contrib/init.d/luci_fw

   1 #!/bin/sh /etc/rc.common
   2 START=46
   3
   4 apply_portfw() {
   5         local cfg="$1"
   6         config_get proto "$cfg" proto
   7         config_get dport "$cfg" dport
   8         config_get iface "$cfg" iface
   9         config_get to    "$cfg" to
  10
  11         ports=$(echo $to | cut -sd: -f2)
  12         [ -n "$ports" ] && ports="--dport $(echo $ports | sed -e 's/-/:/')"
  13
  14         ip=$(echo $to | cut -d: -f1)
  15
  16         if ([ "$proto" == "tcpudp" ] || [ "$proto" == "tcp" ]); then
  17                 iptables -t nat -A luci_prerouting -i "$iface" -p tcp --dport "$dport" -j DNAT --to "$to"
  18                 iptables -A luci_forward -i "$iface" -p tcp -d "$ip" "$ports" -j ACCEPT
  19         fi
  20
  21         if ([ "$proto" == "tcpudp" ] || [ "$proto" == "udp" ]); then
  22                 iptables -t nat -A luci_prerouting -i "$iface" -p udp --dport "$dport" -j DNAT --to "$to"
  23                 iptables -A luci_forward -i "$iface" -p udp -d "$ip" "$ports" -j ACCEPT
  24         fi
  25 }
  26
  27 apply_rule() {
  28         local cfg="$1"
  29         local cmd=""
  30
  31         config_get chain "$cfg" chain
  32         [ -n "$chain" ] || return 0
  33         [ "$chain" == "forward" ] && cmd="$cmd -A luci_forward"
  34         [ "$chain" == "input" ] && cmd="$cmd -A luci_input"
  35         [ "$chain" == "output" ] && cmd="$cmd -A luci_output"
  36         [ "$chain" == "prerouting" ] && cmd="$cmd -t nat -A luci_prerouting"
  37         [ "$chain" == "postrouting" ] && cmd="$cmd -t nat -A luci_postrouting"
  38
  39         config_get iface "$cfg" iface
  40         [ -n "$iface" ] && cmd="$cmd -i $iface"
  41
  42         config_get oface "$cfg" oface
  43         [ -n "$oface" ] && cmd="$cmd -o $oface"
  44
  45         config_get proto "$cfg" proto
  46         [ -n "$proto" ] && cmd="$cmd -p $proto"
  47
  48         config_get source "$cfg" source
  49         [ -n "$source" ] && cmd="$cmd -s $source"
  50
  51         config_get destination "$cfg" destination
  52         [ -n "$destination" ] && cmd="$cmd -d $destination"
  53
  54         config_get sport "$cfg" sport
  55         [ -n "$sport" ] && cmd="$cmd --sport $sport"
  56
  57         config_get dport "$cfg" dport
  58         [ -n "$dport" ] && cmd="$cmd --dport $dport"
  59
  60         config_get todest "$cfg" todest
  61         [ -n "$todest" ] && cmd="$cmd --to-destination $todest"
  62
  63         config_get tosrc "$cfg" tosrc
  64         [ -n "$tosrc" ] && cmd="$cmd --to-source $tosrc"
  65
  66         config_get jump "$cfg" jump
  67         [ -n "$jump" ] && cmd="$cmd -j $jump"
  68
  69         config_get state "$cfg" state
  70         [ -n "$state" ] && cmd="$cmd -m state --state $state"
  71
  72         config_get command "$cfg" command
  73         [ -n "$command" ] && cmd="$cmd $command"
  74
  75         iptables $cmd
  76 }
  77
  78 start() {
  79         ### Create subchains
  80         iptables -N luci_input
  81         iptables -N luci_output
  82         iptables -N luci_forward
  83         iptables -t nat -N luci_prerouting
  84         iptables -t nat -N luci_postrouting
  85
  86         ### Hook in the chains
  87         iptables -A input_rule -j luci_input
  88         iptables -A output_rule -j luci_output
  89         iptables -A forwarding_rule -j luci_forward
  90         iptables -t nat -A prerouting_rule -j luci_prerouting
  91         iptables -t nat -A postrouting_rule -j luci_postrouting
  92
  93         ### Read chains from config
  94         config_load luci_fw
  95         config_foreach apply_portfw portfw
  96         config_foreach apply_rule rule
  97 }
  98
  99 stop() {
 100         ### Hook out the chains
 101         iptables -D input_rule -j luci_input
 102         iptables -D output_rule -j luci_output
 103         iptables -D forwarding_rule -j luci_forward
 104         iptables -t nat -D prerouting_rule -j luci_prerouting
 105         iptables -t nat -D postrouting_rule -j luci_postrouting
 106
 107         ### Clear subchains
 108         iptables -F luci_input
 109         iptables -F luci_output
 110         iptables -F luci_forward
 111         iptables -t nat -F luci_prerouting
 112         iptables -t nat -F luci_postrouting
 113
 114         ### Delete subchains
 115         iptables -X luci_input
 116         iptables -X luci_output
 117         iptables -X luci_forward
 118         iptables -t nat -X luci_prerouting
 119         iptables -t nat -X luci_postrouting
 120 }