diff options
| author | jow <jow@3c298f89-4303-0410-b956-a3cf2f4a3e73> | 2010-05-19 21:35:23 +0000 |
|---|---|---|
| committer | jow <jow@3c298f89-4303-0410-b956-a3cf2f4a3e73> | 2010-05-19 21:35:23 +0000 |
| commit | 24931686cd4b89f6a038d3820218578db8ba92ee (patch) | |
| tree | 3737e742d161802a733eab5124b42e1925b77d22 /package/firewall/files/lib/core_interface.sh | |
| parent | 7c18581ea6a95d35b6581c58a632098e1e05364e (diff) | |
[package] firewall:
- fix ip6tables rules when icmp_type option is set
- add "family" option to zones, forwardings, redirects and rules to selectively apply rules to iptables and/or ip6tables
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21508 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package/firewall/files/lib/core_interface.sh')
| -rw-r--r-- | package/firewall/files/lib/core_interface.sh | 33 |
1 files changed, 18 insertions, 15 deletions
diff --git a/package/firewall/files/lib/core_interface.sh b/package/firewall/files/lib/core_interface.sh index 9b35c8b2b..de5fd9a0e 100644 --- a/package/firewall/files/lib/core_interface.sh +++ b/package/firewall/files/lib/core_interface.sh @@ -17,23 +17,26 @@ fw_configure_interface() { fw__do_rules() { local action=$1 - local chain=$2 + local zone=$2 + local chain=zone_${zone} local ifname=$3 - fw $action i f ${chain}_ACCEPT ACCEPT ^ { -o "$ifname" } - fw $action i f ${chain}_ACCEPT ACCEPT ^ { -i "$ifname" } - fw $action i f ${chain}_DROP DROP ^ { -o "$ifname" } - fw $action i f ${chain}_DROP DROP ^ { -i "$ifname" } - fw $action i f ${chain}_REJECT reject ^ { -o "$ifname" } - fw $action i f ${chain}_REJECT reject ^ { -i "$ifname" } + local mode=$(fw_get_family_mode x $zone i) - fw $action i n ${chain}_nat MASQUERADE ^ { -o "$ifname" } - fw $action i f ${chain}_MSSFIX TCPMSS ^ { -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu } + fw $action $mode f ${chain}_ACCEPT ACCEPT ^ { -o "$ifname" } + fw $action $mode f ${chain}_ACCEPT ACCEPT ^ { -i "$ifname" } + fw $action $mode f ${chain}_DROP DROP ^ { -o "$ifname" } + fw $action $mode f ${chain}_DROP DROP ^ { -i "$ifname" } + fw $action $mode f ${chain}_REJECT reject ^ { -o "$ifname" } + fw $action $mode f ${chain}_REJECT reject ^ { -i "$ifname" } - fw $action i f input ${chain} $ { -i "$ifname" } - fw $action i f forward ${chain}_forward $ { -i "$ifname" } - fw $action i n PREROUTING ${chain}_prerouting ^ { -i "$ifname" } - fw $action i r PREROUTING ${chain}_notrack ^ { -i "$ifname" } + fw $action $mode n ${chain}_nat MASQUERADE ^ { -o "$ifname" } + fw $action $mode f ${chain}_MSSFIX TCPMSS ^ { -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu } + + fw $action $mode f input ${chain} $ { -i "$ifname" } + fw $action $mode f forward ${chain}_forward $ { -i "$ifname" } + fw $action $mode n PREROUTING ${chain}_prerouting ^ { -i "$ifname" } + fw $action $mode r PREROUTING ${chain}_notrack ^ { -i "$ifname" } } local old_zones old_ifname @@ -42,7 +45,7 @@ fw_configure_interface() { config_get old_ifname core "${iface}_ifname" for z in $old_zones; do fw_log info "removing $iface ($old_ifname) from zone $z" - fw__do_rules del zone_$z $old_ifname + fw__do_rules del $z $old_ifname ACTION=remove ZONE="$z" INTERFACE="$iface" DEVICE="$ifname" /sbin/hotplug-call firewall done @@ -57,7 +60,7 @@ fw_configure_interface() { list_contains zone_network "$iface" || return fw_log info "adding $iface ($ifname) to zone $zone_name" - fw__do_rules add zone_${zone_name} "$ifname" + fw__do_rules add ${zone_name} "$ifname" append new_zones $zone_name ACTION=add ZONE="$zone_name" INTERFACE="$iface" DEVICE="$ifname" /sbin/hotplug-call firewall |