brielle
/
SRFirewall
1
0
Fork 0
Code Issues Pull Requests Releases 1 Wiki Activity

master
bbruns@gmail.com 2014-04-05 22:39:57 +00:00
parent c8e3fdd96e
commit 59056c5d86
4 changed files with 59 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
bin/srfirewall
View File

@ -172,7 +172,7 @@ if [ "${EnableIPv4}" == "yes" ]; then
[ "${DNSClientManualv4Servers}" ] && allow_dnsclient_manual ipv4 "${DNSClientManualv4Servers}"
[ "${Enablev4EasyBlock}" == "yes" ] && enable_easyblock ipv4
[ "${Enablev4Filtering}" == "yes" ] && enable_filtering ipv4
#[ "${Enablev4Forwarding}" == "yes" ] && enable_forwarding ipv4
[ "${Enablev4Forwarding}" == "yes" ] && enable_forwarding ipv4
[ "${Enablev4NAT}" == "yes" ] && enable_nat ipv4
fi
@ -193,7 +193,7 @@ if [ "${EnableIPv6}" == "yes" ]; then
[ "${DNSClientManualv6Servers}" ] && allow_dnsclient_manual ipv6 "${DNSClientManualv6Servers}"
[ "${Enablev6EasyBlock}" == "yes" ] && enable_easyblock ipv6
[ "${Enablev6Filtering}" == "yes" ] && enable_filtering ipv6
#[ "${Enablev6Forwarding}" == "yes" ] && enable_forwarding ipv6
[ "${Enablev6Forwarding}" == "yes" ] && enable_forwarding ipv6
[ "${Enablev6NAT}" == "yes" ] && enable_nat ipv6
fi

6
etc/ipv4.conf
View File

@ -53,6 +53,12 @@ Enablev4EasyBlock="yes"
# Values: no | yes (default)
Enablev4Filtering="yes"
# Enable IPv4 forwarding rules
# This allows you to define forwarding rules
# Config file: ipv4/forward.conf
# Values: No | yes (default)
Enablev4Forwarding="yes"
# Enable IPv4 NAT/NETMAP rules
# This allows you to set up NAT rules, SNAT, MASQ, and NETMAP
# Config file: ipv4/nat.conf

6
etc/ipv6.conf
View File

@ -53,6 +53,12 @@ Enablev6EasyBlock="yes"
# Values: no | yes (default)
Enablev6Filtering="yes"
# Enable IPv6 forwarding rules
# This allows you to define forwarding rules
# Config file: ipv4/forward.conf
# Values: No | yes (default)
Enablev6Forwarding="yes"
# Enable IPv6 NAT/NETMAP rules
# This allows you to set up NAT rules, SNAT, MASQ, and NETMAP
# Config file: ipv4/nat.conf

47
lib/iptables.inc
View File

@ -289,9 +289,9 @@ function enable_filtering {
[[ ${direction} = \#* ]] && continue
[[ ${direction} = "" ]] && continue
([[ ${direction} != "IN" ]] && [[ ${direction} != "OUT" ]]) \
&& ${display} RED "acl.conf: Error - must begin with IN/OUT: ${DEFAULT_COLOR}${direction} ${action} ${interface} ${dstaddress} ${dstport} ${srcaddress} ${srcport} ${protocol}" && continue
&& ${display} RED "acl.conf: Error - must begin with IN/OUT: ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" && continue
([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \
&& ${display} RED "acl.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${direction} ${action} ${interface} ${dstaddress} ${dstport} ${srcaddress} ${srcport} ${protocol}" && continue
&& ${display} RED "acl.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" && continue
# Do some creative work with variables to make building the iptables rules fairly painless
[[ ${dstport} != "-" ]] && dstport="--dport ${dstport}"
@ -320,6 +320,49 @@ function enable_filtering {
fi
}
function enable_forwarding {
IP_VERSION=$1
case $IP_VERSION in
ipv6) VER_IPTABLES=${IP6TABLES};
IPVER="6" ;;
ipv4|*) VER_IPTABLES=${IPTABLES}
IPVER="4" ;;
esac
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading"
if [ -e "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" ]; then
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/forward.conf successful"
while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional; do
[[ ${action} = \#* ]] && continue
[[ ${action} = "" ]] && continue
([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \
&& ${display} RED "acl.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${srcaddress}" && continue
# Do some creative work with variables to make building the iptables rules fairly painless
([[ ${bidirectional} == "yes" ]] && [[ ${srcaddress} != "-" ]]) && revsrcaddress="-d ${srcaddress}"
([[ ${bidirectional} == "yes" ]] && [[ ${dstaddress} != "-" ]]) && revdstaddress="-s ${dstaddress}"
([[ ${bidirectional} == "yes" ]] && [[ ${dstinterface} != "-" ]]) && revdstinterface="-i ${dstinterface}"
([[ ${bidirectional} == "yes" ]] && [[ ${srcinterface} != "-" ]]) && revsrcinterface="-o ${srcinterface}"
[[ ${srcaddress} != "-" ]] && srcaddress="-s ${srcaddress}"
[[ ${dstaddress} != "-" ]] && dstaddress="-d ${dstaddress}"
[[ ${srcinterface} != "-" ]] && srcinterface="-i ${srcinterface}"
[[ ${dstinterface} != "-" ]] && dstinterface="-o ${dstinterface}"
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${srcaddress}"
# Blank variables that we're not going to use.
[[ ${srcinterface} == "-" ]] && srcinterface=""
[[ ${dstinterface} == "-" ]] && dstinterface=""
[[ ${dstaddress} == "-" ]] && dstaddress=""
[[ ${srcaddress} == "-" ]] && srcaddress=""
[[ ${bidirectional} == "-" ]] && bidirectional="no"
${VER_IPTABLES} -A ${FwdFilter} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} -j ${action}
[[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${revsrcinterface} ${revsrcaddress} ${revdstinterface} ${revdstaddress} -j ${action}
done < "${FWCONFIGDIR}/ipv${IPVER}/forward.conf"
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done"
fi
}
function enable_nat {
IP_VERSION=$1
case $IP_VERSION in