master
parent
c8e3fdd96e
commit
59056c5d86
|
@ -172,7 +172,7 @@ if [ "${EnableIPv4}" == "yes" ]; then
|
||||||
[ "${DNSClientManualv4Servers}" ] && allow_dnsclient_manual ipv4 "${DNSClientManualv4Servers}"
|
[ "${DNSClientManualv4Servers}" ] && allow_dnsclient_manual ipv4 "${DNSClientManualv4Servers}"
|
||||||
[ "${Enablev4EasyBlock}" == "yes" ] && enable_easyblock ipv4
|
[ "${Enablev4EasyBlock}" == "yes" ] && enable_easyblock ipv4
|
||||||
[ "${Enablev4Filtering}" == "yes" ] && enable_filtering ipv4
|
[ "${Enablev4Filtering}" == "yes" ] && enable_filtering ipv4
|
||||||
#[ "${Enablev4Forwarding}" == "yes" ] && enable_forwarding ipv4
|
[ "${Enablev4Forwarding}" == "yes" ] && enable_forwarding ipv4
|
||||||
[ "${Enablev4NAT}" == "yes" ] && enable_nat ipv4
|
[ "${Enablev4NAT}" == "yes" ] && enable_nat ipv4
|
||||||
|
|
||||||
fi
|
fi
|
||||||
|
@ -193,7 +193,7 @@ if [ "${EnableIPv6}" == "yes" ]; then
|
||||||
[ "${DNSClientManualv6Servers}" ] && allow_dnsclient_manual ipv6 "${DNSClientManualv6Servers}"
|
[ "${DNSClientManualv6Servers}" ] && allow_dnsclient_manual ipv6 "${DNSClientManualv6Servers}"
|
||||||
[ "${Enablev6EasyBlock}" == "yes" ] && enable_easyblock ipv6
|
[ "${Enablev6EasyBlock}" == "yes" ] && enable_easyblock ipv6
|
||||||
[ "${Enablev6Filtering}" == "yes" ] && enable_filtering ipv6
|
[ "${Enablev6Filtering}" == "yes" ] && enable_filtering ipv6
|
||||||
#[ "${Enablev6Forwarding}" == "yes" ] && enable_forwarding ipv6
|
[ "${Enablev6Forwarding}" == "yes" ] && enable_forwarding ipv6
|
||||||
[ "${Enablev6NAT}" == "yes" ] && enable_nat ipv6
|
[ "${Enablev6NAT}" == "yes" ] && enable_nat ipv6
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
|
|
@ -53,6 +53,12 @@ Enablev4EasyBlock="yes"
|
||||||
# Values: no | yes (default)
|
# Values: no | yes (default)
|
||||||
Enablev4Filtering="yes"
|
Enablev4Filtering="yes"
|
||||||
|
|
||||||
|
# Enable IPv4 forwarding rules
|
||||||
|
# This allows you to define forwarding rules
|
||||||
|
# Config file: ipv4/forward.conf
|
||||||
|
# Values: No | yes (default)
|
||||||
|
Enablev4Forwarding="yes"
|
||||||
|
|
||||||
# Enable IPv4 NAT/NETMAP rules
|
# Enable IPv4 NAT/NETMAP rules
|
||||||
# This allows you to set up NAT rules, SNAT, MASQ, and NETMAP
|
# This allows you to set up NAT rules, SNAT, MASQ, and NETMAP
|
||||||
# Config file: ipv4/nat.conf
|
# Config file: ipv4/nat.conf
|
||||||
|
|
|
@ -53,6 +53,12 @@ Enablev6EasyBlock="yes"
|
||||||
# Values: no | yes (default)
|
# Values: no | yes (default)
|
||||||
Enablev6Filtering="yes"
|
Enablev6Filtering="yes"
|
||||||
|
|
||||||
|
# Enable IPv6 forwarding rules
|
||||||
|
# This allows you to define forwarding rules
|
||||||
|
# Config file: ipv4/forward.conf
|
||||||
|
# Values: No | yes (default)
|
||||||
|
Enablev6Forwarding="yes"
|
||||||
|
|
||||||
# Enable IPv6 NAT/NETMAP rules
|
# Enable IPv6 NAT/NETMAP rules
|
||||||
# This allows you to set up NAT rules, SNAT, MASQ, and NETMAP
|
# This allows you to set up NAT rules, SNAT, MASQ, and NETMAP
|
||||||
# Config file: ipv4/nat.conf
|
# Config file: ipv4/nat.conf
|
||||||
|
|
|
@ -289,9 +289,9 @@ function enable_filtering {
|
||||||
[[ ${direction} = \#* ]] && continue
|
[[ ${direction} = \#* ]] && continue
|
||||||
[[ ${direction} = "" ]] && continue
|
[[ ${direction} = "" ]] && continue
|
||||||
([[ ${direction} != "IN" ]] && [[ ${direction} != "OUT" ]]) \
|
([[ ${direction} != "IN" ]] && [[ ${direction} != "OUT" ]]) \
|
||||||
&& ${display} RED "acl.conf: Error - must begin with IN/OUT: ${DEFAULT_COLOR}${direction} ${action} ${interface} ${dstaddress} ${dstport} ${srcaddress} ${srcport} ${protocol}" && continue
|
