surround with quotes)
# You can use '-' for optional fields # You can use '-' for optional fields
#============================================================ #============================================================
#<type> <src-interface> <src-address> <dst-interface> <dst-address> #<type> <src-interface> <src-address> <dst-interface> <dst-address> <custom>
#SNAT eth1 10.0.0.0/24 eth0 172.16.1.1 #SNAT eth1 10.0.0.0/24 eth0 172.16.1.1
#MASQ - - eth0 - #MASQ - - eth0 -
#NETMAP eth1 192.168.0.0/24 vpn0 172.16.10.0/24 #NETMAP eth1 192.168.0.0/24 vpn0 172.16.10.0/24

8
etc/ipv6/acl.conf
View File

@ -2,7 +2,7 @@
# Use this file to set up more complex access control lists. # Use this file to set up more complex access control lists.
# Use tabs or single space to separate # Use tabs or single space to separate
# #
# <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> <state> # <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> <state> <custom>
# #
# Direction: Required ( IN | OUT ) # Direction: Required ( IN | OUT )
# Action: Required (ACCEPT | DROP) # Action: Required (ACCEPT | DROP)
@ -14,10 +14,12 @@
# Protocol: Optional, Required if port is specified ( tcp | udp ) # Protocol: Optional, Required if port is specified ( tcp | udp )
# Syn: Optional, only match (not) syn packets (syn | notsyn ) # Syn: Optional, only match (not) syn packets (syn | notsyn )
# State: Optional, set the connection tracking states ( comma separated list ) # State: Optional, set the connection tracking states ( comma separated list )
# Custom: Optional, set custom section after the source/dest and before ACCEPT/DROP
# (must surround with quotes)
# #
# You can use '-' for optional fields # You can use '-' for optional fields
#============================================================ #============================================================
#<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> <state> #<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn> <state> <custom>
#IN ACCEPT eth0 2002:dead:beef::/64 22 - - tcp - #IN ACCEPT eth0 2002:dead:beef::/64 22 - - tcp -
#IN DROP - - - - 22 tcp syn #IN DROP - - - - 22 tcp syn
#IN ACCEPT eth0 2002:dead:beef::/64 - 2002:dead:bfff::/64 - - - "-m policy --dir in --pol ipsec --proto esp"

9
etc/ipv6/forward.conf
View File

@ -2,7 +2,7 @@
# Use this file to set up network address translation rules # Use this file to set up network address translation rules
# Use tabs or single space to separate # Use tabs or single space to separate
# #
# <action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> <state> # <action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> <state> <custom>
# #
# Action: Required ( ACCEPT | DROP ) # Action: Required ( ACCEPT | DROP )
# Source Interface: Optional ( interface name, aka eth0 ) # Source Interface: Optional ( interface name, aka eth0 )
@ -17,11 +17,14 @@
# Protocol: Optional, required if port numbers specified ( tcp | udp ) # Protocol: Optional, required if port numbers specified ( tcp | udp )
# Syn: Optional, only match (not) syn packets (syn | notsyn ) # Syn: Optional, only match (not) syn packets (syn | notsyn )
# State: Optional, set the connection tracking states ( comma separated list ) # State: Optional, set the connection tracking states ( comma separated list )
# Custom: Optional, set custom section after the source/dest and before ACCEPT/DROP
# (must surround with quotes)
# #
# You can use '-' for optional fields # You can use '-' for optional fields
#============================================================ #============================================================
#<action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> <state> #<action> <src-interface> <src-address> <dst-interface> <dst-address> <bidirectional> <src-port> <dst-port> <protocol> <syn> <state> <custom>
#ACCEPT eth0 - eth1 - yes #ACCEPT eth0 - eth1 - yes
#DROP eth1 2002::/64 eth0 2001::/3 no #DROP eth1 2002::/64 eth0 2001::/3 no
#DROP eth0 2001::/3 eth1 2002:dead:beef::/64 no - 1:1024 tcp syn #DROP eth0 2001::/3 eth1 2002:dead:beef::/64 no - 1:1024 tcp syn
#ACCEPT eth1 - eth0 - no - - udp - NEW,ESTABLISHED,RELATED #ACCEPT eth1 - eth0 - no - - udp - NEW,ESTABLISHED,RELATED
#IN ACCEPT eth0 2002:dead:beef::/64 eth1 2002:dead:bfff::/64 yes - - - - - "-m policy --dir in --pol ipsec --proto esp"

