return 0
}
- fwdchain="zone_${redirect_src}${redirect_dest_ip:+_forward}"
+ fwdopt=""
+ fwdchain=""
+
+ # Check whether only ports are given or whether the given dest ip is local,
+ # in this case match only DNATed traffic and allow it on input, not forward
+ if [ -z "$redirect_dest_ip" ] || /sbin/ifconfig | grep -qE "addr:${redirect_dest_ip//./\\.}\b"; then
+ fwdopt="-m conntrack --ctstate DNAT"
+ fwdchain="zone_${redirect_src}"
+ else
+ fwdchain="zone_${redirect_src}_forward"
+ fi
natopt="--to-destination"
natchain="zone_${redirect_src}_prerouting"
fw add $mode f ${fwdchain:-forward} ACCEPT + \
{ $redirect_src_ip $redirect_dest_ip } { \
- $srcaddr ${destaddr:--m conntrack --ctstate DNAT} \
+ $srcaddr $destaddr \
$pr \
$srcports $destports \
${sm:+-m mac $sm} \
+ $fwdopt \
$redirect_extra \
}
done