#!/bin/sh
-# This will add $net to the zone firewall (and remove it from other zones where it is referenced)
-# It will also setup rules defined in /etc/config/freifunk and /etc/config/profile_<community>
-# Arg $1 = $net
+# Add "freifunk" firewall zone
+# If wan/lan is used for olsr then remove these networks from wan/lan zones
+# Also setup rules defined in /etc/config/freifunk and /etc/config/profile_<community>
-net=$1
-. /etc/functions.sh
+. /lib/functions.sh
. $dir/functions.sh
-config_load firewall
-# Get some variables
-type="$(uci -q get wireless.$net.type)"
-vap="$(uci -q get meshwizard.netconfig.$net\_vap)"
+wan_is_olsr=$(uci -q get meshwizard.netconfig.wan_config)
+lan_is_olsr=$(uci -q get meshwizard.netconfig.lan_config)
-# Add local_restrict to wan firewall zone
-handle_zonewan() {
- config_get name "$1" name
- if [ "$name" == "wan" ]; then
- uci set firewall.$1.local_restrict=1
- fi
-}
-config_foreach handle_zonewan zone && echo " + Enable local_restrict for zone wan"
+config_load firewall
+
+# Rename firewall zone for freifunk if unnamed
+# If wan is used for olsr then set network for the firewall zone wan to ' ' to remove the wan interface from it, else add local restrict to it
+# If lan is used for olsr then set network for the firewall zone lan to ' ' to remove the lan interface from it
-# Delete old firewall zone for freifunk
handle_fwzone() {
config_get name "$1" name
config_get network "$1" network
- if [ "$2" == "zoneconf" ]; then
- # clean zone
- if [ "$name" == "freifunk" ]; then
- if [ "$cleanup" == 1 ]; then
- section_cleanup firewall.$1
- else
- # rename section if unnamed
- if [ -z "${1/cfg[0-9a-fA-F]*/}" ]; then
- section_rename firewall $1 zone_freifunk
- fi
- fi
- else
-
- if [ "$name" == "$netrenamed" ]; then
- section_cleanup firewall.$1
- fi
- if [ -n "$netrenamed" -a -n "$(echo $network | grep $netrenamed)" ] && [ ! "$name" == "freifunk" ]; then
- echo " Removed $netrenamed from firewall zone $name."
- network_new=$(echo $network | sed -e 's/'$netrenamed'//' -e 's/^ //' -e 's/ / /' -e 's/ $//')
- uci set firewall.$1.network="$network_new"
- fi
- fi
- else
- # clean fw_rule, fw_forwarding, include and advanced
- for option in src tcp_ecn path; do
- config_get $option $1 $option
- done
- if [ "$src" == "freifunk" -o "$path" == "/etc/firewall.freifunk" -o -n "$tcpecn" ]; then
- section_cleanup firewall.$1
+ if [ "$name" == "freifunk" ]; then
+ # rename section if unnamed
+ if [ -z "${1/cfg[0-9a-fA-F]*/}" ]; then
+ section_rename firewall $1 zone_freifunk
fi
fi
-}
-
-config_foreach handle_fwzone zone zoneconf
-
-if [ "$cleanup" == 1 ]; then
- for target in include advanced rule forwarding; do
- config_foreach handle_fwzone $target
- done
-fi
-# setup freifunk firewall zone
-
-echo " + Setup firewall zone."
-
-# add $netrenamed and if needed ${netrenamed}dhcp to the networks for this zone
-config_get network zone_freifunk network
-
-# remove ${netrenamed}dhcp from networks list
-[ -n "$network" -a -n "$net" ] && network="${network/${netrenamed}dhcp/}"
-network=$(echo $network) # Removes leading and trailing whitespaces
+ if [ "$name" == "wan" ]; then
+ if [ "$wan_is_olsr" == 1 ]; then
+ uci set firewall.$1.network=' ' && uci_commitverbose "WAN is used for olsr, removed the wan interface from zone wan" firewall
+ else
+ uci set firewall.$1.local_restrict=1 && uci_commitverbose "Enable local_restrict for zone wan" firewall
+ fi
+ fi
-[ -n "$netrenamed" ] && [ -z "$(echo $network | grep $netrenamed)" ] && network="$network $netrenamed"
+ if [ "$name" == "lan" ] && [ "$lan_is_olsr" == 1 ]; then
+ uci set firewall.$1.network=' ' && uci_commitverbose "LAN is used for olsr, removed the lan interface from zone lan" firewall
+ fi
+}
-if [ "$type" == "atheros" -a "$vap" == 1 ]; then
- [ -n "$netrenamed" ] && [ "$network" == "${network/${netrenamed}dhcp/}" ] && network="$network ${netrenamed}dhcp"
-fi
+config_foreach handle_fwzone zone
uci batch << EOF
-set firewall.zone_freifunk="zone"
-set firewall.zone_freifunk.name="freifunk"
-set firewall.zone_freifunk.network="$network"
-set firewall.zone_freifunk.input="$zone_freifunk_input"
-set firewall.zone_freifunk.forward="$zone_freifunk_forward"
-set firewall.zone_freifunk.output="$zone_freifunk_output"
+ set firewall.zone_freifunk="zone"
+ set firewall.zone_freifunk.name="freifunk"
+ set firewall.zone_freifunk.input="$zone_freifunk_input"
+ set firewall.zone_freifunk.forward="$zone_freifunk_forward"
+ set firewall.zone_freifunk.output="$zone_freifunk_output"
EOF
-echo " network: $network
- input: $zone_freifunk_input
- forward: $zone_freifunk_forward
- output: $zone_freifunk_output"
+uci_commitverbose "Setup firewall zones" firewall
-# Usually we need to setup masquerading for lan, except lan is an olsr interface or has an olsr hna
-
-echo " + Setup masquerading rules"
+# Usually we need to setup masquerading for lan, except lan is an olsr interface or has an olsr hna-entry
handle_interface() {
config_get interface "$1" interface
config_load olsrd
config_foreach handle_interface Interface
-handle_hna() {
- config_get netaddr "$1" netaddr
- if [ "$NETWORK" == "$netaddr" ]; then
- no_masq_lan=1
- fi
-}
-config_foreach handle_hna Hna4
+LANIP="$(uci -q get network.lan.ipaddr)"
+if [ -n "$LANIP" ]; then
+ handle_hna() {
+ config_get netaddr "$1" netaddr
+ if [ "$LANIP" == "$netaddr" ]; then
+ no_masq_lan=1
+ fi
+ }
+ config_foreach handle_hna Hna4
+fi
currms=$(uci -q get firewall.zone_freifunk.masq_src)
-if [ ! "$no_masq_lan" == "1" ]; then
- uci set firewall.zone_freifunk.masq="1" && echo " Enabled masquerading." || echo -e "\033[1mWarning:\033[0m: Could not enable masquerading."