8
etc/ipv6/nat.conf
View File

@ -2,16 +2,18 @@
# Use this file to set up network address translation rules # Use this file to set up network address translation rules
# Use tabs or single space to separate # Use tabs or single space to separate
# #
# <type> <src-interface> <src-address> <dst-interface> <dst-address> # <type> <src-interface> <src-address> <dst-interface> <dst-address> <custom>
# #
# Type: Required ( SNAT | MASQ | NETMAP ) # Type: Required ( SNAT | MASQ | NETMAP | ACCEPT)
# Source Interface: Optional ( interface name, aka eth0 ) # Source Interface: Optional ( interface name, aka eth0 )
# Source Address: Optional ( IP address with optional netmask ) # Source Address: Optional ( IP address with optional netmask )
# Destination Interface: Optional for all but MASQ ( interface name, aka eth0 ) # Destination Interface: Optional for all but MASQ ( interface name, aka eth0 )
# Destination Address: Required for all but MASQ ( IP address with optional netmask ) # Destination Address: Required for all but MASQ ( IP address with optional netmask )
# Custom: Optional, set custom section after the source/dest and before ACCEPT/DROP
# (must surround with quotes)
# You can use '-' for optional fields # You can use '-' for optional fields
#============================================================ #============================================================
#<type> <src-interface> <src-address> <dst-interface> <dst-address> #<type> <src-interface> <src-address> <dst-interface> <dst-address> <custom>
#SNAT eth1 2002::/64 eth0 2001::1 #SNAT eth1 2002::/64 eth0 2001::1
#MASQ - - eth0 - #MASQ - - eth0 -
#NETMAP eth1 2002::/64 vpn0 fc00::/64 #NETMAP eth1 2002::/64 vpn0 fc00::/64

