Merge trunk into realtek-unstable

Conflicts:
	Config.in
	feeds.conf.default
	package/base-files/files/etc/hotplug2-common.rules
	package/network/config/netifd/files/etc/init.d/network

8 files changed, 257 insertions, 181 deletions

diff --git a/package/network/config/firewall/Makefile b/package/network/config/firewall/Makefile
index 05f42a62e..b7e7bba4a 100644
--- a/package/network/config/firewall/Makefile
+++ b/package/network/config/firewall/Makefile
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2008-2012 OpenWrt.org
+# Copyright (C) 2008-2013 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=firewall
 
 PKG_VERSION:=2
-PKG_RELEASE:=53
+PKG_RELEASE:=60
 
 include $(INCLUDE_DIR)/package.mk
 
diff --git a/package/network/config/firewall/files/lib/core_forwarding.sh b/package/network/config/firewall/files/lib/core_forwarding.sh
index c4a968143..2ea03f0eb 100644
--- a/package/network/config/firewall/files/lib/core_forwarding.sh
+++ b/package/network/config/firewall/files/lib/core_forwarding.sh
@@ -17,14 +17,14 @@ fw_load_forwarding() {
 
 	fw_callback pre forwarding
 
-	local chain=forward
+	local chain=delegate_forward
 	[ -n "$forwarding_src" ] && {
 		chain=zone_${forwarding_src}_forward 
 	}
 
 	local target=ACCEPT
 	[ -n "$forwarding_dest" ] && {
-		target=zone_${forwarding_dest}_ACCEPT
+		target=zone_${forwarding_dest}_dest_ACCEPT
 	}
 
 	local mode
diff --git a/package/network/config/firewall/files/lib/core_init.sh b/package/network/config/firewall/files/lib/core_init.sh
index 035647998..404a83690 100644
--- a/package/network/config/firewall/files/lib/core_init.sh
+++ b/package/network/config/firewall/files/lib/core_init.sh
@@ -115,13 +115,13 @@ fw_load_defaults() {
 		fw add i n POSTROUTING postrouting_rule
 	}
 
-	fw add i f input
-	fw add i f output
-	fw add i f forward
+	fw add i f delegate_input
+	fw add i f delegate_output
+	fw add i f delegate_forward
 
-	fw add i f INPUT   input
-	fw add i f OUTPUT  output
-	fw add i f FORWARD forward
+	fw add i f INPUT   delegate_input
+	fw add i f OUTPUT  delegate_output
+	fw add i f FORWARD delegate_forward
 
 	fw add i f reject
 	fw add i f reject REJECT { --reject-with tcp-reset -p tcp }
@@ -138,21 +138,28 @@ fw_config_get_zone() {
 	fw_config_get_section "$1" zone { \
 		string name "$1" \
 		string network "" \
+		string device "" \
+		string subnet "" \
 		string input "$FW_DEFAULT_INPUT_POLICY" \
 		string output "$FW_DEFAULT_OUTPUT_POLICY" \
 		string forward "$FW_DEFAULT_FORWARD_POLICY" \
 		boolean masq 0 \
 		string masq_src "" \
 		string masq_dest "" \
+		string extra "" \
+		string extra_src "" \
+		string extra_dest "" \
 		boolean conntrack 0 \
 		boolean mtu_fix 0 \
-		boolean custom_chains "$FW_ADD_CUSTOM_CHAINS" \
+		boolean custom_chains 0 \
 		boolean log 0 \
 		string log_limit 10 \
 		string family "" \
 	} || return
 	[ -n "$zone_name" ] || zone_name=$zone_NAME
-	[ -n "$zone_network" ] || zone_network=$zone_name
+	[ -n "$zone_extra_src" ] || zone_extra_src="$zone_extra"
+	[ -n "$zone_extra_dest" ] || zone_extra_dest="$zone_extra"
+	[ -n "$zone_network$zone_subnet$zone_device$zone_extra_src$zone_extra_dest" ] || zone_network=$zone_name
 }
 
 fw_load_zone() {
@@ -192,19 +199,22 @@ fw_load_zone() {
 
 	local chain=zone_${zone_name}
 
-	fw add $mode f ${chain}_ACCEPT
-	fw add $mode f ${chain}_DROP
-	fw add $mode f ${chain}_REJECT
+	fw add $mode f ${chain}_src_ACCEPT
+	fw add $mode f ${chain}_src_DROP
+	fw add $mode f ${chain}_src_REJECT
 
