bin/srfirewall

@@ -172,7 +172,7 @@ if [ "${EnableIPv4}" == "yes" ]; then
 	[ "${DNSClientManualv4Servers}" ] && allow_dnsclient_manual ipv4 "${DNSClientManualv4Servers}"
 	[ "${Enablev4EasyBlock}" == "yes" ] && enable_easyblock ipv4
 	[ "${Enablev4Filtering}" == "yes" ] && enable_filtering ipv4
-	#[ "${Enablev4Forwarding}" == "yes" ] && enable_forwarding ipv4
+	[ "${Enablev4Forwarding}" == "yes" ] && enable_forwarding ipv4
 	[ "${Enablev4NAT}" == "yes" ] && enable_nat ipv4
 	
 fi
@@ -193,7 +193,7 @@ if [ "${EnableIPv6}" == "yes" ]; then
 	[ "${DNSClientManualv6Servers}" ] && allow_dnsclient_manual ipv6 "${DNSClientManualv6Servers}"
 	[ "${Enablev6EasyBlock}" == "yes" ] && enable_easyblock ipv6
 	[ "${Enablev6Filtering}" == "yes" ] && enable_filtering ipv6
-	#[ "${Enablev6Forwarding}" == "yes" ] && enable_forwarding ipv6
+	[ "${Enablev6Forwarding}" == "yes" ] && enable_forwarding ipv6
 	[ "${Enablev6NAT}" == "yes" ] && enable_nat ipv6
 fi
 

etc/ipv4.conf

@@ -53,6 +53,12 @@ Enablev4EasyBlock="yes"
 # Values: no | yes (default)
 Enablev4Filtering="yes"
 
+# Enable IPv4 forwarding rules
+# This allows you to define forwarding rules
+# Config file: ipv4/forward.conf
+# Values: No | yes (default)
+Enablev4Forwarding="yes"
+
 # Enable IPv4 NAT/NETMAP rules
 # This allows you to set up NAT rules, SNAT, MASQ, and NETMAP
 # Config file: ipv4/nat.conf

etc/ipv6.conf

@@ -53,6 +53,12 @@ Enablev6EasyBlock="yes"
 # Values: no | yes (default)
 Enablev6Filtering="yes"
 
+# Enable IPv6 forwarding rules
+# This allows you to define forwarding rules
+# Config file: ipv4/forward.conf
+# Values: No | yes (default)
+Enablev6Forwarding="yes"
+
 # Enable IPv6 NAT/NETMAP rules
 # This allows you to set up NAT rules, SNAT, MASQ, and NETMAP
 # Config file: ipv4/nat.conf

lib/iptables.inc

@@ -289,9 +289,9 @@ function enable_filtering {
 			[[ ${direction} = \#* ]] && continue
 			[[ ${direction} = "" ]] && continue
 			([[ ${direction} != "IN" ]] && [[ ${direction} != "OUT" ]]) \
-					&& ${display} RED "acl.conf: Error - must begin with IN/OUT: ${DEFAULT_COLOR}${direction} ${action} ${interface} ${dstaddress} ${dstport} ${srcaddress} ${srcport} ${protocol}" && continue
+					&& ${display} RED "acl.conf: Error - must begin with IN/OUT: ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" && continue
 			([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \
-					&& ${display} RED "acl.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${direction} ${action} ${interface} ${dstaddress} ${dstport} ${srcaddress} ${srcport} ${protocol}" && continue
+					&& ${display} RED "acl.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" && continue
 
 			# Do some creative work with variables to make building the iptables rules fairly painless
 			[[ ${dstport} != "-" ]] && dstport="--dport ${dstport}"
@@ -320,6 +320,49 @@ function enable_filtering {
 	fi
 }
 
+function enable_forwarding {
+	IP_VERSION=$1
+		case $IP_VERSION in
+		ipv6) VER_IPTABLES=${IP6TABLES};
+				IPVER="6" ;;
+		ipv4|*) VER_IPTABLES=${IPTABLES}
+				IPVER="4" ;;
+	esac
+	${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading"
+	if [ -e "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" ]; then
+		${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/forward.conf successful"
+		while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional; do
+			[[ ${action} = \#* ]] && continue
+			[[ ${action} = "" ]] && continue
+			([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \
+					&& ${display} RED "acl.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${srcaddress}" && continue
+
+			# Do some creative work with variables to make building the iptables rules fairly painless
+			([[ ${bidirectional} == "yes" ]] && [[ ${srcaddress} != "-" ]]) && revsrcaddress="-d ${srcaddress}"
+			([[ ${bidirectional} == "yes" ]] && [[ ${dstaddress} != "-" ]]) && revdstaddress="-s ${dstaddress}"
+			([[ ${bidirectional} == "yes" ]] && [[ ${dstinterface} != "-" ]]) && revdstinterface="-i ${dstinterface}"
+			([[ ${bidirectional} == "yes" ]] && [[ ${srcinterface} != "-" ]]) && revsrcinterface="-o ${srcinterface}"
+			[[ ${srcaddress} != "-" ]] && srcaddress="-s ${srcaddress}"
+			[[ ${dstaddress} != "-" ]] && dstaddress="-d ${dstaddress}"
+			[[ ${srcinterface} != "-" ]] && srcinterface="-i ${srcinterface}"
+			[[ ${dstinterface} != "-" ]] && dstinterface="-o ${dstinterface}"
+			
+			${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${srcaddress}"
+			
+			# Blank variables that we're not going to use.
+			[[ ${srcinterface} == "-" ]] && srcinterface=""
+			[[ ${dstinterface} == "-" ]] && dstinterface=""
+			[[ ${dstaddress} == "-" ]] && dstaddress=""
+			[[ ${srcaddress} == "-" ]] && srcaddress=""
+			[[ ${bidirectional} == "-" ]] && bidirectional="no"
+			
+			${VER_IPTABLES} -A ${FwdFilter} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} -j ${action}
+			[[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${revsrcinterface} ${revsrcaddress} ${revdstinterface} ${revdstaddress} -j ${action}
+		done < "${FWCONFIGDIR}/ipv${IPVER}/forward.conf"
+		${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done"
+	fi
+}
+
 function enable_nat {
 	IP_VERSION=$1
 		case $IP_VERSION in