module/admin-core/contrib/init.d/luci_fw

   1 #!/bin/sh /etc/rc.common
   2 START=46
   3
   4 apply_portfw() {
   5         local cfg="$1"
   6         config_get proto "$cfg" proto
   7         config_get dport "$cfg" dport
   8         config_get iface "$cfg" iface
   9         config_get to    "$cfg" to
  10
  11         ports=$(echo $to | cut -sd: -f2)
  12         if [ -n "$ports" ]; then
  13                 ports="--dport $(echo $ports | sed -e 's/-/:/')"
  14         else
  15                 ports="--dport $dport"
  16         fi
  17
  18         ip=$(echo $to | cut -d: -f1)
  19
  20         if ([ "$proto" == "tcpudp" ] || [ "$proto" == "tcp" ]); then
  21                 iptables -t nat -A luci_fw_prerouting -i "$iface" -p tcp --dport "$dport" -j DNAT --to "$to"
  22                 iptables -A luci_fw_forward -i "$iface" -p tcp -d "$ip" $ports -j ACCEPT
  23         fi
  24
  25         if ([ "$proto" == "tcpudp" ] || [ "$proto" == "udp" ]); then
  26                 iptables -t nat -A luci_fw_prerouting -i "$iface" -p udp --dport "$dport" -j DNAT --to "$to"
  27                 iptables -A luci_fw_forward -i "$iface" -p udp -d "$ip" $ports -j ACCEPT
  28         fi
  29 }
  30
  31 apply_rule() {
  32         local cfg="$1"
  33         local cmd=""
  34
  35         config_get chain "$cfg" chain
  36         [ -n "$chain" ] || return 0
  37         [ "$chain" == "forward" ] && cmd="$cmd -A luci_fw_forward"
  38         [ "$chain" == "input" ] && cmd="$cmd -A luci_fw_input"
  39         [ "$chain" == "output" ] && cmd="$cmd -A luci_fw_output"
  40         [ "$chain" == "prerouting" ] && cmd="$cmd -t nat -A luci_fw_prerouting"
  41         [ "$chain" == "postrouting" ] && cmd="$cmd -t nat -A luci_fw_postrouting"
  42
  43         config_get iface "$cfg" iface
  44         [ -n "$iface" ] && cmd="$cmd -i $iface"
  45
  46         config_get oface "$cfg" oface
  47         [ -n "$oface" ] && cmd="$cmd -o $oface"
  48
  49         config_get proto "$cfg" proto
  50         [ -n "$proto" ] && cmd="$cmd -p $proto"
  51
  52         config_get source "$cfg" source
  53         [ -n "$source" ] && cmd="$cmd -s $source"
  54
  55         config_get destination "$cfg" destination
  56         [ -n "$destination" ] && cmd="$cmd -d $destination"
  57
  58         config_get sport "$cfg" sport
  59         [ -n "$sport" ] && cmd="$cmd --sport $sport"
  60
  61         config_get dport "$cfg" dport
  62         [ -n "$dport" ] && cmd="$cmd --dport $dport"
  63
  64         config_get todest "$cfg" todest
  65         [ -n "$todest" ] && cmd="$cmd --to-destination $todest"
  66
  67         config_get tosrc "$cfg" tosrc
  68         [ -n "$tosrc" ] && cmd="$cmd --to-source $tosrc"
  69
  70         config_get mac "$cfg" mac
  71         [ -n "$mac" ] && cmd="$cmd -m mac --mac-source $mac"
  72
  73         config_get jump "$cfg" jump
  74         [ -n "$jump" ] && cmd="$cmd -j $jump"
  75
  76         config_get command "$cfg" command
  77         [ -n "$command" ] && cmd="$cmd $command"
  78
  79         iptables $cmd
  80 }
  81
  82 start() {
  83         ### Create subchains
  84         iptables -N luci_fw_input
  85         iptables -N luci_fw_output
  86         iptables -N luci_fw_forward
  87         iptables -t nat -N luci_fw_prerouting
  88         iptables -t nat -N luci_fw_postrouting
  89
  90         ### Hook in the chains
  91         iptables -A input_rule -j luci_fw_input
  92         iptables -A output_rule -j luci_fw_output
  93         iptables -A forwarding_rule -j luci_fw_forward
  94         iptables -t nat -A prerouting_rule -j luci_fw_prerouting
  95         iptables -t nat -A postrouting_rule -j luci_fw_postrouting
  96
  97         ### Read chains from config
  98         config_load luci_fw
  99         config_foreach apply_portfw portfw
 100         config_foreach apply_rule rule
 101 }
 102
 103 stop() {
 104         ### Hook out the chains
 105         iptables -D input_rule -j luci_fw_input
 106         iptables -D output_rule -j luci_fw_output
 107         iptables -D forwarding_rule -j luci_fw_forward
 108         iptables -t nat -D prerouting_rule -j luci_fw_prerouting
 109         iptables -t nat -D postrouting_rule -j luci_fw_postrouting
 110
 111         ### Clear subchains
 112         iptables -F luci_fw_input
 113         iptables -F luci_fw_output
 114         iptables -F luci_fw_forward
 115         iptables -t nat -F luci_fw_prerouting
 116         iptables -t nat -F luci_fw_postrouting
 117
 118         ### Delete subchains
 119         iptables -X luci_fw_input
 120         iptables -X luci_fw_output
 121         iptables -X luci_fw_forward
 122         iptables -t nat -X luci_fw_prerouting
 123         iptables -t nat -X luci_fw_postrouting
 124 }