-	# TODO: Rename to ${chain}_input
-	fw add $mode f ${chain}
-	fw add $mode f ${chain} ${chain}_${zone_input} $
+	fw add $mode f ${chain}_dest_ACCEPT
+	fw add $mode f ${chain}_dest_DROP
+	fw add $mode f ${chain}_dest_REJECT
+
+	fw add $mode f ${chain}_input
+	fw add $mode f ${chain}_input ${chain}_src_${zone_input} $
 
 	fw add $mode f ${chain}_forward
-	fw add $mode f ${chain}_forward ${chain}_${zone_forward} $
+	fw add $mode f ${chain}_forward ${chain}_dest_${zone_forward} $
 
-	# TODO: add ${chain}_output
-	fw add $mode f output ${chain}_${zone_output} $
+	fw add $mode f ${chain}_output
+	fw add $mode f ${chain}_output ${chain}_dest_${zone_output} $
 
 	# TODO: Rename to ${chain}_MASQUERADE
 	fw add $mode n ${chain}_nat
@@ -223,7 +233,7 @@ fw_load_zone() {
 			fw_die "zone ${zone_name}: custom_chains globally disabled"
 
 		fw add $mode f input_${zone_name}
-		fw add $mode f ${chain} input_${zone_name} ^
+		fw add $mode f ${chain}_input input_${zone_name} ^
 
 		fw add $mode f forwarding_${zone_name}
 		fw add $mode f ${chain}_forward forwarding_${zone_name} ^
@@ -238,13 +248,16 @@ fw_load_zone() {
 
 		local t
 		for t in REJECT DROP; do
-			fw add $mode f ${chain}_${t} LOG ^ \
-				{ -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " }
+			local d
+			for d in src dest; do
+				fw add $mode f ${chain}_${d}_${t} LOG ^ \
+					{ -m limit --limit $zone_log_limit --log-prefix "$t($d:$zone_name): " }
+			done
 		done
 
 		[ $zone_mtu_fix == 1 ] && \
 			fw add $mode m ${chain}_MSSFIX LOG ^ \
-				{ -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " }
+				{ -p tcp --tcp-flags SYN,RST SYN -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " }
 	}
 
 	# NB: if MASQUERADING for IPv6 becomes available we'll need a family check here
@@ -267,6 +280,16 @@ fw_load_zone() {
 		done
 	fi
 
+	local dev
+	for dev in ${zone_device:-""}; do
+		local net
+		for net in ${zone_subnet:-""}; do
+			[ -n "$dev" ] || [ -n "$net" ] || continue
+			fw_do_interface_rules add "${zone_name}" "$dev" "$net" \
+                "${zone_extra_src}" "${zone_extra_dest}"
+		done
+	done
+
 	fw_callback post zone
 }
 
@@ -293,7 +316,7 @@ fw_load_include() {
 			fw_log error "You cannot use UCI in firewall includes!" >&2
 			exit 1
 		}
-		. $path 
+		. $path
 	)
 }
 
diff --git a/package/network/config/firewall/files/lib/core_interface.sh b/package/network/config/firewall/files/lib/core_interface.sh
index 3d6718431..9138cbf0c 100644
--- a/package/network/config/firewall/files/lib/core_interface.sh
+++ b/package/network/config/firewall/files/lib/core_interface.sh
@@ -1,4 +1,4 @@
-# Copyright (C) 2009-2012 OpenWrt.org
+# Copyright (C) 2009-2013 OpenWrt.org
 
 fw__uci_state_add() {
 	local var="$1"
@@ -31,6 +31,73 @@ fw__uci_state_del() {
 	uci_toggle_state firewall core $var "$rest"
 }
 