35
lib/iptables.inc
View File

@ -317,7 +317,7 @@ function enable_filtering {
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading"
if [ -e "${FWCONFIGDIR}/ipv${IPVER}/acl.conf" ]; then if [ -e "${FWCONFIGDIR}/ipv${IPVER}/acl.conf" ]; then
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/acl.conf successful" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/acl.conf successful"
while read -r direction action interface srcaddress srcport dstaddress dstport protocol syn state; do while read -r direction action interface srcaddress srcport dstaddress dstport protocol syn state custom; do
[[ ${direction} = \#* ]] && continue [[ ${direction} = \#* ]] && continue
[[ ${direction} = "" ]] && continue [[ ${direction} = "" ]] && continue
([[ ${direction} != "IN" ]] && [[ ${direction} != "OUT" ]]) \ ([[ ${direction} != "IN" ]] && [[ ${direction} != "OUT" ]]) \
@ -343,7 +343,7 @@ function enable_filtering {
[[ ${syn} == "syn" ]] && syn="--syn" [[ ${syn} == "syn" ]] && syn="--syn"
[[ ${syn} == "notsyn" ]] && syn="! --syn" [[ ${syn} == "notsyn" ]] && syn="! --syn"
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol} ${syn}" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol} ${syn} ${custom}"
# Blank variables that we're not going to use. # Blank variables that we're not going to use.
[[ ${interface} == "-" ]] && interface="" [[ ${interface} == "-" ]] && interface=""
@ -353,8 +353,9 @@ function enable_filtering {
[[ ${srcaddress} == "-" ]] && srcaddress="" [[ ${srcaddress} == "-" ]] && srcaddress=""
[[ ${protocol} == "-" ]] && protocol="" [[ ${protocol} == "-" ]] && protocol=""
[[ ${syn} == "-" ]] && syn="" [[ ${syn} == "-" ]] && syn=""
[[ ${custom} == "-" ]] && custom=""
${VER_IPTABLES} -A ${chain} ${interface} ${protocol} ${srcaddress} ${srcport} ${syn} ${dstaddress} ${dstport} ${conntrack_state} -j ${action} ${VER_IPTABLES} -A ${chain} ${interface} ${protocol} ${srcaddress} ${srcport} ${syn} ${dstaddress} ${dstport} ${conntrack_state} ${custom} -j ${action}
done < "${FWCONFIGDIR}/ipv${IPVER}/acl.conf" done < "${FWCONFIGDIR}/ipv${IPVER}/acl.conf"
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done"
fi fi
@ -371,7 +372,7 @@ function enable_forwarding {
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading"
if [ -e "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" ]; then if [ -e "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" ]; then
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/forward.conf successful" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/forward.conf successful"
while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional srcport dstport protocol syn state; do while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional srcport dstport protocol syn state custom; do
unset conntrack_state conntrack_udp_new revsrcaddress revdstaddress revdstinterface revsrcinterface revsrcport revdstport unset conntrack_state conntrack_udp_new revsrcaddress revdstaddress revdstinterface revsrcinterface revsrcport revdstport
[[ ${action} = \#* ]] && continue [[ ${action} = \#* ]] && continue
[[ -z ${action} ]] && continue [[ -z ${action} ]] && continue
@ -425,9 +426,10 @@ function enable_forwarding {
[[ ${state} == "-" ]] && state="" [[ ${state} == "-" ]] && state=""
[[ ${protocol} == "-" ]] && protocol="" [[ ${protocol} == "-" ]] && protocol=""
[[ ${bidirectional} == "-" ]] && bidirectional="no" [[ ${bidirectional} == "-" ]] && bidirectional="no"
[[ ${custom} == "-" ]] && custom=""
${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${srcinterface} ${srcaddress} ${srcport} ${syn} ${dstinterface} ${dstaddress} ${dstport} ${conntrack_state} -j ${action} ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${srcinterface} ${srcaddress} ${srcport} ${syn} ${dstinterface} ${dstaddress} ${dstport} ${conntrack_state} ${custom} -j ${action}
[[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${revsrcinterface} ${revsrcaddress} ${revsrcport} ${syn} ${revdstinterface} ${revdstaddress} ${revdstport} ${conntrack_state} -j ${action} [[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${protocol} ${revsrcinterface} ${revsrcaddress} ${revsrcport} ${syn} ${revdstinterface} ${revdstaddress} ${revdstport} ${conntrack_state} ${custom} -j ${action}
