contrib/package/meshwizard/files/usr/bin/meshwizard/helpers/setup_firewall.sh

   1 #!/bin/sh
   2 # Add "freifunk" firewall zone
   3 # If wan/lan is used for olsr then remove these networks from wan/lan zones
   4 # Also setup rules defined in /etc/config/freifunk and /etc/config/profile_<community>
   5
   6 . /lib/functions.sh
   7 . $dir/functions.sh
   8
   9 wan_is_olsr=$(uci -q get meshwizard.netconfig.wan_config)
  10 lan_is_olsr=$(uci -q get meshwizard.netconfig.lan_config)
  11
  12 config_load firewall
  13
  14 # Rename firewall zone for freifunk if unnamed
  15 # If wan is used for olsr then set network for the firewall zone wan to ' ' to remove the wan interface from it, else add local restrict to it
  16 # If lan is used for olsr then set network for the firewall zone lan to ' ' to remove the lan interface from it
  17
  18 handle_fwzone() {
  19         config_get name "$1" name
  20         config_get network "$1" network
  21
  22         if [ "$name" == "freifunk" ]; then
  23                 # rename section if unnamed
  24                 if [ -z "${1/cfg[0-9a-fA-F]*/}" ]; then
  25                         section_rename firewall $1 zone_freifunk
  26                 fi
  27         fi
  28
  29         if [ "$name" == "wan" ]; then
  30                 if  [ "$wan_is_olsr" == 1 ]; then
  31                         uci set firewall.$1.network=' ' && uci_commitverbose "WAN is used for olsr, removed the wan interface from zone wan" firewall
  32                 else
  33                         uci set firewall.$1.local_restrict=1 && uci_commitverbose "Enable local_restrict for zone wan" firewall
  34                 fi
  35         fi
  36
  37         if [ "$name" == "lan" ] && [ "$lan_is_olsr" == 1 ]; then
  38                         uci set firewall.$1.network=' ' && uci_commitverbose "LAN is used for olsr, removed the lan interface from zone lan" firewall
  39         fi
  40 }
  41
  42 config_foreach handle_fwzone zone
  43
  44 uci batch << EOF
  45         set firewall.zone_freifunk="zone"
  46         set firewall.zone_freifunk.name="freifunk"
  47         set firewall.zone_freifunk.input="$zone_freifunk_input"
  48         set firewall.zone_freifunk.forward="$zone_freifunk_forward"
  49         set firewall.zone_freifunk.output="$zone_freifunk_output"
  50 EOF
  51
  52 uci_commitverbose "Setup firewall zones" firewall
  53
  54 # Usually we need to setup masquerading for lan, except lan is an olsr interface or has an olsr hna-entry
  55
  56 handle_interface() {
  57         config_get interface "$1" interface
  58         if [ "$interface" == "lan" ]; then
  59                 no_masq_lan=1
  60         fi
  61 }
  62 config_load olsrd
  63 config_foreach handle_interface Interface
  64
  65 LANIP="$(uci -q get network.lan.ipaddr)"
  66 if [ -n "$LANIP" ]; then
  67         handle_hna() {
  68                 config_get netaddr "$1" netaddr
  69                         if [ "$LANIP" == "$netaddr" ]; then
  70                         no_masq_lan=1
  71                 fi
  72         }
  73         config_foreach handle_hna Hna4
  74 fi
  75
  76 currms=$(uci -q get firewall.zone_freifunk.masq_src)
  77 if [ ! "$no_masq_lan" == "1" ] && [ ! "$(uci -q get meshwizard.netconfig.lan_config)" == 1 ]; then
  78         uci set firewall.zone_freifunk.masq="1"
  79         [ -z "$(echo $currms |grep lan)" ] && uci add_list firewall.zone_freifunk.masq_src="lan"
  80 fi
  81
  82
  83 # Rules, Forwardings, advanced config and includes
  84
  85 for config in freifunk profile_$community; do
  86
  87         config_load $config
  88
  89         for section in advanced include fw_rule fw_forwarding; do
  90                 handle_firewall() {
  91                         local options=$(uci show $config."$1")
  92                         options=$(echo "$options" | sed -e "s/fw_//g" -e "s/^$config/firewall/g")
  93                         for o in $options; do
  94                                 uci set $o
  95                         done
  96                 }
  97                 config_foreach handle_firewall $section
  98         done
  99 done
 100
 101 # If we use auto-ipv6-dhcp then allow 547/udp on the freifunk zone
 102 if [ "$ipv6_config" = "auto-ipv6-dhcpv6" ]; then
 103         uci batch <<- EOF
 104                 set firewall.dhcpv6=rule
 105                 set firewall.dhcpv6.src=freifunk
 106                 set firewall.dhcpv6.target=ACCEPT
 107                 set firewall.dhcpv6.dest_port=547
 108                 set firewall.dhcpv6.proto=udp
 109         EOF
 110 fi
 111
 112 # Firewall rules to allow incoming ssh and web if enabled
 113
 114 if [ "$wan_allowssh" == 1 ]; then
 115         uci batch <<- EOF
 116                 set firewall.wanssh=rule
 117                 set firewall.wanssh.src=wan
 118                 set firewall.wanssh.target=ACCEPT
 119                 set firewall.wanssh.proto=tcp
 120                 set firewall.wanssh.dest_port=22
 121         EOF
 122 fi
 123
 124 if [ "$wan_allowweb" == 1 ]; then
 125         uci batch <<- EOF
 126                 set firewall.wanweb=rule
 127                 set firewall.wanweb.src=wan
 128                 set firewall.wanweb.target=ACCEPT
 129                 set firewall.wanweb.proto=tcp
 130                 set firewall.wanweb.dest_port=80
 131                 set firewall.wanwebhttps=rule
 132                 set firewall.wanwebhttps.src=wan
 133                 set firewall.wanwebhttps.target=ACCEPT
 134                 set firewall.wanwebhttps.proto=tcp
 135                 set firewall.wanwebhttps.dest_port=443
 136         EOF
 137 fi
 138
 139 uci_commitverbose "Setup rules, forwardings, advanced config and includes." firewall