Forward Firewall: Added multiport support to DNAT/Portforwarding

[people/teissler/ipfire-2.x.git] / config / forwardfw / rules.pl

diff --git a/config/forwardfw/rules.pl b/config/forwardfw/rules.pl
index 9af2c7060ff3acb954d42b94b6cc04c2fe029d81..917e061eb97e8be11891a89d7b905f7b6a0cd829 100755 (executable)
--- a/config/forwardfw/rules.pl
+++ b/config/forwardfw/rules.pl
@@ -176,16 +176,23 @@ sub buildrules
        my $natip;
        my $snatport;
        my $fireport;
+       my $nat;
+       my $fwaccessdport;
        foreach my $key (sort {$a <=> $b} keys %$hash){
                next if ($$hash{$key}[6] eq 'RED' && $conexists eq 'off' );
                if ($$hash{$key}[28] eq 'ON'){
                        $command='iptables -t nat -A';
                        $natip=&get_nat_ip($$hash{$key}[29]);
                        if($$hash{$key}[31] eq 'dnat'){
-                               $$hash{$key}[0]='DNAT';
-                               $fireport='--dport '.$$hash{$key}[30] if ($$hash{$key}[30]>0);
+                               $nat='DNAT';
+                               if ($$hash{$key}[30] =~ /\|/){
+                                       $$hash{$key}[30]=~ tr/|/,/;
+                                       $fireport='-m multiport --dport '.$$hash{$key}[30];
+                               }else{
+                                       $fireport='--dport '.$$hash{$key}[30] if ($$hash{$key}[30]>0);
+                               }
                        }else{
-                               $$hash{$key}[0]='SNAT';
+                               $nat='SNAT';
                        }
                }
                $STAG='';
@@ -287,12 +294,22 @@ sub buildrules
                                                                                if ($$hash{$key}[17] eq 'ON'){
                                                                                        print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $fireport $TIME -j LOG --log-prefix 'DNAT' \n";
                                                                                }
-                                                                               my $fwaccessdport="--dport ".substr($DPORT,1,) if ($DPORT);
                                                                                my ($ip,$sub) =split("/",$targethash{$b}[0]);
-                                                                               print "iptables -A PORTFWACCESS $PROT -i $con -d $ip $fwaccessdport $TIME -j ACCEPT\n";
-                                                                               print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $$hash{$key}[0]  --to $ip$DPORT\n";
+                                                                               print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
+                                                                               $DPORT =~ s/\-/:/g;
+                                                                               if ($DPORT){
+                                                                                       $fwaccessdport="--dport ".substr($DPORT,1,);
+                                                                               }elsif(! $DPORT && $$hash{$key}[30] ne ''){
+                                                                                       if ($$hash{$key}[30]=~m/|/i){
+                                                                                               $$hash{$key}[30] =~ s/\|/,/g;
+                                                                                               $fwaccessdport="-m multiport --dport $$hash{$key}[30]";
+                                                                                       }else{
+                                                                                               $fwaccessdport="--dport $$hash{$key}[30]";
+                                                                                       }
+                                                                               }
+                                                                               print "iptables -A PORTFWACCESS $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
                                                                        }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[32] eq 'snat'){
-                                                                               print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]  --to $natip$fireport\n";
+                                                                               print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip$fireport\n";
                                                                        }
                                                                }                               
                                                        }
@@ -327,15 +344,25 @@ sub buildrules
                                                                                if ($$hash{$key}[17] eq 'ON'){
                                                                                        system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j LOG --log-prefix 'DNAT' \n";
                                                                                }
-                                                                               my $fwaccessdport="--dport ".substr($DPORT,1,) if ($DPORT);
                                                                                my ($ip,$sub) =split("/",$targethash{$b}[0]);
-                                                                               system "iptables -A PORTFWACCESS $PROT -i $con -d $ip $fwaccessdport $TIME -j ACCEPT\n";
-                                                                               system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $$hash{$key}[0]  --to $ip$DPORT\n";
+                                                                               system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
+                                                                               $DPORT =~ s/\-/:/g;
+                                                                               if ($DPORT){
+                                                                                       $fwaccessdport="--dport ".substr($DPORT,1,);
+                                                                               }elsif(! $DPORT && $$hash{$key}[30] ne ''){
+                                                                                       if ($$hash{$key}[30]=~m/|/i){
+                                                                                               $$hash{$key}[30] =~ s/\|/,/g;
+                                                                                               $fwaccessdport="-m multiport --dport $$hash{$key}[30]";
+                                                                                       }else{
+                                                                                               $fwaccessdport="--dport $$hash{$key}[30]";
+                                                                                       }
+                                                                               }
+                                                                               system "iptables -A PORTFWACCESS $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
                                                                        }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){
                                                                                if ($$hash{$key}[17] eq 'ON'){
                                                                                        system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG --log-prefix 'SNAT '\n";
                                                                                }
-                                                                               system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]  --to $natip$fireport\n";
+                                                                               system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat  --to $natip$fireport\n";
                                                                        }
                                                                }                               
                                                        }
@@ -495,6 +522,10 @@ sub get_prot
                        return &fwlib::get_srvgrp_prot($$hash{$key}[15]);
                }
        }
+       #DNAT
+       if ($SRC_TGT eq '' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[11] eq '' && $$hash{$key}[12] ne ''){
+               return "$$hash{$key}[12]";
+       }
 }
 sub get_port
 {
@@ -519,7 +550,6 @@ sub get_port
                        return;
                }
        }elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){
-               
                if($$hash{$key}[14] eq 'TGT_PORT'){
                        if ($$hash{$key}[15] ne ''){
                                $$hash{$key}[15] =~ s/\|/,/g;
@@ -529,6 +559,7 @@ sub get_port
                                        if($$hash{$key}[28] ne 'ON' || ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat') ){
                                                return "--dport $$hash{$key}[15] ";
                                         }else{
+                                                $$hash{$key}[15] =~ s/\:/-/g;
                                                return ":$$hash{$key}[15]";
                                         }
                                }