+if [ ! "$no_masq_lan" == "1" ] && [ ! "$(uci -q get meshwizard.netconfig.lan_config)" == 1 ]; then
+ uci set firewall.zone_freifunk.masq="1"
[ -z "$(echo $currms |grep lan)" ] && uci add_list firewall.zone_freifunk.masq_src="lan"
fi
-# If wifi-interfaces are outside of the mesh network they should be natted
-for i in $networks; do
- # Get dhcprange and meshnet
- dhcprange=$(uci get meshwizard.netconfig.$i\_dhcprange)
- meshnet="$(uci get profile_$community.profile.mesh_network)"
- # check if the dhcprange is inside meshnet
- dhcpinmesh="$($dir/helpers/check-range-in-range.sh $dhcprange $meshnet)"
- if [ ! "$dhcpinmesh" == 1 ]; then
- [ -z "$(echo $currms |grep ${netrenamed}dhcp)" ] && uci add_list firewall.zone_freifunk.masq_src="${netrenamed}dhcp"
- fi
-done
-
-# Rules, Forwardings, advanced config and includes
-# Clear firewall configuration
-echo " + Setup rules, forwardings, advanced config and includes."
+# Rules, Forwardings, advanced config and includes from freifunk and
+# profile_$community config files.
+
+add_fw_rules() {
+ config_cb() {
+ local type="$1"
+ local name="$2"
+ local allowed_section_types="advanced include fw_rule fw_forwarding"
+ if is_in_list "$allowed_section_types" $type ; then
+ uci set firewall.${name}="${type/fw_/}"
+ option_cb() {
+ local option="$1"
+ local value="$2"
+ uci set firewall.${CONFIG_SECTION}.${option}="$value"
+ }
+ else
+ option_cb() { return; }
+ fi
+ }
+ config_load freifunk
+ config_load profile_${community}
+}
+add_fw_rules
+
+
+# If we use auto-ipv6-dhcp then allow 547/udp on the freifunk zone
+if [ "$ipv6_config" = "auto-ipv6-dhcpv6" ]; then
+ uci batch <<- EOF
+ set firewall.dhcpv6=rule
+ set firewall.dhcpv6.src=freifunk
+ set firewall.dhcpv6.target=ACCEPT
+ set firewall.dhcpv6.dest_port=547
+ set firewall.dhcpv6.proto=udp
+ EOF
+fi
-for config in freifunk profile_$community; do
+# Firewall rules to allow incoming ssh and web if enabled
- config_load $config
+if [ "$wan_allowssh" == 1 ]; then
+ uci batch <<- EOF
+ set firewall.wanssh=rule
+ set firewall.wanssh.src=wan
+ set firewall.wanssh.target=ACCEPT
+ set firewall.wanssh.proto=tcp
+ set firewall.wanssh.dest_port=22
+ EOF
+fi
- for section in advanced include fw_rule fw_forwarding; do
- handle_firewall() {
- local options=$(uci show $config."$1")
- options=$(echo "$options" | sed -e "s/fw_//g" -e "s/^$config/firewall/g")
- for o in $options; do
- uci set $o
- done
- }
- config_foreach handle_firewall $section
- done
-done
+if [ "$wan_allowweb" == 1 ]; then
+ uci batch <<- EOF
+ set firewall.wanweb=rule
+ set firewall.wanweb.src=wan
+ set firewall.wanweb.target=ACCEPT
+ set firewall.wanweb.proto=tcp
+ set firewall.wanweb.dest_port=80
+ set firewall.wanwebhttps=rule
+ set firewall.wanwebhttps.src=wan
+ set firewall.wanwebhttps.target=ACCEPT
+ set firewall.wanwebhttps.proto=tcp
+ set firewall.wanwebhttps.dest_port=443
+ EOF
+fi
-uci commit
+uci_commitverbose "Setup rules, forwardings, advanced config and includes." firewall
projects / project / luci.git / blobdiff