net/miniupnpd/files/miniupnpd.firewall

   1 . /etc/functions.sh
   2 include /lib/network
   3 scan_interfaces
   4
   5 upnp_ipt() {
   6         iptables "$@" 2>/dev/null
   7 }
   8
   9 upnp_firewall_addif() {
  10         local intif
  11         local intip
  12         local coldplug="$1"
  13
  14         config_load upnpd
  15         config_get intif config internal_iface
  16
  17         config_load network
  18
  19         for iface in ${intif:-lan}; do
  20                 if [ -n "$coldplug" -o "$iface" == "$INTERFACE" ]; then
  21                         config_get intip "$iface" ipaddr
  22                         config_get intif "$iface" ifname
  23
  24                         [ -n "$intif" -a -n "$intip" ] && {
  25                                 logger -t "upnp firewall" "adding interface $iface($intip)"
  26
  27                                 upnp_ipt -t nat -N MINIUPNPD
  28                                 upnp_ipt -t nat -N miniupnpd_${iface}_rule
  29                                 upnp_ipt -t nat -A miniupnpd_${iface}_rule -i $intif -d $intip -j MINIUPNPD
  30                                 upnp_ipt -t nat -A prerouting_rule -j miniupnpd_${iface}_rule
  31
  32                                 upnp_ipt -t filter -N MINIUPNPD
  33                                 upnp_ipt -t filter -N miniupnpd_${iface}_rule
  34                                 upnp_ipt -t filter -A miniupnpd_${iface}_rule -i $intif -o ! $intif -j MINIUPNPD
  35                                 upnp_ipt -t filter -A forwarding_rule -j miniupnpd_${iface}_rule
  36                         }
  37                 fi
  38         done
  39 }
  40
  41 upnp_firewall_delif() {
  42         local iface="${1:-$INTERFACE}"
  43
  44         if [ -n "$iface" ]; then
  45                 logger -t "upnp firewall" "removing interface $iface"
  46
  47                 upnp_ipt -t nat -D prerouting_rule -j miniupnpd_${iface}_rule
  48                 upnp_ipt -t nat -F miniupnpd_${iface}_rule
  49                 upnp_ipt -t nat -X miniupnpd_${iface}_rule
  50
  51                 upnp_ipt -t filter -D forwarding_rule -j miniupnpd_${iface}_rule
  52                 upnp_ipt -t filter -F miniupnpd_${iface}_rule
  53                 upnp_ipt -t filter -X miniupnpd_${iface}_rule
  54         fi
  55 }
  56
  57 upnp_firewall_start() {
  58         logger -t "upnp firewall" "starting ..."
  59         upnp_firewall_addif coldplug
  60 }
  61
  62 upnp_firewall_stop() {
  63         local intif
  64         config_load upnpd
  65         config_get intif config internal_iface
  66
  67         logger -t "upnp firewall" "stopping ..."
  68
  69         for iface in ${intif:-lan}; do
  70                 upnp_firewall_delif "$iface"
  71         done
  72
  73         upnp_ipt -t nat -F MINIUPNPD
  74         upnp_ipt -t nat -X MINIUPNPD
  75         upnp_ipt -t filter -F MINIUPNPD
  76         upnp_ipt -t filter -X MINIUPNPD
  77 }