From d68e09200e223c466a03242307c97abd25849d82 Mon Sep 17 00:00:00 2001
From: Jo-Philipp Wich <jow@openwrt.org>
Date: Sat, 31 Jul 2010 13:06:14 +0000
Subject: [PATCH] firewall: add basic NAT reflection/NAT loopback support

SVN-Revision: 22441
---
 package/firewall/Makefile                 |  3 +-
 package/firewall/files/reflection.hotplug | 79 +++++++++++++++++++++++
 2 files changed, 81 insertions(+), 1 deletion(-)
 create mode 100644 package/firewall/files/reflection.hotplug

diff --git a/package/firewall/Makefile b/package/firewall/Makefile
index c1f3f6eb22..b489d9387b 100644
--- a/package/firewall/Makefile
+++ b/package/firewall/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=firewall
 
 PKG_VERSION:=2
-PKG_RELEASE:=8
+PKG_RELEASE:=9
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -45,6 +45,7 @@ define Package/firewall/install
 	$(INSTALL_BIN) ./files/firewall.init $(1)/etc/init.d/firewall
 	$(INSTALL_DIR) $(1)/etc/hotplug.d/iface
 	$(INSTALL_DATA) ./files/firewall.hotplug $(1)/etc/hotplug.d/iface/20-firewall
+	$(INSTALL_DATA) ./files/reflection.hotplug $(1)/etc/hotplug.d/iface/30-nat-reflection
 	$(INSTALL_DIR) $(1)/etc
 	$(INSTALL_DATA) ./files/firewall.user $(1)/etc
 endef
diff --git a/package/firewall/files/reflection.hotplug b/package/firewall/files/reflection.hotplug
new file mode 100644
index 0000000000..605ac7c991
--- /dev/null
+++ b/package/firewall/files/reflection.hotplug
@@ -0,0 +1,79 @@
+#!/bin/sh
+# Setup NAT reflection rules
+
+. /etc/functions.sh
+
+if [ "$ACTION" = "ifup" ] && [ "$INTERFACE" = "wan" ]; then
+	local wanip=$(uci -P/var/state get network.wan.ipaddr)
+
+	iptables -t nat -F nat_reflection_in 2>/dev/null || {
+		iptables -t nat -N nat_reflection_in
+		iptables -t nat -A prerouting_rule -j nat_reflection_in
+	}
+
+	iptables -t nat -F nat_reflection_out 2>/dev/null || {
+		iptables -t nat -N nat_reflection_out
+		iptables -t nat -A postrouting_rule -j nat_reflection_out
+	}
+
+	setup_fwd() {
+		local cfg="$1"
+
+		local src
+		config_get src "$cfg" src
+
+		[ "$src" = wan ] && {
+			local dest
+			config_get dest "$cfg" dest "lan"
+
+			local lanip=$(uci -P/var/state get network.$dest.ipaddr)
+			local lanmk=$(uci -P/var/state get network.$dest.netmask)
+
+			local proto
+			config_get proto "$cfg" proto
+
+			local epmin epmax extport
+			config_get extport "$cfg" src_dport
+			[ -n "$extport" ] || return
+
+			epmin="${extport%[-:]*}"; epmax="${extport#*[-:]}"
+			[ "$epmin" != "$epmax" ] || epmax=""
+
+			local ipmin ipmax intport
+			config_get intport "$cfg" dest_port "$extport"
+
+			ipmin="${intport%[-:]*}"; ipmax="${intport#*[-:]}"
+			[ "$ipmin" != "$ipmax" ] || ipmax=""
+
+			local exthost
+			config_get exthost "$cfg" src_dip "$wanip"
+
+			local inthost
+			config_get inthost "$cfg" dest_ip
+			[ -n "$inthost" ] || return
+
+			[ "$proto" = tcpudp ] && proto="tcp udp"
+
+			local p
+			for p in ${proto:-tcp udp}; do
+				case "$p" in
+					tcp|udp)
+						iptables -t nat -A nat_reflection_in \
+							-s $lanip/$lanmk -d $exthost \
+							-p $p --dport $epmin${epmax:+:$epmax} \
+							-j DNAT --to $inthost:$ipmin${ipmax:+-$ipmax}
+
+						iptables -t nat -A nat_reflection_out \
+							-s $lanip/$lanmk -d $inthost \
+							-p $p --dport $ipmin${ipmax:+:$ipmax} \
+							-j SNAT --to-source $lanip
+					;;
+				esac
+			done
+		}
+	}
+
+	config_load firewall
+	config_foreach setup_fwd redirect
+fi
+