X-Git-Url: https://git.rohieb.name/openwrt.git/blobdiff_plain/750dead7922e939ee1d957cfb6b7f0ce65061067..957731ef89fc1876a0ab8c56d50001011b20abb0:/package/firewall/files/reflection.hotplug diff --git a/package/firewall/files/reflection.hotplug b/package/firewall/files/reflection.hotplug index 027d2ed8b..1feb21075 100644 --- a/package/firewall/files/reflection.hotplug +++ b/package/firewall/files/reflection.hotplug @@ -15,6 +15,11 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then iptables -t nat -A postrouting_rule -j nat_reflection_out } + iptables -t filter -F nat_reflection_fwd 2>/dev/null || { + iptables -t filter -N nat_reflection_fwd + iptables -t filter -A forwarding_rule -j nat_reflection_fwd + } + find_networks() { find_networks_cb() { local cfg="$1" @@ -34,10 +39,14 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then config_foreach find_networks_cb zone "$1" } - + setup_fwd() { local cfg="$1" + local reflection + config_get_bool reflection "$cfg" reflection 1 + [ "$reflection" == 1 ] || return + local src config_get src "$cfg" src @@ -47,6 +56,7 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then [ "$src" = wan ] && [ "$target" = DNAT ] && { local dest config_get dest "$cfg" dest "lan" + [ "$dest" != "*" ] || return local net for net in $(find_networks "$dest"); do @@ -56,22 +66,18 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then local proto config_get proto "$cfg" proto - local reflection - config_get_bool reflection "$cfg" reflection 1 - [ "$reflection" == 1 ] || return - local epmin epmax extport config_get extport "$cfg" src_dport [ -n "$extport" ] || return epmin="${extport%[-:]*}"; epmax="${extport#*[-:]}" - [ "$epmin" != "$epmax" ] || epmax="" + [ "${epmin#!}" != "$epmax" ] || epmax="" local ipmin ipmax intport config_get intport "$cfg" dest_port "$extport" ipmin="${intport%[-:]*}"; ipmax="${intport#*[-:]}" - [ "$ipmin" != "$ipmax" ] || ipmax="" + [ "${ipmin#!}" != "$ipmax" ] || ipmax="" local exthost config_get exthost "$cfg" src_dip "$wanip" @@ -82,19 +88,35 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then [ "$proto" = tcpudp ] && proto="tcp udp" + [ "${inthost#!}" = "$inthost" ] || return 0 + [ "${exthost#!}" = "$exthost" ] || return 0 + + [ "${epmin#!}" != "$epmin" ] && \ + extport="! --dport ${epmin#!}${epmax:+:$epmax}" || \ + extport="--dport $epmin${epmax:+:$epmax}" + + [ "${ipmin#!}" != "$ipmin" ] && \ + intport="! --dport ${ipmin#!}${ipmax:+:$ipmax}" || \ + intport="--dport $ipmin${ipmax:+:$ipmax}" + local p for p in ${proto:-tcp udp}; do case "$p" in - tcp|udp) + tcp|udp|6|17) iptables -t nat -A nat_reflection_in \ -s $lanip/$lanmk -d $exthost \ - -p $p --dport $epmin${epmax:+:$epmax} \ - -j DNAT --to $inthost:$ipmin${ipmax:+-$ipmax} + -p $p $extport \ + -j DNAT --to $inthost:${ipmin#!}${ipmax:+-$ipmax} iptables -t nat -A nat_reflection_out \ -s $lanip/$lanmk -d $inthost \ - -p $p --dport $ipmin${ipmax:+:$ipmax} \ + -p $p $intport \ -j SNAT --to-source $lanip + + iptables -t filter -A nat_reflection_fwd \ + -s $lanip/$lanmk -d $inthost \ + -p $p $intport \ + -j ACCEPT ;; esac done @@ -105,4 +127,3 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then config_load firewall config_foreach setup_fwd redirect fi -