. $dir/functions.sh
wan_is_olsr=$(uci -q get meshwizard.netconfig.wan_config)
-lan_is_olsr=$(uci -q get meshwizard.netconfig.lan_config)
config_load firewall
fi
fi
- if [ "$name" == "lan" ] && [ "$lan_is_olsr" == 1 ]; then
+ if [ "$name" == "lan" ] && [ "$lan_is_olsr" == "1" ]; then
uci set firewall.$1.network=' ' && uci_commitverbose "LAN is used for olsr, removed the lan interface from zone lan" firewall
fi
}
fi
-# Rules, Forwardings, advanced config and includes
-
-for config in freifunk profile_$community; do
-
- config_load $config
+# Rules, Forwardings, advanced config and includes from freifunk and
+# profile_$community config files.
+
+add_fw_rules() {
+ config_cb() {
+ local type="$1"
+ local name="$2"
+ local allowed_section_types="advanced include fw_rule fw_forwarding"
+ if is_in_list "$allowed_section_types" $type ; then
+ uci set firewall.${name}="${type/fw_/}"
+ option_cb() {
+ local option="$1"
+ local value="$2"
+ uci set firewall.${CONFIG_SECTION}.${option}="$value"
+ }
+ else
+ option_cb() { return; }
+ fi
+ }
+ config_load freifunk
+ config_load profile_${community}
+}
+add_fw_rules
- for section in advanced include fw_rule fw_forwarding; do
- handle_firewall() {
- local options=$(uci show $config."$1")
- options=$(echo "$options" | sed -e "s/fw_//g" -e "s/^$config/firewall/g")
- for o in $options; do
- uci set $o
- done
- }
- config_foreach handle_firewall $section
- done
-done
# If we use auto-ipv6-dhcp then allow 547/udp on the freifunk zone
-if [ "$profile_ipv6_config" = "auto-ipv6-dhcpv6" ]; then
+if [ "$ipv6_config" = "auto-ipv6-dhcpv6" ]; then
uci batch <<- EOF
set firewall.dhcpv6=rule
set firewall.dhcpv6.src=freifunk
EOF
fi
+# Firewall rules to allow incoming ssh and web if enabled
+
+if [ "$wan_allowssh" == 1 ]; then
+ uci batch <<- EOF
+ set firewall.wanssh=rule
+ set firewall.wanssh.src=wan
+ set firewall.wanssh.target=ACCEPT
+ set firewall.wanssh.proto=tcp
+ set firewall.wanssh.dest_port=22
+ EOF
+fi
+
+if [ "$wan_allowweb" == 1 ]; then
+ uci batch <<- EOF
+ set firewall.wanweb=rule
+ set firewall.wanweb.src=wan
+ set firewall.wanweb.target=ACCEPT
+ set firewall.wanweb.proto=tcp
+ set firewall.wanweb.dest_port=80
+ set firewall.wanwebhttps=rule
+ set firewall.wanwebhttps.src=wan
+ set firewall.wanwebhttps.target=ACCEPT
+ set firewall.wanwebhttps.proto=tcp
+ set firewall.wanwebhttps.dest_port=443
+ EOF
+fi
+
uci_commitverbose "Setup rules, forwardings, advanced config and includes." firewall