2 # This will add $net to the zone firewall (and remove it from other zones where it is referenced)
3 # It will also setup rules defined in /etc/config/freifunk and /etc/config/profile_<community>
12 type="$(uci -q get wireless.$net.type)"
13 vap="$(uci -q get meshwizard.netconfig.$net\_vap)"
15 # Add local_restrict to wan firewall zone
17 config_get name "$1" name
18 if [ "$name" == "wan" ]; then
19 uci set firewall.$1.local_restrict=1
22 config_foreach handle_zonewan zone && echo " + Enable local_restrict for zone wan"
24 # Delete old firewall zone for freifunk
26 config_get name "$1" name
27 config_get network "$1" network
29 if [ "$2" == "zoneconf" ]; then
31 if [ "$name" == "freifunk" ]; then
32 if [ "$cleanup" == 1 ]; then
33 section_cleanup firewall.$1
35 # rename section if unnamed
36 if [ -z "${1/cfg[0-9a-fA-F]*/}" ]; then
37 section_rename firewall $1 zone_freifunk
42 if [ "$name" == "$netrenamed" ]; then
43 section_cleanup firewall.$1
45 if [ -n "$netrenamed" -a -n "$(echo $network | grep $netrenamed)" ] && [ ! "$name" == "freifunk" ]; then
46 echo " Removed $netrenamed from firewall zone $name."
47 network_new=$(echo $network | sed -e 's/'$netrenamed'//' -e 's/^ //' -e 's/ / /' -e 's/ $//')
48 uci set firewall.$1.network="$network_new"
52 # clean fw_rule, fw_forwarding, include and advanced
53 for option in src tcp_ecn path; do
54 config_get $option $1 $option
56 if [ "$src" == "freifunk" -o "$path" == "/etc/firewall.freifunk" -o -n "$tcpecn" ]; then
57 section_cleanup firewall.$1
62 config_foreach handle_fwzone zone zoneconf
64 if [ "$cleanup" == 1 ]; then
65 for target in include advanced rule forwarding; do
66 config_foreach handle_fwzone $target
70 # setup freifunk firewall zone
72 echo " + Setup firewall zone."
74 # add $netrenamed and if needed ${netrenamed}dhcp to the networks for this zone
75 config_get network zone_freifunk network
77 # remove ${netrenamed}dhcp from networks list
78 [ -n "$network" -a -n "$net" ] && network="${network/${netrenamed}dhcp/}"
79 network=$(echo $network) # Removes leading and trailing whitespaces
81 [ -n "$netrenamed" ] && [ -z "$(echo $network | grep $netrenamed)" ] && network="$network $netrenamed"
83 if [ "$type" == "atheros" -a "$vap" == 1 ]; then
84 [ -n "$netrenamed" ] && [ "$network" == "${network/${netrenamed}dhcp/}" ] && network="$network ${netrenamed}dhcp"
88 set firewall.zone_freifunk="zone"
89 set firewall.zone_freifunk.name="freifunk"
90 set firewall.zone_freifunk.network="$network"
91 set firewall.zone_freifunk.input="$zone_freifunk_input"
92 set firewall.zone_freifunk.forward="$zone_freifunk_forward"
93 set firewall.zone_freifunk.output="$zone_freifunk_output"
96 echo " network: $network
97 input: $zone_freifunk_input
98 forward: $zone_freifunk_forward
99 output: $zone_freifunk_output"
101 # Usually we need to setup masquerading for lan, except lan is an olsr interface or has an olsr hna
103 echo " + Setup masquerading rules"
106 config_get interface "$1" interface
107 if [ "$interface" == "lan" ]; then
112 config_foreach handle_interface Interface
115 config_get netaddr "$1" netaddr
116 if [ "$NETWORK" == "$netaddr" ]; then
120 config_foreach handle_hna Hna4
122 currms=$(uci -q get firewall.zone_freifunk.masq_src)
123 if [ ! "$no_masq_lan" == "1" ]; then
124 uci set firewall.zone_freifunk.masq="1" && echo " Enabled masquerading." || echo -e "\033[1mWarning:\033[0m: Could not enable masquerading."
125 [ -z "$(echo $currms |grep lan)" ] && uci add_list firewall.zone_freifunk.masq_src="lan"
128 # If wifi-interfaces are outside of the mesh network they should be natted
129 for i in $networks; do
130 # Get dhcprange and meshnet
131 dhcprange=$(uci get meshwizard.netconfig.$i\_dhcprange)
132 meshnet="$(uci get profile_$community.profile.mesh_network)"
133 # check if the dhcprange is inside meshnet
134 dhcpinmesh="$($dir/helpers/check-range-in-range.sh $dhcprange $meshnet)"
135 if [ ! "$dhcpinmesh" == 1 ]; then
136 [ -z "$(echo $currms |grep ${netrenamed}dhcp)" ] && uci add_list firewall.zone_freifunk.masq_src="${netrenamed}dhcp"
140 # Rules, Forwardings, advanced config and includes
141 # Clear firewall configuration
143 echo " + Setup rules, forwardings, advanced config and includes."
145 for config in freifunk profile_$community; do
149 for section in advanced include fw_rule fw_forwarding; do
151 local options=$(uci show $config."$1")
152 options=$(echo "$options" | sed -e "s/fw_//g" -e "s/^$config/firewall/g")
153 for o in $options; do
157 config_foreach handle_firewall $section