From 799de8987c5c70ce70429700014fd3768b41f3a0 Mon Sep 17 00:00:00 2001 From: Steven Barth Date: Tue, 1 Apr 2008 21:36:09 +0000 Subject: [PATCH] * Added backend for firewall / portforwarding --- contrib/init.d/luci_fw | 120 ++++++++++++++++++++++++ contrib/package/ffluci/Makefile | 2 + src/ffluci/model/cbi/admin_network/firewall.lua | 46 +++++++-- src/ffluci/model/cbi/admin_network/portfw.lua | 10 +- 4 files changed, 169 insertions(+), 9 deletions(-) create mode 100644 contrib/init.d/luci_fw diff --git a/contrib/init.d/luci_fw b/contrib/init.d/luci_fw new file mode 100644 index 000000000..f393719ab --- /dev/null +++ b/contrib/init.d/luci_fw @@ -0,0 +1,120 @@ +#!/bin/sh /etc/rc.common +START=46 + +apply_portfw() { + local cfg="$1" + config_get proto "$cfg" proto + config_get dport "$cfg" dport + config_get iface "$cfg" iface + config_get to "$cfg" to + + ports=$(echo $to | cut -sd: -f2) + [ -n "$ports" ] && ports="--dport $(echo $ports | sed -e 's/-/:/')" + + ip=$(echo $to | cut -d: -f1) + + if ([ "$proto" == "tcpudp" ] || [ "$proto" == "tcp" ]); then + iptables -t nat -A luci_prerouting -i "$iface" -p tcp --dport "$dport" -j DNAT --to "$to" + iptables -A luci_forward -i "$iface" -p tcp -d "$ip" "$ports" -j ACCEPT + fi + + if ([ "$proto" == "tcpudp" ] || [ "$proto" == "udp" ]); then + iptables -t nat -A luci_prerouting -i "$iface" -p udp --dport "$dport" -j DNAT --to "$to" + iptables -A luci_forward -i "$iface" -p udp -d "$ip" "$ports" -j ACCEPT + fi +} + +apply_rule() { + local cfg="$1" + local cmd="" + + config_get chain "$cfg" chain + [ -n "$chain" ] || return 0 + [ "$chain" == "forward" ] && cmd="$cmd -A luci_forward" + [ "$chain" == "input" ] && cmd="$cmd -A luci_input" + [ "$chain" == "output" ] && cmd="$cmd -A luci_output" + [ "$chain" == "prerouting" ] && cmd="$cmd -t nat -A luci_prerouting" + [ "$chain" == "postrouting" ] && cmd="$cmd -t nat -A luci_postrouting" + + config_get iface "$cfg" iface + [ -n "$iface" ] && cmd="$cmd -i $iface" + + config_get oface "$cfg" oface + [ -n "$oface" ] && cmd="$cmd -o $oface" + + config_get proto "$cfg" proto + [ -n "$proto" ] && cmd="$cmd -p $proto" + + config_get source "$cfg" source + [ -n "$source" ] && cmd="$cmd -s $source" + + config_get destination "$cfg" destination + [ -n "$destination" ] && cmd="$cmd -d $destination" + + config_get sport "$cfg" sport + [ -n "$sport" ] && cmd="$cmd --sport $sport" + + config_get dport "$cfg" dport + [ -n "$dport" ] && cmd="$cmd --dport $dport" + + config_get todest "$cfg" todest + [ -n "$todest" ] && cmd="$cmd --to-destination $todest" + + config_get tosrc "$cfg" tosrc + [ -n "$tosrc" ] && cmd="$cmd --to-source $tosrc" + + config_get jump "$cfg" jump + [ -n "$jump" ] && cmd="$cmd -j $jump" + + config_get state "$cfg" state + [ -n "$state" ] && cmd="$cmd -m state --state $state" + + config_get command "$cfg" command + [ -n "$command" ] && cmd="$cmd $command" + + iptables $cmd +} + +start() { + ### Create subchains + iptables -N luci_input + iptables -N luci_output + iptables -N luci_forward + iptables -t nat -N luci_prerouting + iptables -t nat -N luci_postrouting + + ### Hook in the chains + iptables -A input_rule -j luci_input + iptables -A output_rule -j luci_output + iptables -A forwarding_rule -j luci_forward + iptables -t nat -A prerouting_rule -j luci_prerouting + iptables -t nat -A postrouting_rule -j luci_postrouting + + ### Read chains from config + config_load luci_fw + config_foreach apply_portfw portfw + config_foreach apply_rule rule +} + +stop() { + ### Hook out the chains + iptables -D input_rule -j luci_input + iptables -D output_rule -j luci_output + iptables -D forwarding_rule -j luci_forward + iptables -t nat -D prerouting_rule -j luci_prerouting + iptables -t nat -D postrouting_rule -j luci_postrouting + + ### Clear subchains + iptables -F luci_input + iptables -F luci_output + iptables -F luci_forward + iptables -t nat -F luci_prerouting + iptables -t nat -F luci_postrouting + + ### Delete subchains + iptables -X luci_input + iptables -X luci_output + iptables -X luci_forward + iptables -t