+fw_do_interface_rules() {
+    local action=$1
+    local zone=$2
+    local chain=zone_${zone}
+    local ifname=$3
+    local subnet=$4
+    local extra_src="$5"
+    local extra_dest="$6"
+
+    local idev odev inet onet mode
+    fw_get_family_mode mode x $zone i
+
+    fw_get_negation idev '-i' "$ifname"
+    fw_get_negation odev '-o' "$ifname"
+
+    case "$mode/$subnet" in
+        # Zone supports v6 only or dual, need v6
+        G6/*:*|i/*:*)
+            fw_get_negation inet '-s' "$subnet"
+            fw_get_negation onet '-d' "$subnet"
+            mode=6
+        ;;
+
+        # Zone supports v4 only or dual, need v4
+        G4/*.*.*.*|i/*.*.*.*)
+            fw_get_negation inet '-s' "$subnet"
+            fw_get_negation onet '-d' "$subnet"
+            mode=4
+        ;;
+
+        # Need v6 while zone is v4
+        */*:*) fw_log info "zone $zone does not support IPv6 address family, skipping"; return ;;
+
+        # Need v4 while zone is v6
+        */*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;;
+
+        # Strip prefix
+        *) mode="${mode#G}" ;;
+    esac
+
+    lock /var/run/firewall-interface.lock
+
+    fw $action $mode f ${chain}_dest_ACCEPT ACCEPT $ { $odev $onet $extra_dest }
+    fw $action $mode f ${chain}_src_ACCEPT  ACCEPT $ { $idev $inet $extra_src  }
+    fw $action $mode f ${chain}_dest_DROP   DROP   $ { $odev $onet $extra_dest }
+    fw $action $mode f ${chain}_src_DROP    DROP   $ { $idev $inet $extra_src  }
+    fw $action $mode f ${chain}_dest_REJECT reject $ { $odev $onet $extra_dest }
+    fw $action $mode f ${chain}_src_REJECT  reject $ { $idev $inet $extra_src  }
+
+    [ "$(uci_get_state firewall core "${zone}_tcpmss")" == 1 ] && \
+        fw $action $mode m ${chain}_MSSFIX TCPMSS $ \
+            { $odev -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet $extra_dest }
+
+    fw $action $mode f delegate_input   ${chain}_input   $ { $idev $inet $extra_src  }
+    fw $action $mode f delegate_forward ${chain}_forward $ { $idev $inet $extra_src  }
+    fw $action $mode f delegate_output  ${chain}_output  $ { $odev $onet $extra_dest }
+
+    fw $action $mode n PREROUTING ${chain}_prerouting $ { $idev $inet $extra_src  }
+    fw $action $mode r PREROUTING ${chain}_notrack    $ { $idev $inet $extra_src  }
+    fw $action $mode n POSTROUTING ${chain}_nat       $ { $odev $onet $extra_dest }
+
+    # Flush conntrack table
+    echo f >/proc/net/nf_conntrack 2>/dev/null
+
+    lock -u /var/run/firewall-interface.lock
+}
+
 fw_configure_interface() {
 	local iface=$1
 	local action=$2
@@ -52,63 +119,6 @@ fw_configure_interface() {
 
