contrib/package/freifunk-firewall/files/etc/hotplug.d/iface/22-firewall-nat-fix

   1 . /lib/firewall/uci_firewall.sh
   2 unset ZONE
   3 config_get ifname $INTERFACE ifname
   4 [ "$ifname" == "lo" ] && exit 0
   5
   6 load_zones() {
   7         local name
   8         local network
   9         config_get name $1 name
  10         config_get network $1 network
  11         [ -z "$network" ] && network=$name
  12         for n in $network; do
  13                 [ "$n" = "$INTERFACE" ] && ZONE="$ZONE $name"
  14         done
  15 }
  16
  17 config_foreach load_zones zone
  18
  19 [ -z "$ZONE" ] && exit 0
  20
  21 natfix_addr_add() {
  22         local network=$1
  23         local iface=$2
  24
  25         config_get parent "$1" interface
  26         [ "$network" != "$INTERFACE" -a "$parent" != "$INTERFACE" ] && return 0
  27
  28         config_get ipaddr "$network" ipaddr
  29         [ -n "$ipaddr" ] || return 0
  30         config_get netmask "$network" netmask
  31         [ -n "$netmask" ] || return 0
  32         eval "$(ipcalc.sh $ipaddr $netmask)"
  33
  34         logger -t firewall.freifunk "adding nat rule for $iface($NETWORK/$PREFIX)"
  35         iptables -t nat -A "natfix_$iface" -s "$NETWORK/$PREFIX" -d "$NETWORK/$PREFIX" -j ACCEPT
  36 }
  37
  38 [ ifup = "$ACTION" ] && {
  39         iptables -t nat -N "natfix_$ifname"
  40         natfix_addr_add "$INTERFACE" "$ifname"
  41         config_foreach natfix_addr_add alias "$ifname"
  42
  43         for z in $ZONE; do
  44                 local loaded
  45                 config_get loaded core loaded
  46                 [ -n "$loaded" ] && {
  47                         logger -t firewall.freifunk "applying nat rules on zone $z"
  48                         iptables -t nat -I "zone_${z}_nat" 1 -o "$ifname" -j "natfix_$ifname"
  49                 }
  50         done
  51 }
  52
  53 [ ifdown = "$ACTION" ] && {
  54         for z in $ZONE; do
  55                 local up
  56                 config_get up $z up
  57                 iptables -t nat -D "zone_${z}_nat" -o "$ifname" -j "natfix_$ifname" 2>/dev/null
  58         done
  59         iptables -t nat -F "natfix_$ifname" 2>/dev/null
  60         iptables -t nat -X "natfix_$ifname" 2>/dev/null
  61 }