dc6780a720053d2da4af69371485915995817b06
[openwrt/svn-archive/archive.git] / package / firewall / files / reflection.hotplug
1 #!/bin/sh
2
3 . /etc/functions.sh
4
5 if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
6 local wanip=$(uci -P/var/state get network.wan.ipaddr)
7
8 iptables -t nat -F nat_reflection_in 2>/dev/null || {
9 iptables -t nat -N nat_reflection_in
10 iptables -t nat -A prerouting_rule -j nat_reflection_in
11 }
12
13 iptables -t nat -F nat_reflection_out 2>/dev/null || {
14 iptables -t nat -N nat_reflection_out
15 iptables -t nat -A postrouting_rule -j nat_reflection_out
16 }
17
18 find_networks() {
19 find_networks_cb() {
20 local cfg="$1"
21 local zone="$2"
22
23 local name
24 config_get name "$cfg" name
25
26 [ "$name" = "$zone" ] && {
27 local network
28 config_get network "$cfg" network
29
30 echo ${network:-$zone}
31 return 1
32 }
33 }
34
35 config_foreach find_networks_cb zone "$1"
36 }
37
38 setup_fwd() {
39 local cfg="$1"
40
41 local src
42 config_get src "$cfg" src
43
44 [ "$src" = wan ] && {
45 local dest
46 config_get dest "$cfg" dest "lan"
47
48 local net
49 for net in $(find_networks "$dest"); do
50 local lanip=$(uci -P/var/state get network.$net.ipaddr)
51 local lanmk=$(uci -P/var/state get network.$net.netmask)
52
53 local proto
54 config_get proto "$cfg" proto
55
56 local epmin epmax extport
57 config_get extport "$cfg" src_dport
58 [ -n "$extport" ] || return
59
60 epmin="${extport%[-:]*}"; epmax="${extport#*[-:]}"
61 [ "$epmin" != "$epmax" ] || epmax=""
62
63 local ipmin ipmax intport
64 config_get intport "$cfg" dest_port "$extport"
65
66 ipmin="${intport%[-:]*}"; ipmax="${intport#*[-:]}"
67 [ "$ipmin" != "$ipmax" ] || ipmax=""
68
69 local exthost
70 config_get exthost "$cfg" src_dip "$wanip"
71
72 local inthost
73 config_get inthost "$cfg" dest_ip
74 [ -n "$inthost" ] || return
75
76 [ "$proto" = tcpudp ] && proto="tcp udp"
77
78 local p
79 for p in ${proto:-tcp udp}; do
80 case "$p" in
81 tcp|udp)
82 iptables -t nat -A nat_reflection_in \
83 -s $lanip/$lanmk -d $exthost \
84 -p $p --dport $epmin${epmax:+:$epmax} \
85 -j DNAT --to $inthost:$ipmin${ipmax:+-$ipmax}
86
87 iptables -t nat -A nat_reflection_out \
88 -s $lanip/$lanmk -d $inthost \
89 -p $p --dport $ipmin${ipmax:+:$ipmax} \
90 -j SNAT --to-source $lanip
91 ;;
92 esac
93 done
94 done
95 }
96 }
97
98 config_load firewall
99 config_foreach setup_fwd redirect
100 fi
101