 	fw_callback pre interface
 
-	fw__do_rules() {
-		local action=$1
-		local zone=$2
-		local chain=zone_${zone}
-		local ifname=$3
-		local subnet=$4
-
-		local inet onet mode
-		fw_get_family_mode mode x $zone i
-
-		case "$mode/$subnet" in
-			# Zone supports v6 only or dual, need v6
-			G6/*:*|i/*:*)
-				inet="-s $subnet -d ::/0"
-				onet="-s ::/0 -d $subnet"
-				mode=6
-			;;
-
-			# Zone supports v4 only or dual, need v4
-			G4/*.*.*.*|i/*.*.*.*)
-				inet="-s $subnet -d 0.0.0.0/0"
-				onet="-s 0.0.0.0/0 -d $subnet"
-				mode=4
-			;;
-
-			# Need v6 while zone is v4
-			*/*:*) fw_log info "zone $zone does not support IPv6 address family, skipping"; return ;;
-
-			# Need v4 while zone is v6
-			*/*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;;
-
-			# Strip prefix
-			*) mode="${mode#G}" ;;
-		esac
-
-		lock /var/run/firewall-interface.lock
-
-		fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -o "$ifname" $onet }
-		fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -i "$ifname" $inet }
-		fw $action $mode f ${chain}_DROP   DROP   $ { -o "$ifname" $onet }
-		fw $action $mode f ${chain}_DROP   DROP   $ { -i "$ifname" $inet }
-		fw $action $mode f ${chain}_REJECT reject $ { -o "$ifname" $onet }
-		fw $action $mode f ${chain}_REJECT reject $ { -i "$ifname" $inet }
-
-		[ "$(uci_get_state firewall core "${zone}_tcpmss")" == 1 ] && \
-			fw $action $mode m ${chain}_MSSFIX TCPMSS $ \
-				{ -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet }
-
-		fw $action $mode f input   ${chain}         $ { -i "$ifname" $inet }
-		fw $action $mode f forward ${chain}_forward $ { -i "$ifname" $inet }
-		fw $action $mode n PREROUTING ${chain}_prerouting $ { -i "$ifname" $inet }
-		fw $action $mode r PREROUTING ${chain}_notrack    $ { -i "$ifname" $inet }
-		fw $action $mode n POSTROUTING ${chain}_nat       $ { -o "$ifname" $onet }
-
-		lock -u /var/run/firewall-interface.lock
-	}
-
 	local old_zones old_ifname old_subnets
 	config_get old_zones core "${iface}_zone"
 	[ -n "$old_zones" ] && {
@@ -120,7 +130,7 @@ fw_configure_interface() {
 			local n
 			for n in ${old_subnets:-""}; do
 				fw_log info "removing $iface ($old_ifname${n:+ alias $n}) from zone $z"
-				fw__do_rules del $z $old_ifname $n
+				fw_do_interface_rules del $z $old_ifname $n
 			done
 
 			[ -n "$old_subnets" ] || {
@@ -179,7 +189,7 @@ fw_configure_interface() {
 		list_contains zone_network "$iface" || return
 
 		fw_log info "adding $iface ($ifname${aliasnet:+ alias $aliasnet}) to zone $zone_name"
-		fw__do_rules add ${zone_name} "$ifname" "$aliasnet"
+		fw_do_interface_rules add ${zone_name} "$ifname" "$aliasnet"
 		append new_zones $zone_name
 
 		[ -n "$aliasnet" ] || {
@@ -202,4 +212,3 @@ fw_sysctl_interface() {
 		sysctl -w net.ipv6.conf.${ifname}.accept_source_route=$FW_ACCEPT_SRC_ROUTE
 	} >/dev/null 2>/dev/null
 }
-
diff --git a/package/network/config/firewall/files/lib/core_redirect.sh b/package/network/config/firewall/files/lib/core_redirect.sh
index fe396c1c1..9493bc6ae 100644
--- a/package/network/config/firewall/files/lib/core_redirect.sh
+++ b/package/network/config/firewall/files/lib/core_redirect.sh
@@ -41,7 +41,7 @@ fw_load_redirect() {
 		# in this case match only DNATed traffic and allow it on input, not forward
 		if [ -z "$redirect_dest_ip" ] || /sbin/ifconfig | grep -qE "addr:${redirect_dest_ip//./\\.}\b"; then
 			fwdopt="-m conntrack --ctstate DNAT"
-			fwdchain="zone_${redirect_src}"
+			fwdchain="zone_${redirect_src}_input"
 		else
 			fwdchain="zone_${redirect_src}_forward"
 		fi
@@ -114,7 +114,7 @@ fw_load_redirect() {
 				$redirect_options \
 			}
 
