From 59056c5d86dbaa834f5354ab5c52a7ed360887f1 Mon Sep 17 00:00:00 2001 From: "bbruns@gmail.com" Date: Sat, 5 Apr 2014 22:39:57 +0000 Subject: [PATCH] --- bin/srfirewall | 4 ++-- etc/ipv4.conf | 6 ++++++ etc/ipv6.conf | 6 ++++++ lib/iptables.inc | 47 +++++++++++++++++++++++++++++++++++++++++++++-- 4 files changed, 59 insertions(+), 4 deletions(-) diff --git a/bin/srfirewall b/bin/srfirewall index fa780b0..8fbe195 100755 --- a/bin/srfirewall +++ b/bin/srfirewall @@ -172,7 +172,7 @@ if [ "${EnableIPv4}" == "yes" ]; then [ "${DNSClientManualv4Servers}" ] && allow_dnsclient_manual ipv4 "${DNSClientManualv4Servers}" [ "${Enablev4EasyBlock}" == "yes" ] && enable_easyblock ipv4 [ "${Enablev4Filtering}" == "yes" ] && enable_filtering ipv4 - #[ "${Enablev4Forwarding}" == "yes" ] && enable_forwarding ipv4 + [ "${Enablev4Forwarding}" == "yes" ] && enable_forwarding ipv4 [ "${Enablev4NAT}" == "yes" ] && enable_nat ipv4 fi @@ -193,7 +193,7 @@ if [ "${EnableIPv6}" == "yes" ]; then [ "${DNSClientManualv6Servers}" ] && allow_dnsclient_manual ipv6 "${DNSClientManualv6Servers}" [ "${Enablev6EasyBlock}" == "yes" ] && enable_easyblock ipv6 [ "${Enablev6Filtering}" == "yes" ] && enable_filtering ipv6 - #[ "${Enablev6Forwarding}" == "yes" ] && enable_forwarding ipv6 + [ "${Enablev6Forwarding}" == "yes" ] && enable_forwarding ipv6 [ "${Enablev6NAT}" == "yes" ] && enable_nat ipv6 fi diff --git a/etc/ipv4.conf b/etc/ipv4.conf index 9ea5a98..c72893b 100644 --- a/etc/ipv4.conf +++ b/etc/ipv4.conf @@ -53,6 +53,12 @@ Enablev4EasyBlock="yes" # Values: no | yes (default) Enablev4Filtering="yes" +# Enable IPv4 forwarding rules +# This allows you to define forwarding rules +# Config file: ipv4/forward.conf +# Values: No | yes (default) +Enablev4Forwarding="yes" + # Enable IPv4 NAT/NETMAP rules # This allows you to set up NAT rules, SNAT, MASQ, and NETMAP # Config file: ipv4/nat.conf diff --git a/etc/ipv6.conf b/etc/ipv6.conf index 4fe0378..a9c5821 100644 --- a/etc/ipv6.conf +++ b/etc/ipv6.conf @@ -53,6 +53,12 @@ Enablev6EasyBlock="yes" # Values: no | yes (default) Enablev6Filtering="yes" +# Enable IPv6 forwarding rules +# This allows you to define forwarding rules +# Config file: ipv4/forward.conf +# Values: No | yes (default) +Enablev6Forwarding="yes" + # Enable IPv6 NAT/NETMAP rules # This allows you to set up NAT rules, SNAT, MASQ, and NETMAP # Config file: ipv4/nat.conf diff --git a/lib/iptables.inc b/lib/iptables.inc index edd3c26..ff24dae 100644 --- a/lib/iptables.inc +++ b/lib/iptables.inc @@ -289,9 +289,9 @@ function enable_filtering { [[ ${direction} = \#* ]] && continue [[ ${direction} = "" ]] && continue ([[ ${direction} != "IN" ]] && [[ ${direction} != "OUT" ]]) \ - && ${display} RED "acl.conf: Error - must begin with IN/OUT: ${DEFAULT_COLOR}${direction} ${action} ${interface} ${dstaddress} ${dstport} ${srcaddress} ${srcport} ${protocol}" && continue + && ${display} RED "acl.conf: Error - must begin with IN/OUT: ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" && continue ([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \ - && ${display} RED "acl.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${direction} ${action} ${interface} ${dstaddress} ${dstport} ${srcaddress} ${srcport} ${protocol}" && continue + && ${display} RED "acl.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" && continue # Do some creative work with variables to make building the iptables rules fairly painless [[ ${dstport} != "-" ]] && dstport="--dport ${dstport}" @@ -320,6 +320,49 @@ function enable_filtering { fi } +function enable_forwarding { + IP_VERSION=$1 + case $IP_VERSION in + ipv6) VER_IPTABLES=${IP6TABLES}; + IPVER="6" ;; + ipv4|*) VER_IPTABLES=${IPTABLES} + IPVER="4" ;; + esac + ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading" + if [ -e "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" ]; then + ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/forward.conf successful" + while read -r action srcinterface srcaddress dstinterface dstaddress bidirectional; do + [[ ${action} = \#* ]] && continue + [[ ${action} = "" ]] && continue + ([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]]) \ + && ${display} RED "acl.conf: Error - action must be either ACCEPT or DROP : ${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${srcaddress}" && continue + + # Do some creative work with variables to make building the iptables rules fairly painless + ([[ ${bidirectional} == "yes" ]] && [[ ${srcaddress} != "-" ]]) && revsrcaddress="-d ${srcaddress}" + ([[ ${bidirectional} == "yes" ]] && [[ ${dstaddress} != "-" ]]) && revdstaddress="-s ${dstaddress}" + ([[ ${bidirectional} == "yes" ]] && [[ ${dstinterface} != "-" ]]) && revdstinterface="-i ${dstinterface}" + ([[ ${bidirectional} == "yes" ]] && [[ ${srcinterface} != "-" ]]) && revsrcinterface="-o ${srcinterface}" + [[ ${srcaddress} != "-" ]] && srcaddress="-s ${srcaddress}" + [[ ${dstaddress} != "-" ]] && dstaddress="-d ${dstaddress}" + [[ ${srcinterface} != "-" ]] && srcinterface="-i ${srcinterface}" + [[ ${dstinterface} != "-" ]] && dstinterface="-o ${dstinterface}" + + ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${action} ${srcinterface} ${srcaddress} ${dstinterface} ${srcaddress}" + + # Blank variables that we're not going to use. + [[ ${srcinterface} == "-" ]] && srcinterface="" + [[ ${dstinterface} == "-" ]] && dstinterface="" + [[ ${dstaddress} == "-" ]] && dstaddress="" + [[ ${srcaddress} == "-" ]] && srcaddress="" + [[ ${bidirectional} == "-" ]] && bidirectional="no" + + ${VER_IPTABLES} -A ${FwdFilter} ${srcinterface} ${srcaddress} ${dstinterface} ${dstaddress} -j ${action} + [[ ${bidirectional} == "yes" ]] && ${VER_IPTABLES} -A ${FwdFilter} ${revsrcinterface} ${revsrcaddress} ${revdstinterface} ${revdstaddress} -j ${action} + done < "${FWCONFIGDIR}/ipv${IPVER}/forward.conf" + ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done" + fi +} + function enable_nat { IP_VERSION=$1 case $IP_VERSION in