webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-12 04:05:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

Forward Firewall: set standard rules for blue in mode 2

Browse Source
This commit is contained in:
Alexander Marx
2013-01-30 13:34:54 +01:00
committed by Michael Tremer
parent e974ced8c5
commit 6adcf1569c
3 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
config/forwardfw/rules.pl
View File

@@ -57,6 +57,7 @@ my $netsettings = "${General::swroot}/ethernet/settings";
my $errormessage='';
my $orange;
my $green;
my $blue;
my ($TYPE,$PROT,$SPROT,$DPROT,$SPORT,$DPORT,$TIME,$TIMEFROM,$TIMETILL,$SRC_TGT);
my $CHAIN="FORWARDFW";
@@ -96,15 +97,21 @@ if($param eq 'flush'){
&p2pblock;
system ("/usr/sbin/firewall-forward-policy");
}elsif($fwdfwsettings{'POLICY'} eq 'MODE2'){
$defaultNetworks{'GREEN_NETMASK'}=&General::iporsubtocidr($defaultNetworks{'GREEN_NETMASK'});
$green="$defaultNetworks{'GREEN_ADDRESS'}/$defaultNetworks{'GREEN_NETMASK'}";
if ($defaultNetworks{'ORANGE_DEV'}){
$defaultNetworks{'ORANGE_NETMASK'}=&General::iporsubtocidr($defaultNetworks{'ORANGE_NETMASK'});
$defaultNetworks{'GREEN_NETMASK'}=&General::iporsubtocidr($defaultNetworks{'GREEN_NETMASK'});
$orange="$defaultNetworks{'ORANGE_ADDRESS'}/$defaultNetworks{'ORANGE_NETMASK'}";
$green="$defaultNetworks{'GREEN_ADDRESS'}/$defaultNetworks{'GREEN_NETMASK'}";
#set default rules for DMZ
system ("iptables -A $CHAIN -s $orange -d $green -j RETURN");
&p2pblock;
}
if ($defaultNetworks{'BLUE_DEV'}){
$defaultNetworks{'BLUE_NETMASK'}=&General::iporsubtocidr($defaultNetworks{'BLUE_NETMASK'});
$blue="$defaultNetworks{'BLUE_ADDRESS'}/$defaultNetworks{'BLUE_NETMASK'}";
#set default rules for BLUE
system ("iptables -A $CHAIN -s $blue -d $green -j RETURN");
}
&p2pblock;
system ("iptables -A $CHAIN -m state --state NEW -j ACCEPT");
system ("/usr/sbin/firewall-forward-policy");
}

6
html/cgi-bin/forwardfw.cgi
View File

@@ -731,9 +731,9 @@ sub checktarget
$ip=&General::ip2dec($ip);
$ip=&General::dec2ip($ip);
#check if net
#check if net or broadcast
my @tmp= split (/\./,$ip);
if ($tmp[3] eq "0")
if ($tmp[3] eq "0" || ($tmp[3] eq "255"))
{
$errormessage=$Lang::tr{'fwhost err hostip'}."<br>";
}
@@ -876,7 +876,7 @@ sub checkrule
$hint.=$Lang::tr{'fwdfw hint ip2'}." Source: $networkip1/$scidr Target: $networkip2/$tcidr<br>";
}
}else{
if ( &General::IpInSubnet($networkip2,$sip,&General::iporsubtodec($scidr)) && $tcidr ne '32' ){
if ( &General::IpInSubnet($networkip2,$sip,&General::iporsubtodec($scidr)) ){
$errormessage.=$Lang::tr{'fwdfw err samesub'};
}
}

1
src/initscripts/init.d/firewall
View File

@@ -353,6 +353,7 @@ case "$1" in
$0 stop
$0 start
/usr/local/bin/forwardfwctrl
/usr/local/bin/setportfw
/usr/local/bin/openvpnctrl -s > /dev/null 2>&1
/usr/local/bin/openvpnctrl -sn2n > /dev/null 2>&1
;;