X-Git-Url: https://git.rohieb.name/openwrt.git/blobdiff_plain/cf123d2a166d297712ab7b7221af999a62643f98..a7d37003016b53ca8612384353754052545f257e:/package/iptables/files/firewall.init?ds=inline diff --git a/package/iptables/files/firewall.init b/package/iptables/files/firewall.init index 731485bcd..290bae1ea 100755 --- a/package/iptables/files/firewall.init +++ b/package/iptables/files/firewall.init @@ -2,12 +2,13 @@ # Copyright (C) 2006 OpenWrt.org ## Please make changes in /etc/firewall.user - +START=45 start() { include /lib/network scan_interfaces config_get WAN wan ifname + config_get WANDEV wan device config_get LAN lan ifname ## CLEAR TABLES @@ -17,14 +18,19 @@ start() { done iptables -N input_rule + iptables -N input_wan iptables -N output_rule iptables -N forwarding_rule - + iptables -N forwarding_wan + + iptables -t nat -N NEW iptables -t nat -N prerouting_rule + iptables -t nat -N prerouting_wan iptables -t nat -N postrouting_rule iptables -N LAN_ACCEPT [ -z "$WAN" ] || iptables -A LAN_ACCEPT -i "$WAN" -j RETURN + [ -z "$WANDEV" -o "$WANDEV" = "$WAN" ] || iptables -A LAN_ACCEPT -i "$WANDEV" -j RETURN iptables -A LAN_ACCEPT -j ACCEPT ### INPUT @@ -40,6 +46,7 @@ start() { # insert accept rule or to jump to new accept-check table here # iptables -A INPUT -j input_rule + [ -z "$WAN" ] || iptables -A INPUT -i $WAN -j input_wan # allow iptables -A INPUT -j LAN_ACCEPT # allow from lan/wifi interfaces @@ -83,22 +90,29 @@ start() { # insert accept rule or to jump to new accept-check table here # iptables -A FORWARD -j forwarding_rule + [ -z "$WAN" ] || iptables -A FORWARD -i $WAN -j forwarding_wan # allow - iptables -A FORWARD -i br0 -o br0 -j ACCEPT + iptables -A FORWARD -i $LAN -o $LAN -j ACCEPT [ -z "$WAN" ] || iptables -A FORWARD -i $LAN -o $WAN -j ACCEPT # reject (what to do with anything not allowed earlier) # uses the default -P DROP ### MASQ + iptables -t nat -A PREROUTING -m state --state NEW -j NEW iptables -t nat -A PREROUTING -j prerouting_rule + [ -z "$WAN" ] || iptables -t nat -A PREROUTING -i "$WAN" -j prerouting_wan iptables -t nat -A POSTROUTING -j postrouting_rule [ -z "$WAN" ] || iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE - + + iptables -t nat -A NEW -m limit --limit 50 --limit-burst 100 -j RETURN && \ + iptables -t nat -A NEW -j DROP + ## USER RULES [ -f /etc/firewall.user ] && . /etc/firewall.user [ -n "$WAN" -a -e /etc/config/firewall ] && { + export WAN awk -f /usr/lib/common.awk -f /usr/lib/firewall.awk /etc/config/firewall | ash } } @@ -108,8 +122,10 @@ stop() { iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT iptables -F + iptables -X iptables -t nat -P PREROUTING ACCEPT iptables -t nat -P POSTROUTING ACCEPT iptables -t nat -P OUTPUT ACCEPT iptables -t nat -F + iptables -t nat -X }