diff options
| author | Jo-Philipp Wich <jow@openwrt.org> | 2010-10-03 18:11:59 +0000 |
|---|---|---|
| committer | Jo-Philipp Wich <jow@openwrt.org> | 2010-10-03 18:11:59 +0000 |
| commit | 7cd9ce2291053b1e57f6c974ad8350f0d7c7a36d (patch) | |
| tree | 4116386709044cc5bf70c407dd97bd68f1c653dc /package | |
| parent | ceb09bdfb8f2ee7ccd7e37fec801f72fc95405cb (diff) | |
| download | master-187ad058-7cd9ce2291053b1e57f6c974ad8350f0d7c7a36d.tar.gz master-187ad058-7cd9ce2291053b1e57f6c974ad8350f0d7c7a36d.tar.bz2 master-187ad058-7cd9ce2291053b1e57f6c974ad8350f0d7c7a36d.zip | |
[package] firewall: also establish forward rules when setting up nat reflection, back out early if reflection is disabled
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23201 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package')
| -rw-r--r-- | package/firewall/Makefile | 2 | ||||
| -rw-r--r-- | package/firewall/files/reflection.hotplug | 21 |
2 files changed, 16 insertions, 7 deletions
diff --git a/package/firewall/Makefile b/package/firewall/Makefile index 1f461567b3..59edb0e3f3 100644 --- a/package/firewall/Makefile +++ b/package/firewall/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=firewall PKG_VERSION:=2 -PKG_RELEASE:=18 +PKG_RELEASE:=19 include $(INCLUDE_DIR)/package.mk diff --git a/package/firewall/files/reflection.hotplug b/package/firewall/files/reflection.hotplug index b3b5e5ecce..33d121cec4 100644 --- a/package/firewall/files/reflection.hotplug +++ b/package/firewall/files/reflection.hotplug @@ -15,6 +15,11 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then iptables -t nat -A postrouting_rule -j nat_reflection_out } + iptables -t filter -F nat_reflection_fwd 2>/dev/null || { + iptables -t filter -N nat_reflection_fwd + iptables -t filter -A forwarding_rule -j nat_reflection_fwd + } + find_networks() { find_networks_cb() { local cfg="$1" @@ -34,10 +39,14 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then config_foreach find_networks_cb zone "$1" } - + setup_fwd() { local cfg="$1" + local reflection + config_get_bool reflection "$cfg" reflection 1 + [ "$reflection" == 1 ] || return + local src config_get src "$cfg" src @@ -56,10 +65,6 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then local proto config_get proto "$cfg" proto - local reflection - config_get_bool reflection "$cfg" reflection 1 - [ "$reflection" == 1 ] || return - local epmin epmax extport config_get extport "$cfg" src_dport [ -n "$extport" ] || return @@ -98,6 +103,11 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then -s $lanip/$lanmk -d $inthost \ -p $p --dport $ipmin${ipmax:+:$ipmax} \ -j SNAT --to-source $lanip + + iptables -t filter -A nat_reflection_fwd \ + -s $lanip/$lanmk -d $inthost \ + -p $p --dport $ipmin${ipmax:+:$ipmax} \ + -j ACCEPT ;; esac done @@ -108,4 +118,3 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then config_load firewall config_foreach setup_fwd redirect fi - |