contrib/meshwizard: Add lan config, rework wan config
[project/luci.git] / contrib / package / meshwizard / files / usr / bin / meshwizard / helpers / setup_firewall.sh
1 #!/bin/sh
2 # Add "freifunk" firewall zone
3 # If wan/lan is used for olsr then remove these networks from wan/lan zones
4 # Also setup rules defined in /etc/config/freifunk and /etc/config/profile_<community>
5
6 . /etc/functions.sh
7 . $dir/functions.sh
8
9 wan_is_olsr=$(uci -q get meshwizard.netconfig.wan_config)
10 lan_is_olsr=$(uci -q get meshwizard.netconfig.lan_config)
11
12 config_load firewall
13
14 # Rename firewall zone for freifunk if unnamed
15 # If wan is used for olsr then set network for the firewall zone wan to ' ' to remove the wan interface from it, else add local restrict to it
16 # If lan is used for olsr then set network for the firewall zone lan to ' ' to remove the lan interface from it
17
18 handle_fwzone() {
19 config_get name "$1" name
20 config_get network "$1" network
21
22 if [ "$name" == "freifunk" ]; then
23 # rename section if unnamed
24 if [ -z "${1/cfg[0-9a-fA-F]*/}" ]; then
25 section_rename firewall $1 zone_freifunk
26 fi
27 fi
28
29 if [ "$name" == "wan" ]; then
30 if [ "$wan_is_olsr" == 1 ]; then
31 uci set firewall.$1.network=' ' && uci_commitverbose "WAN is used for olsr, removed the wan interface from zone wan" firewall
32 else
33 uci set firewall.$1.local_restrict=1 && uci_commitverbose "Enable local_restrict for zone wan" firewall
34 fi
35 fi
36
37 if [ "$name" == "lan" ] && [ "$lan_is_olsr" == 1 ]; then
38 uci set firewall.$1.network=' ' && uci_commitverbose "LAN is used for olsr, removed the lan interface from zone lan" firewall
39 fi
40 }
41
42 config_foreach handle_fwzone zone
43
44 uci batch << EOF
45 set firewall.zone_freifunk="zone"
46 set firewall.zone_freifunk.name="freifunk"
47 set firewall.zone_freifunk.input="$zone_freifunk_input"
48 set firewall.zone_freifunk.forward="$zone_freifunk_forward"
49 set firewall.zone_freifunk.output="$zone_freifunk_output"
50 EOF
51
52 uci_commitverbose "Setup firewall zones" firewall
53
54 # Usually we need to setup masquerading for lan, except lan is an olsr interface or has an olsr hna-entry
55
56 handle_interface() {
57 config_get interface "$1" interface
58 if [ "$interface" == "lan" ]; then
59 no_masq_lan=1
60 fi
61 }
62 config_load olsrd
63 config_foreach handle_interface Interface
64
65 LANIP="$(uci -q get network.lan.ipaddr)"
66 if [ -n "$LANIP" ]; then
67 handle_hna() {
68 config_get netaddr "$1" netaddr
69 if [ "$LANIP" == "$netaddr" ]; then
70 no_masq_lan=1
71 fi
72 }
73 config_foreach handle_hna Hna4
74 fi
75
76 currms=$(uci -q get firewall.zone_freifunk.masq_src)
77 if [ ! "$no_masq_lan" == "1" ] && [ ! "$(uci -q get meshwizard.netconfig.lan_config)" == 1 ]; then
78 uci set firewall.zone_freifunk.masq="1"
79 [ -z "$(echo $currms |grep lan)" ] && uci add_list firewall.zone_freifunk.masq_src="lan"
80 fi
81
82
83 # Rules, Forwardings, advanced config and includes
84
85 for config in freifunk profile_$community; do
86
87 config_load $config
88
89 for section in advanced include fw_rule fw_forwarding; do
90 handle_firewall() {
91 local options=$(uci show $config."$1")
92 options=$(echo "$options" | sed -e "s/fw_//g" -e "s/^$config/firewall/g")
93 for o in $options; do
94 uci set $o
95 done
96 }
97 config_foreach handle_firewall $section
98 done
99 done
100 uci_commitverbose "Setup rules, forwardings, advanced config and includes." firewall