webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-28 11:43:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

Firewall: Make it possible to use NAT rules with servicegroups.

Browse Source
This commit is contained in:
Alexander Marx
2013-10-23 16:06:54 +02:00
committed by Michael Tremer
parent 8cdfbf5aeb
commit f0befbc378
1 changed files with 32 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
config/forwardfw/rules.pl
View File

@@ -278,6 +278,11 @@ sub buildrules
print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $fireport $TIME -j LOG --log-prefix 'DNAT' \n";
}
my ($ip,$sub) =split("/",$targethash{$b}[0]);
#Process NAT with servicegroup used
if ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[14] eq 'cust_srvgrp'){
print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip $DPORT\n";
$fwaccessdport=$DPORT;
}else{
print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
$DPORT =~ s/\-/:/g;
if ($DPORT){
@@ -290,6 +295,7 @@ sub buildrules
$fwaccessdport="--dport $$hash{$key}[30]";
}
}
}
print "iptables -A FORWARDFW $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
next;
}elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){
@@ -342,6 +348,11 @@ sub buildrules
system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $fireport $TIME -j LOG --log-prefix 'DNAT' \n";
}
my ($ip,$sub) =split("/",$targethash{$b}[0]);
#Process NAT with servicegroup used
if ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[14] eq 'cust_srvgrp'){
system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip $DPORT\n";
$fwaccessdport=$DPORT;
}else{
system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
$DPORT =~ s/\-/:/g;
if ($DPORT){
@@ -354,6 +365,7 @@ sub buildrules
$fwaccessdport="--dport $$hash{$key}[30]";
}
}
}
system "iptables -A FORWARDFW $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
next;
#PROCESS SNAT RULE