-			fw add $mode f ${fwdchain:-forward} ACCEPT + \
+			fw add $mode f ${fwdchain:-delegate_forward} ACCEPT + \
 				{ $redirect_src_ip $redirect_dest_ip } { \
 				$srcaddr $destaddr \
 				$pr \
diff --git a/package/network/config/firewall/files/lib/core_rule.sh b/package/network/config/firewall/files/lib/core_rule.sh
index f49c42af5..0ce2122be 100644
--- a/package/network/config/firewall/files/lib/core_rule.sh
+++ b/package/network/config/firewall/files/lib/core_rule.sh
@@ -34,7 +34,7 @@ fw_load_rule() {
 	fw_callback pre rule
 
 	local table=f
-	local chain=input
+	local chain=delegate_output
 	local target="${rule_target:-REJECT}"
 	if [ "$target" == "NOTRACK" ]; then
 		table=r
@@ -42,16 +42,23 @@ fw_load_rule() {
 	else
 		if [ -n "$rule_src" ]; then
 			if [ "$rule_src" != "*" ]; then
-				chain="zone_${rule_src}${rule_dest:+_forward}"
+				if [ -n "$rule_dest" ]; then
+					chain="zone_${rule_src}_forward"
+				else
+					chain="zone_${rule_src}_input"
+				fi
 			else
-				chain="${rule_dest:+forward}"
-				chain="${chain:-input}"
+				chain="${rule_dest:+delegate_forward}"
+				chain="${chain:-delegate_input}"
 			fi
 		fi
 
 		if [ -n "$rule_dest" ]; then
 			if [ "$rule_dest" != "*" ]; then
-				target="zone_${rule_dest}_${target}"
+				target="zone_${rule_dest}_dest_${target}"
+				if [ -z "$rule_src" ]; then
+					chain="zone_${rule_dest}_output"
+				fi
 			elif [ "$target" = REJECT ]; then
 				target=reject
 			fi
diff --git a/package/network/config/firewall/files/lib/fw.sh b/package/network/config/firewall/files/lib/fw.sh
index 76e294f56..ca851e81c 100644
--- a/package/network/config/firewall/files/lib/fw.sh
+++ b/package/network/config/firewall/files/lib/fw.sh
@@ -170,7 +170,7 @@ fw__exec() { # <action> <family> <table> <chain> <target> <position> { <rules> }
 					fw_log info "ICMP type '$2' is not valid for $fam address family, skipping rule"
 					return 1
 				fi
-				shift	
+				shift
 			;;
 			*) cmdline="$cmdline $1" ;;
 		esac
diff --git a/package/network/config/firewall/files/reflection.hotplug b/package/network/config/firewall/files/reflection.hotplug
index 843c615bc..129a922e4 100644
--- a/package/network/config/firewall/files/reflection.hotplug
+++ b/package/network/config/firewall/files/reflection.hotplug
@@ -3,34 +3,59 @@
 . /lib/functions.sh
 . /lib/functions/network.sh
 
-if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
-	local wanip
-	network_get_ipaddr wanip wan || return
-
-	iptables -t nat -F nat_reflection_in 2>/dev/null || {
-		iptables -t nat -N nat_reflection_in
-		iptables -t nat -A prerouting_rule -j nat_reflection_in
+if [ "$ACTION" = "remove" ]; then
+
+	delete_rules_by_comment() {
+		local table="$1"
+		local chain="$2"
+		local comment="$3"
+
+		iptables -t "$table" --line-numbers -nL "$chain" 2>/dev/null | \
+			sed -e '
+				1d;
+				1! {
+					\#^[0-9]\+ .* /\* '"$comment"' \*/.*$# {
+						s/ .*$//;
+						G; h;
+					}
+				};
+				$!d;
+			' | xargs -n1 iptables -t "$table" -D "$chain" 2>/dev/null
 	}
 
