2 # This will add $net to the zone firewall (and remove it from other zones where it is referenced)
3 # It will also setup rules defined in /etc/config/freifunk and /etc/config/profile_<community>
12 type="$(uci -q get wireless.$net.type)"
13 vap
="$(uci -q get meshwizard.netconfig.$net\_vap)"
15 # Delete old firewall zone for freifunk
17 config_get name
"$1" name
18 config_get network
"$1" network
20 if [ "$2" == "zoneconf" ]; then
22 if [ "$name" == "freifunk" ]; then
23 if [ "$cleanup" == 1 ]; then
24 section_cleanup firewall.
$1
26 # rename section if unnamed
27 if [ -z "${1/cfg[0-9a-fA-F]*/}" ]; then
28 section_rename firewall
$1 zone_freifunk
33 if [ "$name" == "$netrenamed" ]; then
34 section_cleanup firewall.
$1
36 if [ -n "$netrenamed" -a -n "$(echo $network | grep $netrenamed)" ] && [ ! "$name" == "freifunk" ]; then
37 echo " Removed $netrenamed from firewall zone $name."
38 network_new
=$
(echo $network |
sed -e 's/'$netrenamed'//' -e 's/^ //' -e 's/ / /' -e 's/ $//')
39 uci
set firewall.
$1.network
="$network_new"
43 # clean fw_rule, fw_forwarding, include and advanced
44 for option
in src tcp_ecn path
; do
45 config_get
$option $1 $option
47 if [ "$src" == "freifunk" -o "$path" == "/etc/firewall.freifunk" -o -n "$tcpecn" ]; then
48 section_cleanup firewall.
$1
53 config_foreach handle_fwzone zone zoneconf
55 if [ "$cleanup" == 1 ]; then
56 for target
in include advanced rule forwarding
; do
57 config_foreach handle_fwzone
$target
61 # setup freifunk firewall zone
63 echo " + Setup firewall zone."
65 # add $netrenamed and if needed ${netrenamed}dhcp to the networks for this zone
66 config_get network zone_freifunk network
68 # remove ${netrenamed}dhcp from networks list
69 [ -n "$network" -a -n "$net" ] && network
="${network/${netrenamed}dhcp/}"
70 network
=$
(echo $network) # Removes leading and trailing whitespaces
72 [ -n "$netrenamed" ] && [ -z "$(echo $network | grep $netrenamed)" ] && network
="$network $netrenamed"
74 if [ "$type" == "atheros" -a "$vap" == 1 ]; then
75 [ -n "$netrenamed" ] && [ "$network" == "${network/${netrenamed}dhcp/}" ] && network
="$network ${netrenamed}dhcp"
79 set firewall.zone_freifunk="zone"
80 set firewall.zone_freifunk.name="freifunk"
81 set firewall.zone_freifunk.network="$network"
82 set firewall.zone_freifunk.input="$zone_freifunk_input"
83 set firewall.zone_freifunk.forward="$zone_freifunk_forward"
84 set firewall.zone_freifunk.output="$zone_freifunk_output"
87 echo " network: $network
88 input: $zone_freifunk_input
89 forward: $zone_freifunk_forward
90 output: $zone_freifunk_output"
92 # Usually we need to setup masquerading for lan, except lan is an olsr interface or has an olsr hna
94 echo " + Setup masquerading rules"
97 config_get interface
"$1" interface
98 if [ "$interface" == "lan" ]; then
103 config_foreach handle_interface Interface
106 config_get netaddr
"$1" netaddr
107 if [ "$NETWORK" == "$netaddr" ]; then
111 config_foreach handle_hna Hna4
113 currms
=$
(uci
-q get firewall.zone_freifunk.masq_src
)
114 if [ ! "$no_masq_lan" == "1" ]; then
115 uci
set firewall.zone_freifunk.masq
="1" && echo " Enabled masquerading." ||
echo -e "\033[1mWarning:\033[0m: Could not enable masquerading."
116 [ -z "$(echo $currms |grep lan)" ] && uci add_list firewall.zone_freifunk.masq_src
="lan"
119 # If wifi-interfaces are outside of the mesh network they should be natted
120 for i
in $networks; do
121 # Get dhcprange and meshnet
122 dhcprange
=$
(uci get meshwizard.netconfig.
$i\_dhcprange
)
123 meshnet
="$(uci get profile_$community.profile.mesh_network)"
124 # check if the dhcprange is inside meshnet
125 dhcpinmesh
="$($dir/helpers/check-range-in-range.sh $dhcprange $meshnet)"
126 if [ ! "$dhcpinmesh" == 1 ]; then
127 [ -z "$(echo $currms |grep ${net}dhcp)" ] && uci add_list firewall.zone_freifunk.masq_src
="${net}dhcp"
131 # Rules, Forwardings, advanced config and includes
132 # Clear firewall configuration
134 echo " + Setup rules, forwardings, advanced config and includes."
136 for config
in freifunk profile_
$community; do
140 for section
in advanced include fw_rule fw_forwarding
; do
142 local options
=$
(uci show
$config.
"$1")
143 options
=$
(echo "$options" |
sed -e "s/fw_//g" -e "s/^$config/firewall/g")
144 for o
in $options; do
148 config_foreach handle_firewall
$section