aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJo-Philipp Wich <jow@openwrt.org>2011-04-12 20:03:59 +0000
committerJo-Philipp Wich <jow@openwrt.org>2011-04-12 20:03:59 +0000
commita9977eca9145b9f061ceb1d1604f59efba1b2949 (patch)
tree2a6c6bd5aa65cef00e2657805fcd10cf52b641de
parent095946758305cbef0391a557fe02adc755b4a60a (diff)
downloadupstream-a9977eca9145b9f061ceb1d1604f59efba1b2949.tar.gz
upstream-a9977eca9145b9f061ceb1d1604f59efba1b2949.tar.bz2
upstream-a9977eca9145b9f061ceb1d1604f59efba1b2949.zip
firewall: allow local redirection of ports
Allow a redirect like: config redirect option src 'wan' option dest 'lan' option src_dport '22001' option dest_port '22' option proto 'tcp' note the absence of the "dest_ip" field, meaning to terminate the connection on the firewall itself. This patch makes three changes: (1) moves the conntrack module into the conntrack package (but not any of the conntrack_* helpers). (2) fixes a bug where the wrong table is used when the "dest_ip" field is absent. (3) accepts incoming connections on the destination port on the input_ZONE table, but only for DNATted connections. In the above example, ssh -p 22 root@myrouter would fail from the outside, but: ssh -p 22001 root@myrouter would succeed. This is handy if: (1) you want to avoid ssh probes on your router, or (2) you want to redirect incoming connections on port 22 to some machine inside your firewall, but still want to allow firewall access from outside. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com> SVN-Revision: 26617
-rw-r--r--include/netfilter.mk4
-rw-r--r--package/firewall/files/lib/core_redirect.sh5
2 files changed, 4 insertions, 5 deletions
diff --git a/include/netfilter.mk b/include/netfilter.mk
index fe468fca31..9da455a07a 100644
--- a/include/netfilter.mk
+++ b/include/netfilter.mk
@@ -60,6 +60,8 @@ $(eval $(call nf_add,IPT_CONNTRACK,CONFIG_NETFILTER_XT_MATCH_STATE, $(P_XT)xt_st
$(eval $(call nf_add,IPT_CONNTRACK,CONFIG_IP_NF_RAW, $(P_V4)iptable_raw))
$(eval $(call nf_add,IPT_CONNTRACK,CONFIG_IP_NF_TARGET_NOTRACK, $(P_V4)ipt_NOTRACK))
$(eval $(call nf_add,IPT_CONNTRACK,CONFIG_NETFILTER_XT_TARGET_NOTRACK, $(P_XT)xt_NOTRACK))
+$(eval $(call nf_add,IPT_CONNTRACK,CONFIG_IP_NF_MATCH_CONNTRACK, $(P_V4)ipt_conntrack))
+$(eval $(call nf_add,IPT_CONNTRACK,CONFIG_NETFILTER_XT_MATCH_CONNTRACK, $(P_XT)xt_conntrack))
# conntrack-extra
@@ -68,8 +70,6 @@ $(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_IP_NF_MATCH_CONNBYTES, $(P_V4)ip
$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_MATCH_CONNBYTES, $(P_XT)xt_connbytes))
$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_IP_NF_MATCH_CONNMARK, $(P_V4)ipt_connmark))
$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_MATCH_CONNMARK, $(P_XT)xt_connmark))
-$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_IP_NF_MATCH_CONNTRACK, $(P_V4)ipt_conntrack))
-$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_MATCH_CONNTRACK, $(P_XT)xt_conntrack))
$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_IP_NF_MATCH_HELPER, $(P_V4)ipt_helper))
$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_MATCH_HELPER, $(P_XT)xt_helper))
$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_IP_NF_MATCH_RECENT, $(P_V4)ipt_recent))
diff --git a/package/firewall/files/lib/core_redirect.sh b/package/firewall/files/lib/core_redirect.sh
index 87941a2a17..64c619e434 100644
--- a/package/firewall/files/lib/core_redirect.sh
+++ b/package/firewall/files/lib/core_redirect.sh
@@ -34,7 +34,7 @@ fw_load_redirect() {
return 0
}
- fwdchain="zone_${redirect_src}_forward"
+ fwdchain="zone_${redirect_src}${redirect_dest_ip:+_forward}"
natopt="--to-destination"
natchain="zone_${redirect_src}_prerouting"
@@ -100,9 +100,8 @@ fw_load_redirect() {
$natopt $nataddr${natports:+:$natports} \
}
- [ -n "$destaddr" ] && \
fw add $mode f ${fwdchain:-forward} ACCEPT ^ { $redirect_src_ip $redirect_dest_ip } { \
- $srcaddr $destaddr \
+ $srcaddr ${destaddr:--m conntrack --ctstate DNAT} \
${redirect_proto:+-p $redirect_proto} \
${srcports:+--sport $srcports} \
${destports:+--dport $destports} \