webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 10:35:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

firewall: Collect all networks that should not be NATed in an array

Browse Source 
commit 8fa1831bff7e1d76eb83b145976211aa703062e1
    Author: Michael Tremer <michael.tremer@ipfire.org>
    Date:   Mon Mar 31 16:31:43 2025 +0200

        firewall: Collect all networks that should not be NATed in an array

        No functional changes.

        Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

    firewall: Explicitely don't NAT any aliases

        It seems that there is a problem with local connections that have
        preselected an outgoing interface. That will work just fine, but
        ultimately the packet will be NATed back to the primary RED IP address.
        To prevent this, we are adding some extra rules that skip the MASQUERADE
        target.

        Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
This commit is contained in:
Vincent Li
2025-07-02 21:29:21 +00:00
parent 90a4a51a0e
commit 0f4e6612df
1 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/initscripts/system/firewall
View File

@@ -484,22 +484,27 @@ iptables_red_up() {
iptables -t nat -A REDNAT -i "${GREEN_DEV}" -o "${IFACE}" -j RETURN
fi
local NO_MASQ_NETWORKS
local NO_MASQ_NETWORKS=()
if [ "${MASQUERADE_GREEN}" = "off" ]; then
NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${GREEN_NETADDRESS}/${GREEN_NETMASK}"
NO_MASQ_NETWORKS+=( "${GREEN_NETADDRESS}/${GREEN_NETMASK}" )
fi
if [ "${MASQUERADE_BLUE}" = "off" ]; then
NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${BLUE_NETADDRESS}/${BLUE_NETMASK}"
NO_MASQ_NETWORKS+=( "${BLUE_NETADDRESS}/${BLUE_NETMASK}" )
fi
if [ "${MASQUERADE_ORANGE}" = "off" ]; then
NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${ORANGE_NETADDRESS}/${ORANGE_NETMASK}"
NO_MASQ_NETWORKS+=( "${ORANGE_NETADDRESS}/${ORANGE_NETMASK}" )
fi
local alias
for alias in $(get_aliases); do
NO_MASQ_NETWORKS+=( "${alias}" )
done
local network
for network in ${NO_MASQ_NETWORKS}; do
for network in ${NO_MASQ_NETWORKS[@]}; do
iptables -t nat -A REDNAT -s "${network}" -o "${IFACE}" -j RETURN
done