firwall: fix nat reflection for zones covering multiple networks

SVN-Revision: 22442
This commit is contained in:
Jo-Philipp Wich 2010-07-31 13:25:56 +00:00
parent d68e09200e
commit 5b365822f3

View File

@ -1,5 +1,4 @@
#!/bin/sh #!/bin/sh
# Setup NAT reflection rules
. /etc/functions.sh . /etc/functions.sh
@ -16,6 +15,26 @@ if [ "$ACTION" = "ifup" ] && [ "$INTERFACE" = "wan" ]; then
iptables -t nat -A postrouting_rule -j nat_reflection_out iptables -t nat -A postrouting_rule -j nat_reflection_out
} }
find_networks() {
find_networks_cb() {
local cfg="$1"
local zone="$2"
local name
config_get name "$cfg" name
[ "$name" = "$zone" ] && {
local network
config_get network "$cfg" network
echo ${network:-$zone}
return 1
}
}
config_foreach find_networks_cb zone "$1"
}
setup_fwd() { setup_fwd() {
local cfg="$1" local cfg="$1"
@ -26,49 +45,52 @@ if [ "$ACTION" = "ifup" ] && [ "$INTERFACE" = "wan" ]; then
local dest local dest
config_get dest "$cfg" dest "lan" config_get dest "$cfg" dest "lan"
local lanip=$(uci -P/var/state get network.$dest.ipaddr) local net
local lanmk=$(uci -P/var/state get network.$dest.netmask) for net in $(find_networks "$dest"); do
local lanip=$(uci -P/var/state get network.$net.ipaddr)
local lanmk=$(uci -P/var/state get network.$net.netmask)
local proto local proto
config_get proto "$cfg" proto config_get proto "$cfg" proto
local epmin epmax extport local epmin epmax extport
config_get extport "$cfg" src_dport config_get extport "$cfg" src_dport
[ -n "$extport" ] || return [ -n "$extport" ] || return
epmin="${extport%[-:]*}"; epmax="${extport#*[-:]}" epmin="${extport%[-:]*}"; epmax="${extport#*[-:]}"
[ "$epmin" != "$epmax" ] || epmax="" [ "$epmin" != "$epmax" ] || epmax=""
local ipmin ipmax intport local ipmin ipmax intport
config_get intport "$cfg" dest_port "$extport" config_get intport "$cfg" dest_port "$extport"
ipmin="${intport%[-:]*}"; ipmax="${intport#*[-:]}" ipmin="${intport%[-:]*}"; ipmax="${intport#*[-:]}"
[ "$ipmin" != "$ipmax" ] || ipmax="" [ "$ipmin" != "$ipmax" ] || ipmax=""
local exthost local exthost
config_get exthost "$cfg" src_dip "$wanip" config_get exthost "$cfg" src_dip "$wanip"
local inthost local inthost
config_get inthost "$cfg" dest_ip config_get inthost "$cfg" dest_ip
[ -n "$inthost" ] || return [ -n "$inthost" ] || return
[ "$proto" = tcpudp ] && proto="tcp udp" [ "$proto" = tcpudp ] && proto="tcp udp"
local p local p
for p in ${proto:-tcp udp}; do for p in ${proto:-tcp udp}; do
case "$p" in case "$p" in
tcp|udp) tcp|udp)
iptables -t nat -A nat_reflection_in \ iptables -t nat -A nat_reflection_in \
-s $lanip/$lanmk -d $exthost \ -s $lanip/$lanmk -d $exthost \
-p $p --dport $epmin${epmax:+:$epmax} \ -p $p --dport $epmin${epmax:+:$epmax} \
-j DNAT --to $inthost:$ipmin${ipmax:+-$ipmax} -j DNAT --to $inthost:$ipmin${ipmax:+-$ipmax}
iptables -t nat -A nat_reflection_out \ iptables -t nat -A nat_reflection_out \
-s $lanip/$lanmk -d $inthost \ -s $lanip/$lanmk -d $inthost \
-p $p --dport $ipmin${ipmax:+:$ipmax} \ -p $p --dport $ipmin${ipmax:+:$ipmax} \
-j SNAT --to-source $lanip -j SNAT --to-source $lanip
;; ;;
esac esac
done
done done
} }
} }