webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-27 19:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Forward Firewall: enabled Portranges for DNAT

Browse Source
This commit is contained in:
Alexander Marx
2013-04-01 06:26:58 +02:00
committed by Michael Tremer
parent 6be32fe504
commit 829697d076
4 changed files with 35 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
config/forwardfw/rules.pl
View File

@@ -287,10 +287,11 @@ sub buildrules
if ($$hash{$key}[17] eq 'ON'){
print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $fireport $TIME -j LOG --log-prefix 'DNAT' \n";
}
my $fwaccessdport="--dport ".substr($DPORT,1,) if ($DPORT);
my ($ip,$sub) =split("/",$targethash{$b}[0]);
print "iptables -A PORTFWACCESS $PROT -i $con -d $ip $fwaccessdport $TIME -j ACCEPT\n";
print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $$hash{$key}[0] --to $ip$DPORT\n";
$DPORT =~ s/\-/:/g;
my $fwaccessdport="--dport ".substr($DPORT,1,) if ($DPORT);
print "iptables -A PORTFWACCESS $PROT -i $con -d $ip $fwaccessdport $TIME -j ACCEPT\n";
}elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[32] eq 'snat'){
print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0] --to $natip$fireport\n";
}
@@ -327,10 +328,12 @@ sub buildrules
if ($$hash{$key}[17] eq 'ON'){
system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j LOG --log-prefix 'DNAT' \n";
}
my $fwaccessdport="--dport ".substr($DPORT,1,) if ($DPORT);
my ($ip,$sub) =split("/",$targethash{$b}[0]);
system "iptables -A PORTFWACCESS $PROT -i $con -d $ip $fwaccessdport $TIME -j ACCEPT\n";
system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $$hash{$key}[0] --to $ip$DPORT\n";
$DPORT =~ s/\-/:/g;
my $fwaccessdport="--dport ".substr($DPORT,1,) if ($DPORT);
system "iptables -A PORTFWACCESS $PROT -i $con -d $ip $fwaccessdport $TIME -j ACCEPT\n";
}elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){
if ($$hash{$key}[17] eq 'ON'){
system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG --log-prefix 'SNAT '\n";
@@ -519,7 +522,6 @@ sub get_port
return;
}
}elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){
if($$hash{$key}[14] eq 'TGT_PORT'){
if ($$hash{$key}[15] ne ''){
$$hash{$key}[15] =~ s/\|/,/g;
@@ -529,6 +531,7 @@ sub get_port
if($$hash{$key}[28] ne 'ON' || ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat') ){
return "--dport $$hash{$key}[15] ";
}else{
$$hash{$key}[15] =~ s/\:/-/g;
return ":$$hash{$key}[15]";
}
}