1 #!/bin/sh /etc/rc.common
6 config_get proto
"$cfg" proto
7 config_get dport
"$cfg" dport
8 config_get iface
"$cfg" iface
9 config_get to
"$cfg" to
11 config_get ifname
"$iface" ifname
13 [ -n "$proto" ] ||
return 0
14 [ -n "$dport" ] ||
return 0
15 [ -n "$ifname" ] ||
return 0
16 [ -n "$to" ] ||
return 0
18 ports
=$
(echo $to | cut
-sd: -f2)
19 if [ -n "$ports" ]; then
20 ports
="--dport $(echo $ports | sed -e 's/-/:/')"
22 ports
="--dport $dport"
25 ip
=$
(echo $to | cut
-d: -f1)
27 if ([ "$proto" == "tcpudp" ] ||
[ "$proto" == "tcp" ]); then
28 iptables
-t nat
-A luci_fw_prerouting
-i "$ifname" -p tcp
--dport "$dport" -j DNAT
--to "$to"
29 iptables
-A luci_fw_forward
-i "$ifname" -p tcp
-d "$ip" $ports -j ACCEPT
32 if ([ "$proto" == "tcpudp" ] ||
[ "$proto" == "udp" ]); then
33 iptables
-t nat
-A luci_fw_prerouting
-i "$ifname" -p udp
--dport "$dport" -j DNAT
--to "$to"
34 iptables
-A luci_fw_forward
-i "$ifname" -p udp
-d "$ip" $ports -j ACCEPT
40 config_get iface
"$cfg" iface
41 config_get oface
"$cfg" oface
42 config_get_bool fwd
"$cfg" fwd
43 config_get_bool nat
"$cfg" nat
44 config_get_bool bidi
"$cfg" bidi
46 config_get ifname
"$iface" ifname
47 config_get ofname
"$oface" ifname
49 [ -n "$ifname" ] ||
return 0
50 [ -n "$ofname" ] ||
return 0
53 iptables
-A luci_fw_forward
-i "$ifname" -o "$ofname" -j ACCEPT
54 [ "$bidi" -gt 0 ] && iptables
-A luci_fw_forward
-i "$ofname" -o "$ifname" -j ACCEPT
58 config_get ifip
"$iface" ipaddr
59 config_get ifmask
"$iface" netmask
60 eval "$(ipcalc.sh $ifip $ifmask)"
62 iptables
-t nat
-A luci_fw_postrouting
-s "$NETWORK/$PREFIX" -o "$ofname" -j MASQUERADE
64 [ "$bidi" -gt 0 ] && {
65 config_get ofip
"$oface" ipaddr
66 config_get ofmask
"$oface" netmask
67 eval "$(ipcalc.sh $ofip $ofmask)"
69 iptables
-t nat
-A luci_fw_postrouting
-s "$NETWORK/$PREFIX" -o "$ifname" -j MASQUERADE
78 config_get chain
"$cfg" chain
79 [ -n "$chain" ] ||
return 0
80 [ "$chain" == "forward" ] && cmd
="$cmd -A luci_fw_forward"
81 [ "$chain" == "input" ] && cmd
="$cmd -A luci_fw_input"
82 [ "$chain" == "output" ] && cmd
="$cmd -A luci_fw_output"
83 [ "$chain" == "prerouting" ] && cmd
="$cmd -t nat -A luci_fw_prerouting"
84 [ "$chain" == "postrouting" ] && cmd
="$cmd -t nat -A luci_fw_postrouting"
86 config_get iface
"$cfg" iface
87 config_get ifname
"$iface" ifname
88 [ -n "$ifname" ] && cmd
="$cmd -i $ifname"
90 config_get oface
"$cfg" oface
91 config_get ofname
"$oface" ifname
92 [ -n "$ofname" ] && cmd
="$cmd -o $ofname"
94 config_get proto
"$cfg" proto
95 [ -n "$proto" ] && cmd
="$cmd -p $proto"
97 config_get
source "$cfg" source
98 [ -n "$source" ] && cmd
="$cmd -s $source"
100 config_get destination
"$cfg" destination
101 [ -n "$destination" ] && cmd
="$cmd -d $destination"
103 config_get sport
"$cfg" sport
104 [ -n "$sport" ] && cmd
="$cmd --sport $sport"
106 config_get dport
"$cfg" dport
107 [ -n "$dport" ] && cmd
="$cmd --dport $dport"
109 config_get todest
"$cfg" todest
110 [ -n "$todest" ] && cmd
="$cmd --to-destination $todest"
112 config_get tosrc
"$cfg" tosrc
113 [ -n "$tosrc" ] && cmd
="$cmd --to-source $tosrc"
115 config_get mac
"$cfg" mac
116 [ -n "$mac" ] && cmd
="$cmd -m mac --mac-source $mac"
118 config_get jump
"$cfg" jump
119 [ -n "$jump" ] && cmd
="$cmd -j $jump"
121 config_get
command "$cfg" command
122 [ -n "$command" ] && cmd
="$cmd $command"
129 iptables
-N luci_fw_input
130 iptables
-N luci_fw_output
131 iptables
-N luci_fw_forward
132 iptables
-t nat
-N luci_fw_prerouting
133 iptables
-t nat
-N luci_fw_postrouting
135 ### Hook in the chains
136 iptables
-A input_rule
-j luci_fw_input
137 iptables
-A output_rule
-j luci_fw_output
138 iptables
-A forwarding_rule
-j luci_fw_forward
139 iptables
-t nat
-A prerouting_rule
-j luci_fw_prerouting
140 iptables
-t nat
-A postrouting_rule
-j luci_fw_postrouting
142 ### Scan network interfaces
146 ### Read chains from config
148 config_foreach apply_rule rule
149 config_foreach apply_portfw portfw
150 config_foreach apply_routing routing
154 ### Hook out the chains
155 iptables
-D input_rule
-j luci_fw_input
156 iptables
-D output_rule
-j luci_fw_output
157 iptables
-D forwarding_rule
-j luci_fw_forward
158 iptables
-t nat
-D prerouting_rule
-j luci_fw_prerouting
159 iptables
-t nat
-D postrouting_rule
-j luci_fw_postrouting
162 iptables
-F luci_fw_input
163 iptables
-F luci_fw_output
164 iptables
-F luci_fw_forward
165 iptables
-t nat
-F luci_fw_prerouting
166 iptables
-t nat
-F luci_fw_postrouting
169 iptables
-X luci_fw_input
170 iptables
-X luci_fw_output
171 iptables
-X luci_fw_forward
172 iptables
-t nat
-X luci_fw_prerouting
173 iptables
-t nat
-X luci_fw_postrouting