&& ${display} RED "acl.conf: Error - must begin with IN/OUT: ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" && continue
|
||||||
([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \
|
([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \
|
||||||
&& ${display} RED "acl.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${direction} ${action} ${interface} ${dstaddress} ${dstport} ${srcaddress} ${srcport} ${protocol}" && continue
|
&& ${display} RED "acl.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" && continue
|
||||||
|
|
||||||
# Do some creative work with variables to make building the iptables rules fairly painless
|
# Do some creative work with variables to make building the iptables rules fairly painless
|
||||||
[[ ${dstport} != "-" ]] && dstport="--dport ${dstport}"
|
[[ ${dstport} != "-" ]] && dstport="--dport ${dstport}"
|
||||||
|
@ -320,6 +320,49 @@ function enable_filtering {
|
||||||
fi
|
fi
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function enable_forwarding {
|
||||||
|
IP_VERSION=$1
|
||||||
|
case $IP_VERSION in
|
||||||
|
ipv6) VER_IPTABLES=${IP6TABLES};
|
||||||
|
IPVER="6" ;;
|
||||||
|
ipv4|*) VER_IPTABLES=${IPTABLES}
|
||||||
|
IPVER="4" ;;
|
||||||
|
esac
|
||||||
|
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading"
|
||||||
|
if [ -e "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" ]; then
|
||||||
|
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/forward.conf successful"
|
||||||
|
while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional; do
|
||||||
|
[[ ${action} = \#* ]] && continue
|
||||||
|
[[ ${action} = "" ]] && continue
|
||||||
|
([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \
|
||||||
|
&& ${display} RED "acl.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${srcaddress}" && continue
|
||||||
|
|
||||||
|
# Do some creative work with variables to make building the iptables rules fairly painless
|
||||||
|
([[ ${bidirectional} == "yes" ]] && [[ ${srcaddress} != "-" ]]) && revsrcaddress="-d ${srcaddress}"
|
||||||
|
([[ ${bidirectional} == "yes" ]] && [[ ${dstaddress} != "-" ]]) && revdstaddress="-s ${dstaddress}"
|
||||||
|
([[ ${bidirectional} == "yes" ]] && [[ ${dstinterface} != "-" ]]) && revdstinterface="-i ${dstinterface}"
|
||||||
|
([[ ${bidirectional} == "yes" ]] && [[ ${srcinterface} != "-" ]]) && revsrcinterface="-o ${srcinterface}"
|
||||||
|
[[ ${srcaddress} != "-" ]] && srcaddress="-s ${srcaddress}"
|
||||||
|
[[ ${dstaddress} != "-" ]] && dstaddress="-d ${dstaddress}"
|
||||||
|
[[ ${srcinterface} != "-" ]] && srcinterface="-i ${srcinterface}"
|
||||||
|
[[ ${dstinterface} != "-" ]] && dstinterface="-o ${dstinterface}"
|
||||||
|
|
||||||
|
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${srcaddress}"
|
||||||
|
|
||||||
|
# Blank variables that we're not going to use.
|
||||||
|
[[ ${srcinterface} == "-" ]] && srcinterface=""
|
||||||
|
[[ ${dstinterface} == "-" ]] && dstinterface=""
|
||||||
|
[[ ${dstaddress} == "-" ]] && dstaddress=""
|
||||||
|
[[ ${srcaddress} == "-" ]] && srcaddress=""
|
||||||
|
[[ ${bidirectional} == "-" ]] && bidirectional="no"
|
||||||
|
|
||||||
|
${VER_IPTABLES} -A ${FwdFilter} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} -j ${action}
|
||||||
|
[[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${revsrcinterface} ${revsrcaddress} ${revdstinterface} ${revdstaddress} -j ${action}
|
||||||
|
done < "${FWCONFIGDIR}/ipv${IPVER}/forward.conf"
|
||||||
|
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
function enable_nat {
|
function enable_nat {
|
||||||
IP_VERSION=$1
|
IP_VERSION=$1
|
||||||
case $IP_VERSION in
|
case $IP_VERSION in
|
||||||
|
|
Loading…
Reference in New Issue