projects
/
openwrt
/
svn-archive
/
archive.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
[package] firewall:
[openwrt/svn-archive/archive.git]
/
package
/
firewall
/
files
/
reflection.hotplug
diff --git
a/package/firewall/files/reflection.hotplug
b/package/firewall/files/reflection.hotplug
index b3b5e5ecce29336b6931583d0a98d34cb3ed34c1..4fd8f296de44e4de3e523ebf1e7eec2dfbe714bb 100644
(file)
--- a/
package/firewall/files/reflection.hotplug
+++ b/
package/firewall/files/reflection.hotplug
@@
-15,6
+15,11
@@
if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
iptables -t nat -A postrouting_rule -j nat_reflection_out
}
iptables -t nat -A postrouting_rule -j nat_reflection_out
}
+ iptables -t filter -F nat_reflection_fwd 2>/dev/null || {
+ iptables -t filter -N nat_reflection_fwd
+ iptables -t filter -A forwarding_rule -j nat_reflection_fwd
+ }
+
find_networks() {
find_networks_cb() {
local cfg="$1"
find_networks() {
find_networks_cb() {
local cfg="$1"
@@
-34,10
+39,14
@@
if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
config_foreach find_networks_cb zone "$1"
}
config_foreach find_networks_cb zone "$1"
}
-
+
setup_fwd() {
local cfg="$1"
setup_fwd() {
local cfg="$1"
+ local reflection
+ config_get_bool reflection "$cfg" reflection 1
+ [ "$reflection" == 1 ] || return
+
local src
config_get src "$cfg" src
local src
config_get src "$cfg" src
@@
-47,6
+56,7
@@
if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
[ "$src" = wan ] && [ "$target" = DNAT ] && {
local dest
config_get dest "$cfg" dest "lan"
[ "$src" = wan ] && [ "$target" = DNAT ] && {
local dest
config_get dest "$cfg" dest "lan"
+ [ "$dest" != "*" ] || return
local net
for net in $(find_networks "$dest"); do
local net
for net in $(find_networks "$dest"); do
@@
-56,10
+66,6
@@
if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
local proto
config_get proto "$cfg" proto
local proto
config_get proto "$cfg" proto
- local reflection
- config_get_bool reflection "$cfg" reflection 1
- [ "$reflection" == 1 ] || return
-
local epmin epmax extport
config_get extport "$cfg" src_dport
[ -n "$extport" ] || return
local epmin epmax extport
config_get extport "$cfg" src_dport
[ -n "$extport" ] || return
@@
-98,6
+104,11
@@
if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
-s $lanip/$lanmk -d $inthost \
-p $p --dport $ipmin${ipmax:+:$ipmax} \
-j SNAT --to-source $lanip
-s $lanip/$lanmk -d $inthost \
-p $p --dport $ipmin${ipmax:+:$ipmax} \
-j SNAT --to-source $lanip
+
+ iptables -t filter -A nat_reflection_fwd \
+ -s $lanip/$lanmk -d $inthost \
+ -p $p --dport $ipmin${ipmax:+:$ipmax} \
+ -j ACCEPT
;;
esac
done
;;
esac
done
@@
-108,4
+119,3
@@
if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
config_load firewall
config_foreach setup_fwd redirect
fi
config_load firewall
config_foreach setup_fwd redirect
fi
-