nat -X luci_prerouting + iptables -t nat -X luci_postrouting +} diff --git a/contrib/package/ffluci/Makefile b/contrib/package/ffluci/Makefile index 885411017..42fffb6ed 100644 --- a/contrib/package/ffluci/Makefile +++ b/contrib/package/ffluci/Makefile @@ -39,6 +39,8 @@ define Package/ffluci/install $(INSTALL_DIR) $(1)/www/cgi-bin $(INSTALL_DIR) $(1)/www/ffluci $(INSTALL_DIR) $(1)/etc/config + $(INSTALL_DIR) $(1)/etc/init.d + $(INSTALL_BIN) $(PKG_BUILD_DIR)/contrib/init.d/luci_fw $(1)/etc/init.d/luci_fw $(CP) $(PKG_BUILD_DIR)/dist/* $(1)/usr/lib/lua/ -R $(CP) $(PKG_BUILD_DIR)/contrib/media $(1)/www/ffluci/ -R $(INSTALL_BIN) $(PKG_BUILD_DIR)/contrib/ffluci $(1)/www/cgi-bin diff --git a/src/ffluci/model/cbi/admin_network/firewall.lua b/src/ffluci/model/cbi/admin_network/firewall.lua index fc7bea61b..a30bac710 100644 --- a/src/ffluci/model/cbi/admin_network/firewall.lua +++ b/src/ffluci/model/cbi/admin_network/firewall.lua @@ -13,12 +13,34 @@ chain:value("postrouting", "Postrouting") s:option(Value, "iface", "Eingangsschnittstelle").optional = true s:option(Value, "oface", "Ausgangsschnittstelle").optional = true -s:option(Value, "proto", "Protokoll").optional = true + +proto = s:option(ListValue, "proto", "Protokoll") +proto.optional = true +proto:value("") +proto:value("tcp", "TCP") +proto:value("udp", "UDP") + s:option(Value, "source", "Quelladresse").optional = true s:option(Value, "destination", "Zieladresse").optional = true -s:option(Value, "sport", "Quellports").optional = true -s:option(Value, "dport", "Zielports").optional = true -s:option(Value, "to", "Neues Ziel").optional = true + +sport = s:option(Value, "sport", "Quellport") +sport.optional = true +sport:depends("proto", "tcp") +sport:depends("proto", "udp") + +dport = s:option(Value, "dport", "Zielport") +dport.optional = true +dport:depends("proto", "tcp") +dport:depends("proto", "udp") + +tosrc = s:option(Value, "tosrc", "Neue Quelladresse [SNAT]") +tosrc.optional = true +tosrc:depends("jump", "SNAT") + +tosrc = s:option(Value, "todest", "Neue Zieladresse [DNAT]") +tosrc.optional = true +tosrc:depends("jump", "DNAT") + state = s:option(MultiValue, "state", "Status") state.optional = true @@ -28,10 +50,20 @@ state:value("ESTABLISHED", "etabliert") state:value("RELATED", "zugehörig") state:value("INVALID", "ungültig") -s:option(Value, "jump", "Aktion", "ACCEPT, REJECT, DROP, MASQUERADE, DNAT, SNAT, ...").optional = true +jump = s:option(ListValue, "jump", "Aktion") +jump.rmempty = true +jump:value("", "") +jump:value("ACCEPT", "annehmen (ACCEPT)") +jump:value("REJECT", "zurückweisen (REJECT)") +jump:value("DROP", "verwerfen (DROP)") +jump:value("LOG", "protokollieren (LOG)") +jump:value("DNAT", "Ziel umschreiben (DNAT) [nur Prerouting]") +jump:value("MASQUERADE", "maskieren (MASQUERADE) [nur Postrouting]") +jump:value("SNAT", "Quelle umschreiben (SNAT) [nur Postrouting]") -add = s:option(Value, "command", "Befehl") +add = s:option(Value, "command", "Eigener Befehl") add.size = 50 +add.rmempty = true -return m \ No newline at end of file +return m diff --git a/src/ffluci/model/cbi/admin_network/portfw.lua b/src/ffluci/model/cbi/admin_network/portfw.lua index 6f8822a89..70a174907 100644 --- a/src/ffluci/model/cbi/admin_network/portfw.lua +++ b/src/ffluci/model/cbi/admin_network/portfw.lua @@ -1,18 +1,24 @@ -- ToDo: Translate, Add descriptions and help texts +require("ffluci.sys") m = Map("luci_fw", "Portweiterleitung") s = m:section(TypedSection, "portfw") s.addremove = true s.anonymous = true -iface = s:option(Value, "in_interface", "Externes Interface") +iface = s:option(ListValue, "iface", "Externes Interface") +iface:value("") +for k,v in pairs(ffluci.sys.net.devices()) do + iface:value(v) +end proto = s:option(ListValue, "proto", "Protokoll") proto:value("tcp", "TCP") proto:value("udp", "UDP") +proto:value("tcpudp", "TCP+UDP") dport = s:option(Value, "dport", "Externer Port", "Port[:Endport]") to = s:option(Value, "to", "Interne Adresse", "IP-Adresse[:Zielport[-Zielendport]]") -return m \ No newline at end of file +return m -- 2.11.0