webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-05-03 08:42:55 +02:00
Code Issues Packages Projects Releases Wiki Activity

Forward Firewall: Added multiport support to DNAT/Portforwarding

Browse Source 
Now it is possible to use multiple ports under DNAT when TARGET has no Port, one Port or one Portrange defined
This commit is contained in:
Alexander Marx
2013-04-11 10:50:29 +02:00
committed by Michael Tremer
parent ed618226bb
commit 98cee89f94
3 changed files with 74 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
config/forwardfw/rules.pl
View File

@@ -177,6 +177,7 @@ sub buildrules
my $snatport;
my $fireport;
my $nat;
my $fwaccessdport;
foreach my $key (sort {$a <=> $b} keys %$hash){
next if ($$hash{$key}[6] eq 'RED' && $conexists eq 'off' );
if ($$hash{$key}[28] eq 'ON'){
@@ -184,7 +185,12 @@ sub buildrules
$natip=&get_nat_ip($$hash{$key}[29]);
if($$hash{$key}[31] eq 'dnat'){
$nat='DNAT';
$fireport='--dport '.$$hash{$key}[30] if ($$hash{$key}[30]>0);
if ($$hash{$key}[30] =~ /\|/){
$$hash{$key}[30]=~ tr/|/,/;
$fireport='-m multiport --dport '.$$hash{$key}[30];
}else{
$fireport='--dport '.$$hash{$key}[30] if ($$hash{$key}[30]>0);
}
}else{
$nat='SNAT';
}
@@ -291,7 +297,16 @@ sub buildrules
my ($ip,$sub) =split("/",$targethash{$b}[0]);
print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
$DPORT =~ s/\-/:/g;
my $fwaccessdport="--dport ".substr($DPORT,1,) if ($DPORT);
if ($DPORT){
$fwaccessdport="--dport ".substr($DPORT,1,);
}elsif(! $DPORT && $$hash{$key}[30] ne ''){
if ($$hash{$key}[30]=~m/|/i){
$$hash{$key}[30] =~ s/\|/,/g;
$fwaccessdport="-m multiport --dport $$hash{$key}[30]";
}else{
$fwaccessdport="--dport $$hash{$key}[30]";
}
}
print "iptables -A PORTFWACCESS $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
}elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[32] eq 'snat'){
print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip$fireport\n";
@@ -332,9 +347,17 @@ sub buildrules
my ($ip,$sub) =split("/",$targethash{$b}[0]);
system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
$DPORT =~ s/\-/:/g;
my $fwaccessdport="--dport ".substr($DPORT,1,) if ($DPORT);
if ($DPORT){
$fwaccessdport="--dport ".substr($DPORT,1,);
}elsif(! $DPORT && $$hash{$key}[30] ne ''){
if ($$hash{$key}[30]=~m/|/i){
$$hash{$key}[30] =~ s/\|/,/g;
$fwaccessdport="-m multiport --dport $$hash{$key}[30]";
}else{
$fwaccessdport="--dport $$hash{$key}[30]";
}
}
system "iptables -A PORTFWACCESS $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
}elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){
if ($$hash{$key}[17] eq 'ON'){
system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG --log-prefix 'SNAT '\n";
@@ -499,6 +522,10 @@ sub get_prot
return &fwlib::get_srvgrp_prot($$hash{$key}[15]);
}
}
#DNAT
if ($SRC_TGT eq '' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[11] eq '' && $$hash{$key}[12] ne ''){
return "$$hash{$key}[12]";
}
}
sub get_port
{