EljakimHerrewijnen/Openwrt
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

firewall: introduce SNAT support for redirect sections

Browse Source 
SVN-Revision: 22937
This commit is contained in:
Jo-Philipp Wich 2010-09-05 19:03:17 +00:00
parent 0c6653c6e2
commit eb79296cc1
3 changed files with 19 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
package/firewall/Makefile
View File

@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=firewall PKG_NAME:=firewall
PKG_VERSION:=2 PKG_VERSION:=2
PKG_RELEASE:=11 PKG_RELEASE:=12
include $(INCLUDE_DIR)/package.mk include $(INCLUDE_DIR)/package.mk

16
package/firewall/files/lib/core_redirect.sh
View File

@ -17,6 +17,7 @@ fw_config_get_redirect() {
string dest_port "" \ string dest_port "" \
string proto "tcpudp" \ string proto "tcpudp" \
string family "" \ string family "" \
string target "DNAT" \
} || return } || return
[ -n "$redirect_name" ] || redirect_name=$redirect__name [ -n "$redirect_name" ] || redirect_name=$redirect__name
} }
@ -30,6 +31,17 @@ fw_load_redirect() {
fw_die "redirect ${redirect_name}: needs src and dest_ip or dest_port" fw_die "redirect ${redirect_name}: needs src and dest_ip or dest_port"
} }
local chain destopt
if [ "$redirect_target" == "DNAT" ]; then
chain="zone_${redirect_src}_prerouting"
destopt="--to-destination"
elif [ "$redirect_target" == "SNAT" ]; then
chain="zone_${redirect_src}_nat"
destopt="--to-source"
else
fw_die "redirect ${redirect_name}: target must be either DNAT or SNAT"
fi
list_contains FW_CONNTRACK_ZONES $redirect_src || \ list_contains FW_CONNTRACK_ZONES $redirect_src || \
append FW_CONNTRACK_ZONES $redirect_src append FW_CONNTRACK_ZONES $redirect_src
@ -43,14 +55,14 @@ fw_load_redirect() {
[ "$redirect_proto" == "tcpudp" ] && redirect_proto="tcp udp" [ "$redirect_proto" == "tcpudp" ] && redirect_proto="tcp udp"
for redirect_proto in $redirect_proto; do for redirect_proto in $redirect_proto; do
fw add $mode n zone_${redirect_src}_prerouting DNAT $ { $redirect_src_ip $redirect_dest_ip } { \ fw add $mode n $chain $redirect_target $ { $redirect_src_ip $redirect_dest_ip } { \
${redirect_proto:+-p $redirect_proto} \ ${redirect_proto:+-p $redirect_proto} \
${redirect_src_ip:+-s $redirect_src_ip/$redirect_src_ip_prefixlen} \ ${redirect_src_ip:+-s $redirect_src_ip/$redirect_src_ip_prefixlen} \
${redirect_src_dip:+-d $redirect_src_dip/$redirect_src_dip_prefixlen} \ ${redirect_src_dip:+-d $redirect_src_dip/$redirect_src_dip_prefixlen} \
${redirect_src_port:+--sport $redirect_src_port} \ ${redirect_src_port:+--sport $redirect_src_port} \
${redirect_src_dport:+--dport $redirect_src_dport} \ ${redirect_src_dport:+--dport $redirect_src_dport} \
${redirect_src_mac:+-m mac --mac-source $redirect_src_mac} \ ${redirect_src_mac:+-m mac --mac-source $redirect_src_mac} \
--to-destination ${redirect_dest_ip}${redirect_dest_port:+:$nat_dest_port} \ $destopt ${redirect_dest_ip}${redirect_dest_port:+:$nat_dest_port} \
} }
[ -n "$redirect_dest_ip" ] && \ [ -n "$redirect_dest_ip" ] && \

5
package/firewall/files/reflection.hotplug
View File

@ -41,7 +41,10 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
local src local src
config_get src "$cfg" src config_get src "$cfg" src
[ "$src" = wan ] && { local target
config_get target "$cfg" target DNAT
[ "$src" = wan ] && [ "$target" = DNAT ] && {
local dest local dest
config_get dest "$cfg" dest "lan" config_get dest "$cfg" dest "lan"