|
|
@ -1,5 +1,4 @@ |
|
|
|
#!/bin/sh |
|
|
|
#!/bin/sh |
|
|
|
# Setup NAT reflection rules |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
. /etc/functions.sh |
|
|
|
. /etc/functions.sh |
|
|
|
|
|
|
|
|
|
|
@ -16,6 +15,26 @@ if [ "$ACTION" = "ifup" ] && [ "$INTERFACE" = "wan" ]; then |
|
|
|
iptables -t nat -A postrouting_rule -j nat_reflection_out |
|
|
|
iptables -t nat -A postrouting_rule -j nat_reflection_out |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
find_networks() { |
|
|
|
|
|
|
|
find_networks_cb() { |
|
|
|
|
|
|
|
local cfg="$1" |
|
|
|
|
|
|
|
local zone="$2" |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
local name |
|
|
|
|
|
|
|
config_get name "$cfg" name |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[ "$name" = "$zone" ] && { |
|
|
|
|
|
|
|
local network |
|
|
|
|
|
|
|
config_get network "$cfg" network |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
echo ${network:-$zone} |
|
|
|
|
|
|
|
return 1 |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
config_foreach find_networks_cb zone "$1" |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
setup_fwd() { |
|
|
|
setup_fwd() { |
|
|
|
local cfg="$1" |
|
|
|
local cfg="$1" |
|
|
|
|
|
|
|
|
|
|
@ -26,49 +45,52 @@ if [ "$ACTION" = "ifup" ] && [ "$INTERFACE" = "wan" ]; then |
|
|
|
local dest |
|
|
|
local dest |
|
|
|
config_get dest "$cfg" dest "lan" |
|
|
|
config_get dest "$cfg" dest "lan" |
|
|
|
|
|
|
|
|
|
|
|
local lanip=$(uci -P/var/state get network.$dest.ipaddr) |
|
|
|
local net |
|
|
|
local lanmk=$(uci -P/var/state get network.$dest.netmask) |
|
|
|
for net in $(find_networks "$dest"); do |
|
|
|
|
|
|
|
local lanip=$(uci -P/var/state get network.$net.ipaddr) |
|
|
|
|
|
|
|
local lanmk=$(uci -P/var/state get network.$net.netmask) |
|
|
|
|
|
|
|
|
|
|
|
local proto |
|
|
|
local proto |
|
|
|
config_get proto "$cfg" proto |
|
|
|
config_get proto "$cfg" proto |
|
|
|
|
|
|
|
|
|
|
|
local epmin epmax extport |
|
|
|
local epmin epmax extport |
|
|
|
config_get extport "$cfg" src_dport |
|
|
|
config_get extport "$cfg" src_dport |
|
|
|
[ -n "$extport" ] || return |
|
|
|
[ -n "$extport" ] || return |
|
|
|
|
|
|
|
|
|
|
|
epmin="${extport%[-:]*}"; epmax="${extport#*[-:]}" |
|
|
|
epmin="${extport%[-:]*}"; epmax="${extport#*[-:]}" |
|
|
|
[ "$epmin" != "$epmax" ] || epmax="" |
|
|
|
[ "$epmin" != "$epmax" ] || epmax="" |
|
|
|
|
|
|
|
|
|
|
|
local ipmin ipmax intport |
|
|
|
local ipmin ipmax intport |
|
|
|
config_get intport "$cfg" dest_port "$extport" |
|
|
|
config_get intport "$cfg" dest_port "$extport" |
|
|
|
|
|
|
|
|
|
|
|
ipmin="${intport%[-:]*}"; ipmax="${intport#*[-:]}" |
|
|
|
ipmin="${intport%[-:]*}"; ipmax="${intport#*[-:]}" |
|
|
|
[ "$ipmin" != "$ipmax" ] || ipmax="" |
|
|
|
[ "$ipmin" != "$ipmax" ] || ipmax="" |
|
|
|
|
|
|
|
|
|
|
|
local exthost |
|
|
|
local exthost |
|
|
|
config_get exthost "$cfg" src_dip "$wanip" |
|
|
|
config_get exthost "$cfg" src_dip "$wanip" |
|
|
|
|
|
|
|
|
|
|
|
local inthost |
|
|
|
local inthost |
|
|
|
config_get inthost "$cfg" dest_ip |
|
|
|
config_get inthost "$cfg" dest_ip |
|
|
|
[ -n "$inthost" ] || return |
|
|
|
[ -n "$inthost" ] || return |
|
|
|
|
|
|
|
|
|
|
|
[ "$proto" = tcpudp ] && proto="tcp udp" |
|
|
|
[ "$proto" = tcpudp ] && proto="tcp udp" |
|
|
|
|
|
|
|
|
|
|
|
local p |
|
|
|
local p |
|
|
|
for p in ${proto:-tcp udp}; do |
|
|
|
for p in ${proto:-tcp udp}; do |
|
|
|
case "$p" in |
|
|
|
case "$p" in |
|
|
|
tcp|udp) |
|
|
|
tcp|udp) |
|
|
|
iptables -t nat -A nat_reflection_in \ |
|
|
|
iptables -t nat -A nat_reflection_in \ |
|
|
|
-s $lanip/$lanmk -d $exthost \ |
|
|
|
-s $lanip/$lanmk -d $exthost \ |
|
|
|
-p $p --dport $epmin${epmax:+:$epmax} \ |
|
|
|
-p $p --dport $epmin${epmax:+:$epmax} \ |
|
|
|
-j DNAT --to $inthost:$ipmin${ipmax:+-$ipmax} |
|
|
|
-j DNAT --to $inthost:$ipmin${ipmax:+-$ipmax} |
|
|
|
|
|
|
|
|
|
|
|
iptables -t nat -A nat_reflection_out \ |
|
|
|
iptables -t nat -A nat_reflection_out \ |
|
|
|
-s $lanip/$lanmk -d $inthost \ |
|
|
|
-s $lanip/$lanmk -d $inthost \ |
|
|
|
-p $p --dport $ipmin${ipmax:+:$ipmax} \ |
|
|
|
-p $p --dport $ipmin${ipmax:+:$ipmax} \ |
|
|
|
-j SNAT --to-source $lanip |
|
|
|
-j SNAT --to-source $lanip |
|
|
|
;; |
|
|
|
;; |
|
|
|
esac |
|
|
|
esac |
|
|
|
|
|
|
|
done |
|
|
|
done |
|
|
|
done |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|