You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

139 lines
4.0 KiB

# --- T2-COPYRIGHT-NOTE-BEGIN ---
# This copyright note is auto-generated by ./scripts/Create-CopyPatch.
#
# T2 SDE: package/.../iptables/rocknet_iptables.sh
# Copyright (C) 2004 - 2006 The T2 SDE Project
#
# More information can be found in the files COPYING and README.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License. A copy of the
# GNU General Public License can be found in the file COPYING.
# --- T2-COPYRIGHT-NOTE-END ---
iptables_init_if() {
if isfirst "iptables_$if"; then
# prepare INPUT
addcode up 1 1 "iptables -N firewall_$if"
addcode up 1 2 "iptables -A INPUT -i $if `
`-m state --state ESTABLISHED,RELATED -j ACCEPT"
addcode up 1 3 "iptables -A INPUT -i $if -j firewall_$if"
# prepare FORWARD
addcode up 1 1 "iptables -N forward_$if"
addcode up 1 2 "iptables -A FORWARD -i $if `
`-m state --state ESTABLISHED,RELATED -j ACCEPT"
addcode up 1 3 "iptables -A FORWARD -i $if -j forward_$if"
# clean INPUT
addcode down 1 3 "iptables -F firewall_$if"
addcode down 1 2 "iptables -D INPUT -i $if -j firewall_$if"
addcode down 1 2 "iptables -D INPUT -i $if `
`-m state --state ESTABLISHED,RELATED -j ACCEPT"
addcode down 1 1 "iptables -X firewall_$if"
# clean FORWARD
addcode down 1 3 "iptables -F forward_$if"
addcode down 1 2 "iptables -D FORWARD -i $if -j forward_$if"
addcode down 1 2 "iptables -D FORWARD -i $if `
`-m state --state ESTABLISHED,RELATED -j ACCEPT"
addcode down 1 1 "iptables -X forward_$if"
fi
}
iptables_parse_conditions() {
iptables_cond=""
while [ -n "$1" ]
do
case "$1" in
all)
shift
;;
tcp|udp)
iptables_cond="$iptables_cond -p $1 --dport $2"
shift; shift
;;
icmp)
iptables_cond="$iptables_cond -p icmp --icmp-type $2"
shift; shift
;;
ip)
iptables_cond="$iptables_cond -s $2"
shift; shift
;;
*)
error "Unkown accept/reject/drop condition: $1"
shift
esac
done
}
public_accept() {
iptables_parse_conditions "$@"
local level=6; [ "$ip" ] && level=5
addcode up 1 $level "iptables -A firewall_$if ${ip:+-d $ip} $iptables_cond -j ACCEPT"
iptables_init_if
}
public_reject() {
iptables_parse_conditions "$@"
local level=6; [ "$ip" ] && level=5
addcode up 1 $level "iptables -A firewall_$if ${ip:+-d $ip} $iptables_cond -j REJECT"
iptables_init_if
}
public_drop() {
iptables_parse_conditions "$@"
local level=6; [ "$ip" ] && level=5
addcode up 1 $level "iptables -A firewall_$if ${ip:+-d $ip} $iptables_cond -j DROP"
iptables_init_if
}
public_restrict() {
iptables_parse_conditions "$@"
local level=6; [ "$ip" ] && level=5
addcode up 1 $level "iptables -A forward_$if ${ip:+-d $ip} $iptables_cond -j DROP"
iptables_init_if
}
public_conduit() {
# conduit (tcp|udp) port targetip[:targetport]
#
local proto=$1 port=$2
local targetip=$3 targetport=$2
if [ "${targetip/:/}" != "$targetip" ]; then
targetport=${targetip#*:}
targetip=${targetip%:*}
fi
addcode up 1 4 "iptables -t nat -A PREROUTING -i $if ${ip:+-d $ip} -p $proto \
--dport $port -j DNAT --to $targetip:$targetport"
addcode up 1 4 "iptables -A forward_$if -p $proto -d $targetip \
--dport $targetport -j ACCEPT"
iptables_init_if
}
public_clamp_mtu() {
addcode up 1 1 "iptables -A FORWARD ${if:+-o $if} -p tcp --tcp-flags SYN,RST SYN \
-j TCPMSS --clamp-mss-to-pmtu"
addcode down 9 1 "iptables -D FORWARD ${if:+-o $if} -p tcp --tcp-flags SYN,RST SYN \
-j TCPMSS --clamp-mss-to-pmtu"
}
public_masquerade() {
if [ "$ip" ]; then
addcode up 1 6 "iptables -t nat -A POSTROUTING ${1:+-s $1} -o $if \
-j SNAT --to $ip"
addcode down 9 6 "iptables -t nat -D POSTROUTING ${1:+-s $1} -o $if \
-j SNAT --to $ip"
else
addcode up 1 6 "iptables -t nat -A POSTROUTING ${1:+-s $1} -o $if \
-j MASQUERADE"
addcode down 9 6 "iptables -t nat -D POSTROUTING ${1:+-s $1} -o $if \
-j MASQUERADE"
fi
}