-	iptables -t nat -F nat_reflection_out 2>/dev/null || {
-		iptables -t nat -N nat_reflection_out
-		iptables -t nat -A postrouting_rule -j nat_reflection_out
-	}
+	delete_rules_by_comment nat    nat_reflection_in  "$INTERFACE"
+	delete_rules_by_comment nat    nat_reflection_out "$INTERFACE"
+	delete_rules_by_comment filter nat_reflection_fwd "$INTERFACE"
+
+elif [ "$ACTION" = "add" ]; then
+
+	prepare_chains() {
+		iptables -t nat -N nat_reflection_in 2>/dev/null && {
+			iptables -t nat -A prerouting_rule -j nat_reflection_in
+		}
+
+		iptables -t nat -N nat_reflection_out 2>/dev/null && {
+			iptables -t nat -A postrouting_rule -j nat_reflection_out
+		}
 
-	iptables -t filter -F nat_reflection_fwd 2>/dev/null || {
-		iptables -t filter -N nat_reflection_fwd
-		iptables -t filter -A forwarding_rule -j nat_reflection_fwd
+		iptables -t filter -N nat_reflection_fwd 2>/dev/null && {
+			iptables -t filter -A forwarding_rule -j nat_reflection_fwd
+		}
 	}
 
 	find_networks() {
 		find_networks_cb() {
 			local cfg="$1"
 			local zone="$2"
+			local need_masq="${3:-0}"
 
 			local name
 			config_get name "$cfg" name
 
-			[ "$name" = "$zone" ] && {
+			local masq
+			config_get_bool masq "$cfg" masq 0
+
+			[ "$name" = "$zone" ] && [ "$masq" -ge "$need_masq" ] && {
 				local network
 				config_get network "$cfg" network
 
@@ -39,7 +64,7 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
 			}
 		}
 
-		config_foreach find_networks_cb zone "$1"
+		config_foreach find_networks_cb zone "$@"
 	}
 
 	setup_fwd() {
@@ -51,82 +76,94 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
 
 		local src
 		config_get src "$cfg" src
+		[ "$src" == "$ZONE" ] || return
+
+		local dest
+		config_get dest "$cfg" dest
+		[ "$dest" != "*" ] || return
 
