diff options
| author | jow <jow@3c298f89-4303-0410-b956-a3cf2f4a3e73> | 2011-07-01 11:48:14 +0000 |
|---|---|---|
| committer | jow <jow@3c298f89-4303-0410-b956-a3cf2f4a3e73> | 2011-07-01 11:48:14 +0000 |
| commit | 9179216cd8776544534ef866e221e575a5a2c8c1 (patch) | |
| tree | 752a85088d332b5693b0cd17dc3f764d9e44eac4 | |
| parent | 9d43dbd716ca1c46e5c92a1ba4e56c7dbaa4ec86 (diff) | |
[package] firewall: properly handle negated ports in nat reflection
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@27334 3c298f89-4303-0410-b956-a3cf2f4a3e73
| -rw-r--r-- | package/firewall/Makefile | 2 | ||||
| -rw-r--r-- | package/firewall/files/reflection.hotplug | 16 |
2 files changed, 13 insertions, 5 deletions
diff --git a/package/firewall/Makefile b/package/firewall/Makefile index ff62309d3..25c110040 100644 --- a/package/firewall/Makefile +++ b/package/firewall/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=firewall PKG_VERSION:=2 -PKG_RELEASE:=27 +PKG_RELEASE:=28 include $(INCLUDE_DIR)/package.mk diff --git a/package/firewall/files/reflection.hotplug b/package/firewall/files/reflection.hotplug index 4fd8f296d..7ab4c5fe8 100644 --- a/package/firewall/files/reflection.hotplug +++ b/package/firewall/files/reflection.hotplug @@ -91,23 +91,31 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then [ "${inthost#!}" = "$inthost" ] || return 0 [ "${exthost#!}" = "$exthost" ] || return 0 + [ "${epmin#!}" != "$epmin" ] && \ + extport="! --dport ${epmin#!}${epmax:+:$epmax}" || \ + extport="--dport $epmin${epmax:+:$epmax}" + + [ "${ipmin#!}" != "$ipmin" ] && \ + intport="! --dport ${ipmin#!}${ipmax:+:$ipmax}" || \ + intport="--dport $ipmin${ipmax:+:$ipmax}" + local p for p in ${proto:-tcp udp}; do case "$p" in tcp|udp) iptables -t nat -A nat_reflection_in \ -s $lanip/$lanmk -d $exthost \ - -p $p --dport $epmin${epmax:+:$epmax} \ - -j DNAT --to $inthost:$ipmin${ipmax:+-$ipmax} + -p $p $extport \ + -j DNAT --to $inthost:${ipmin#!}${ipmax:+-$ipmax} iptables -t nat -A nat_reflection_out \ -s $lanip/$lanmk -d $inthost \ - -p $p --dport $ipmin${ipmax:+:$ipmax} \ + -p $p $intport \ -j SNAT --to-source $lanip iptables -t filter -A nat_reflection_fwd \ -s $lanip/$lanmk -d $inthost \ - -p $p --dport $ipmin${ipmax:+:$ipmax} \ + -p $p $intport \ -j ACCEPT ;; esac |