61 lines
1.5 KiB
Text
61 lines
1.5 KiB
Text
. /lib/firewall/uci_firewall.sh
|
|
unset ZONE
|
|
config_get ifname $INTERFACE ifname
|
|
[ "$ifname" == "lo" ] && exit 0
|
|
|
|
load_zones() {
|
|
local name
|
|
local network
|
|
config_get name $1 name
|
|
config_get network $1 network
|
|
[ -z "$network" ] && network=$name
|
|
for n in $network; do
|
|
[ "$n" = "$INTERFACE" ] && ZONE="$ZONE $name"
|
|
done
|
|
}
|
|
|
|
config_foreach load_zones zone
|
|
|
|
[ -z "$ZONE" ] && exit 0
|
|
|
|
natfix_addr_add() {
|
|
local network=$1
|
|
local iface=$2
|
|
|
|
config_get parent "$1" interface
|
|
[ "$network" != "$INTERFACE" -a "$parent" != "$INTERFACE" ] && return 0
|
|
|
|
config_get ipaddr "$network" ipaddr
|
|
[ -n "$ipaddr" ] || return 0
|
|
config_get netmask "$network" netmask
|
|
[ -n "$netmask" ] || return 0
|
|
eval "$(ipcalc.sh $ipaddr $netmask)"
|
|
|
|
logger -t firewall.freifunk "adding nat rule for $iface($NETWORK/$PREFIX)"
|
|
iptables -t nat -A "natfix_$iface" -s "$NETWORK/$PREFIX" -d "$NETWORK/$PREFIX" -j ACCEPT
|
|
}
|
|
|
|
[ ifup = "$ACTION" ] && {
|
|
iptables -t nat -N "natfix_$ifname"
|
|
natfix_addr_add "$INTERFACE" "$ifname"
|
|
config_foreach natfix_addr_add alias "$ifname"
|
|
|
|
for z in $ZONE; do
|
|
local loaded
|
|
config_get loaded core loaded
|
|
[ -n "$loaded" ] && {
|
|
logger -t firewall.freifunk "applying nat rules on zone $z"
|
|
iptables -t nat -I "zone_${z}_nat" 1 -o "$ifname" -j "natfix_$ifname"
|
|
}
|
|
done
|
|
}
|
|
|
|
[ ifdown = "$ACTION" ] && {
|
|
for z in $ZONE; do
|
|
local up
|
|
config_get up $z up
|
|
iptables -t nat -D "zone_${z}_nat" -o "$ifname" -j "natfix_$ifname" 2>/dev/null
|
|
done
|
|
iptables -t nat -F "natfix_$ifname" 2>/dev/null
|
|
iptables -t nat -X "natfix_$ifname" 2>/dev/null
|
|
}
|