 		local target
 		config_get target "$cfg" target DNAT
-
-		[ "$src" = wan ] && [ "$target" = DNAT ] && {
-			local dest
-			config_get dest "$cfg" dest "lan"
-			[ "$dest" != "*" ] || return
-
-			local net
-			for net in $(find_networks "$dest"); do
-				local lannet
-				network_get_subnet lannet "$net" || return
-
-				local proto
-				config_get proto "$cfg" proto
-
-				local epmin epmax extport
-				config_get extport "$cfg" src_dport "1-65535"
-				[ -n "$extport" ] || return
-
-				epmin="${extport%[-:]*}"; epmax="${extport#*[-:]}"
-				[ "${epmin#!}" != "$epmax" ] || epmax=""
-
-				local ipmin ipmax intport
-				config_get intport "$cfg" dest_port "$extport"
-
-				ipmin="${intport%[-:]*}"; ipmax="${intport#*[-:]}"
-				[ "${ipmin#!}" != "$ipmax" ] || ipmax=""
-
-				local exthost
-				config_get exthost "$cfg" src_dip "$wanip"
-
-				local inthost
-				config_get inthost "$cfg" dest_ip
-				[ -n "$inthost" ] || return
-
-				[ "$proto" = all    ] && proto="tcp udp"
-				[ "$proto" = tcpudp ] && proto="tcp udp"
-
-				[ "${inthost#!}" = "$inthost" ] || return 0
-				[ "${exthost#!}" = "$exthost" ] || return 0
-
-				[ "${epmin#!}" != "$epmin" ] && \
-					extport="! --dport ${epmin#!}${epmax:+:$epmax}" || \
-					extport="--dport $epmin${epmax:+:$epmax}"
-
-				[ "${ipmin#!}" != "$ipmin" ] && \
-					intport="! --dport ${ipmin#!}${ipmax:+:$ipmax}" || \
-					intport="--dport $ipmin${ipmax:+:$ipmax}"
-
-				local p
-				for p in ${proto:-tcp udp}; do
-					case "$p" in
-						tcp|udp|6|17)
-							iptables -t nat -A nat_reflection_in \
-								-s $lannet -d $exthost \
-								-p $p $extport \
-								-j DNAT --to $inthost:${ipmin#!}${ipmax:+-$ipmax}
-
-							iptables -t nat -A nat_reflection_out \
-								-s $lannet -d $inthost \
-								-p $p $intport \
-								-j SNAT --to-source ${lannet%%/*}
-
-							iptables -t filter -A nat_reflection_fwd \
-								-s $lannet -d $inthost \
-								-p $p $intport \
-								-j ACCEPT
-						;;
-					esac
-				done
+		[ "$target" = DNAT ] || return
+
+		prepare_chains
+
+		local net
+		for net in $(find_networks "$dest" 0); do
+			local intnet
+			network_get_subnet intnet "$net" || continue
+
+			local proto
+			config_get proto "$cfg" proto
+
+			local epmin epmax extport
+			config_get extport "$cfg" src_dport "1-65535"
+			[ -n "$extport" ] || return
+
+			epmin="${extport%[-:]*}"; epmax="${extport#*[-:]}"
+			[ "${epmin#!}" != "$epmax" ] || epmax=""
+
+			local ipmin ipmax intport
+			config_get intport "$cfg" dest_port "$extport"
+
+			ipmin="${intport%[-:]*}"; ipmax="${intport#*[-:]}"
+			[ "${ipmin#!}" != "$ipmax" ] || ipmax=""
+
+			local exthost
+			config_get exthost "$cfg" src_dip "$extip"
+
+			local inthost
+			config_get inthost "$cfg" dest_ip
+			[ -n "$inthost" ] || return
+
+			[ "$proto" = all    ] && proto="tcp udp"
+			[ "$proto" = tcpudp ] && proto="tcp udp"
+
+			[ "${inthost#!}" = "$inthost" ] || return 0
+			[ "${exthost#!}" = "$exthost" ] || return 0
+
+			[ "${epmin#!}" != "$epmin" ] && \
+				extport="! --dport ${epmin#!}${epmax:+:$epmax}" || \
+				extport="--dport $epmin${epmax:+:$epmax}"
+
+			[ "${ipmin#!}" != "$ipmin" ] && \
+				intport="! --dport ${ipmin#!}${ipmax:+:$ipmax}" || \
+				intport="--dport $ipmin${ipmax:+:$ipmax}"
+
+			local p
+			for p in ${proto:-tcp udp}; do
+				case "$p" in
+					tcp|udp|6|17)
+						iptables -t nat -A nat_reflection_in \
+							-s $intnet -d $exthost \
+							-p $p $extport \
+							-m comment --comment "$INTERFACE" \
+							-j DNAT --to $inthost:${ipmin#!}${ipmax:+-$ipmax}
+
+						iptables -t nat -A nat_reflection_out \
+							-s $intnet -d $inthost \
+							-p $p $intport \
+							-m comment --comment "$INTERFACE" \
+							-j SNAT --to-source ${intnet%%/*}
+
+						iptables -t filter -A nat_reflection_fwd \
+							-s $intnet -d $inthost \
+							-p $p $intport \
+							-m comment --comment "$INTERFACE" \
+							-j ACCEPT
+					;;
+				esac
 			done
-		}
+		done
 	}
 
 	config_load firewall
+
+	local is_masq_zone="$(find_networks "$ZONE" 1)"
+	[ -n "$is_masq_zone" ] || exit 0
+
+	local extip
+	network_get_ipaddr extip "$INTERFACE" || exit 0
+
 	config_foreach setup_fwd redirect
 fi