done < "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" done < "${FWCONFIGDIR}/ipv${IPVER}/forward.conf"
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done"
fi fi
@ -447,16 +449,16 @@ function enable_nat {
if [ -e "${FWCONFIGDIR}/ipv${IPVER}/nat.conf" ]; then if [ -e "${FWCONFIGDIR}/ipv${IPVER}/nat.conf" ]; then
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/nat.conf successful" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/nat.conf successful"
while read -r type srcinterface srcaddress dstinterface dstaddress; do while read -r type srcinterface srcaddress dstinterface dstaddress custom; do
[[ ${type} = \#* ]] && continue [[ ${type} = \#* ]] && continue
[[ ${type} = "" ]] && continue [[ ${type} = "" ]] && continue
([[ ${type} != "SNAT" ]] && [[ ${type} != "MASQ" ]] && [[ ${type} != "NETMAP" ]]) \ ([[ ${type} != "SNAT" ]] && [[ ${type} != "MASQ" ]] && [[ ${type} != "NETMAP" ]] && [[ ${type} != "ACCEPT") \
&& ${display} RED "nat.conf: Error - must begin with SNAT/MASQ/NETMAP: ${DEFAULT_COLOR}${type} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress}" && continue && ${display} RED "nat.conf: Error - must begin with SNAT/MASQ/NETMAP/ACCEPT: ${DEFAULT_COLOR}${type} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} ${custom}" && continue
# Do some creative work with variables to make building the iptables rules fairly painless # Do some creative work with variables to make building the iptables rules fairly painless
[[ ${srcaddress} != "-" ]] && revsrcaddress="-d ${srcaddress}" #[[ ${srcaddress} != "-" ]] && revsrcaddress="-d ${srcaddress}"
[[ ${dstinterface} != "-" ]] && revdstinterface="-i ${dstinterface}" #[[ ${dstinterface} != "-" ]] && revdstinterface="-i ${dstinterface}"
[[ ${srcinterface} != "-" ]] && revsrcinterface="-o ${srcinterface}" #[[ ${srcinterface} != "-" ]] && revsrcinterface="-o ${srcinterface}"
[[ ${srcinterface} != "-" ]] && srcinterface="-i ${srcinterface}" [[ ${srcinterface} != "-" ]] && srcinterface="-i ${srcinterface}"
[[ ${dstinterface} != "-" ]] && dstinterface="-o ${dstinterface}" [[ ${dstinterface} != "-" ]] && dstinterface="-o ${dstinterface}"
([[ ${srcaddress} != "-" ]] && [[ ${type} != "NETMAP" ]]) && srcaddress="-s ${srcaddress}" ([[ ${srcaddress} != "-" ]] && [[ ${type} != "NETMAP" ]]) && srcaddress="-s ${srcaddress}"
@ -474,17 +476,18 @@ function enable_nat {
([[ ${srcaddress} != "-" ]] && [[ ${dstaddress} != "-" ]] && [[ ${type} == "NETMAP" ]]) && action="-j NETMAP" && srcaddress="-d ${srcaddress}" && dstaddress="--to ${dstaddress}" ([[ ${srcaddress} != "-" ]] && [[ ${dstaddress} != "-" ]] && [[ ${type} == "NETMAP" ]]) && action="-j NETMAP" && srcaddress="-d ${srcaddress}" && dstaddress="--to ${dstaddress}"
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol} ${custom}"
# Blank variables that we're not going to use. # Blank variables that we're not going to use.
[[ ${srcinterface} == "-" ]] && srcinterface="" [[ ${srcinterface} == "-" ]] && srcinterface=""
[[ ${dstinterface} == "-" ]] && dstinterface="" [[ ${dstinterface} == "-" ]] && dstinterface=""
[[ ${dstaddress} == "-" ]] && dstaddress="" [[ ${dstaddress} == "-" ]] && dstaddress=""
[[ ${srcaddress} == "-" ]] && srcaddress="" [[ ${srcaddress} == "-" ]] && srcaddress=""
[[ ${custom} == "-" ]] && custom=""
${VER_IPTABLES} -A ${NAT} -t nat ${srcaddress} ${action} ${dstinterface} ${dstaddress} ${VER_IPTABLES} -A ${NAT} -t nat ${srcaddress} ${dstinterface} ${dstaddress} ${custom} ${action}
${VER_IPTABLES} -A ${FwdFilter} ${M_STATE} ${C_STATE} RELATED,ESTABLISHED,NEW ${srcinterface} ${srcaddress} ${dstinterface} -j ACCEPT #${VER_IPTABLES} -A ${FwdFilter} ${M_STATE} ${C_STATE} RELATED,ESTABLISHED,NEW ${srcinterface} ${srcaddress} ${dstinterface} -j ACCEPT
${VER_IPTABLES} -A ${FwdFilter} ${M_STATE} ${C_STATE} RELATED,ESTABLISHED ${revsrcinterface} ${revsrcaddress} ${revdstinterface} -j ACCEPT #${VER_IPTABLES} -A ${FwdFilter} ${M_STATE} ${C_STATE} RELATED,ESTABLISHED ${revsrcinterface} ${revsrcaddress} ${revdstinterface} -j ACCEPT
done < "${FWCONFIGDIR}/ipv${IPVER}/nat.conf" done < "${FWCONFIGDIR}/ipv${IPVER}/nat.conf"
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done"
fi fi