firewall-no-nat: Use network masks to identify the subnets.

In the POSTROUTING chains of the NAT table, there is
no more information about on which interface the packet
has arrived (green0, etc.).

diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index a49dcdee6d23adb147b210216972dc07a24047f6..e53c5b54ad637cbd99ed7aa4bff79f1deff5ecea 100644 (file)
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -340,23 +340,23 @@ iptables_red() {
                        MASQUERADE_GREEN="off"
                fi
 
-               local NO_MASQ_DEVICES
+               local NO_MASQ_NETWORKS
 
                if [ "${MASQUERADE_GREEN}" = "off" ]; then
-                       NO_MASQ_DEVICES="${NO_MASQ_DEVICES} ${GREEN_DEV}"
+                       NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${GREEN_NETADDRESS}/${GREEN_NETMASK}"
                fi
 
                if [ "${MASQUERADE_BLUE}" = "off" ]; then
-                       NO_MASQ_DEVICES="${NO_MASQ_DEVICES} ${BLUE_DEV}"
+                       NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${BLUE_NETADDRESS}/${BLUE_NETMASK}"
                fi
 
                if [ "${MASQUERADE_ORANGE}" = "off" ]; then
-                       NO_MASQ_DEVICES="${NO_MASQ_DEVICES} ${ORANGE_DEV}"
+                       NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${ORANGE_NETADDRESS}/${ORANGE_NETMASK}"
                fi
 
-               local device
-               for device in ${NO_MASQ_DEVICES}; do
-                       iptables -t nat -A REDNAT -i "${device}" -o "${IFACE}" -j RETURN
+               local network
+               for network in ${NO_MASQ_NETWORKS}; do
+                       iptables -t nat -A REDNAT -s "${network}" -o "${IFACE}" -j RETURN
                done
 
                # Masquerade everything else