1 #!/bin/sh /etc/rc.common
6 config_get proto "$cfg" proto
7 config_get dport "$cfg" dport
8 config_get iface "$cfg" iface
9 config_get to "$cfg" to
11 config_get ifname "$iface" ifname
13 [ -n "$proto" ] || return 0
14 [ -n "$dport" ] || return 0
15 [ -n "$ifname" ] || return 0
16 [ -n "$to" ] || return 0
18 dport=$(echo $dport | sed -e 's/-/:/')
20 ports=$(echo $to | cut -sd: -f2)
21 if [ -n "$ports" ]; then
22 ports="--dport $(echo $ports | sed -e 's/-/:/')"
24 ports="--dport $dport"
27 ip=$(echo $to | cut -d: -f1)
29 if ([ "$proto" == "tcpudp" ] || [ "$proto" == "tcp" ]); then
30 iptables -t nat -A luci_fw_prerouting -i "$ifname" -p tcp --dport "$dport" -j DNAT --to "$to"
31 iptables -A luci_fw_forward -i "$ifname" -p tcp -d "$ip" $ports -j ACCEPT
34 if ([ "$proto" == "tcpudp" ] || [ "$proto" == "udp" ]); then
35 iptables -t nat -A luci_fw_prerouting -i "$ifname" -p udp --dport "$dport" -j DNAT --to "$to"
36 iptables -A luci_fw_forward -i "$ifname" -p udp -d "$ip" $ports -j ACCEPT
42 config_get iface "$cfg" iface
43 config_get oface "$cfg" oface
44 config_get_bool fwd "$cfg" fwd
45 config_get_bool nat "$cfg" nat
46 config_get_bool bidi "$cfg" bidi
48 config_get ifname "$iface" ifname
49 config_get ofname "$oface" ifname
51 [ -n "$ifname" ] || return 0
52 [ -n "$ofname" ] || return 0
55 iptables -A luci_fw_forward -i "$ifname" -o "$ofname" -j ACCEPT
56 [ "$bidi" -gt 0 ] && iptables -A luci_fw_forward -i "$ofname" -o "$ifname" -j ACCEPT
60 config_get ifip "$iface" ipaddr
61 config_get ifmask "$iface" netmask
62 eval "$(ipcalc.sh $ifip $ifmask)"
64 iptables -t nat -A luci_fw_postrouting -s "$NETWORK/$PREFIX" -o "$ofname" -j MASQUERADE
66 [ "$bidi" -gt 0 ] && {
67 config_get ofip "$oface" ipaddr
68 config_get ofmask "$oface" netmask
69 eval "$(ipcalc.sh $ofip $ofmask)"
71 iptables -t nat -A luci_fw_postrouting -s "$NETWORK/$PREFIX" -o "$ifname" -j MASQUERADE
80 config_get chain "$cfg" chain
81 [ -n "$chain" ] || return 0
82 [ "$chain" == "forward" ] && cmd="$cmd -A luci_fw_forward"
83 [ "$chain" == "input" ] && cmd="$cmd -A luci_fw_input"
84 [ "$chain" == "output" ] && cmd="$cmd -A luci_fw_output"
85 [ "$chain" == "prerouting" ] && cmd="$cmd -t nat -A luci_fw_prerouting"
86 [ "$chain" == "postrouting" ] && cmd="$cmd -t nat -A luci_fw_postrouting"
88 config_get iface "$cfg" iface
89 config_get ifname "$iface" ifname
90 [ -n "$ifname" ] && cmd="$cmd -i $ifname"
92 config_get oface "$cfg" oface
93 config_get ofname "$oface" ifname
94 [ -n "$ofname" ] && cmd="$cmd -o $ofname"
96 config_get proto "$cfg" proto
97 [ -n "$proto" ] && cmd="$cmd -p $proto"
99 config_get source "$cfg" source
100 [ -n "$source" ] && cmd="$cmd -s $source"
102 config_get destination "$cfg" destination
103 [ -n "$destination" ] && cmd="$cmd -d $destination"
105 config_get sport "$cfg" sport
106 [ -n "$sport" ] && cmd="$cmd --sport $sport"
108 config_get dport "$cfg" dport
109 [ -n "$dport" ] && cmd="$cmd --dport $dport"
111 config_get todest "$cfg" todest
112 [ -n "$todest" ] && cmd="$cmd --to-destination $todest"
114 config_get tosrc "$cfg" tosrc
115 [ -n "$tosrc" ] && cmd="$cmd --to-source $tosrc"
117 config_get mac "$cfg" mac
118 [ -n "$mac" ] && cmd="$cmd -m mac --mac-source $mac"
120 config_get jump "$cfg" jump
121 [ -n "$jump" ] && cmd="$cmd -j $jump"
123 config_get command "$cfg" command
124 [ -n "$command" ] && cmd="$cmd $command"
131 iptables -N luci_fw_input
132 iptables -N luci_fw_output
133 iptables -N luci_fw_forward
134 iptables -t nat -N luci_fw_prerouting
135 iptables -t nat -N luci_fw_postrouting
137 ### Hook in the chains
138 iptables -A input_rule -j luci_fw_input
139 iptables -A output_rule -j luci_fw_output
140 iptables -A forwarding_rule -j luci_fw_forward
141 iptables -t nat -A prerouting_rule -j luci_fw_prerouting
142 iptables -t nat -A postrouting_rule -j luci_fw_postrouting
144 ### Scan network interfaces
148 ### Read chains from config
150 config_foreach apply_rule rule
151 config_foreach apply_portfw portfw
152 config_foreach apply_routing routing
156 ### Hook out the chains
157 iptables -D input_rule -j luci_fw_input
158 iptables -D output_rule -j luci_fw_output
159 iptables -D forwarding_rule -j luci_fw_forward
160 iptables -t nat -D prerouting_rule -j luci_fw_prerouting
161 iptables -t nat -D postrouting_rule -j luci_fw_postrouting
164 iptables -F luci_fw_input
165 iptables -F luci_fw_output
166 iptables -F luci_fw_forward
167 iptables -t nat -F luci_fw_prerouting
168 iptables -t nat -F luci_fw_postrouting
171 iptables -X luci_fw_input
172 iptables -X luci_fw_output
173 iptables -X luci_fw_forward
174 iptables -t nat -X luci_fw_prerouting
175 iptables -t nat -X luci_fw_postrouting