Forward Firewall: changed /etc/init.d/firewall. deleted stop routine and rearranged...

[people/teissler/ipfire-2.x.git] / config / forwardfw / rules.pl

diff --git a/config/forwardfw/rules.pl b/config/forwardfw/rules.pl
index c7acd122b5d98fcc75f8ae8c538288748f550dd4..9f9f7e9919d118b204bd73c427b6d4a4b431bf27 100755 (executable)
--- a/config/forwardfw/rules.pl
+++ b/config/forwardfw/rules.pl
@@ -177,14 +177,20 @@ sub buildrules
        my $snatport;
        my $fireport;
        my $nat;
+       my $fwaccessdport;
        foreach my $key (sort {$a <=> $b} keys %$hash){
-               next if ($$hash{$key}[6] eq 'RED' && $conexists eq 'off' );
+               next if (($$hash{$key}[6] eq 'RED' || $$hash{$key}[6] eq 'RED1') && $conexists eq 'off' );
                if ($$hash{$key}[28] eq 'ON'){
                        $command='iptables -t nat -A';
-                       $natip=&get_nat_ip($$hash{$key}[29]);
+                       $natip=&get_nat_ip($$hash{$key}[29],$$hash{$key}[31]);
                        if($$hash{$key}[31] eq 'dnat'){
                                $nat='DNAT';
-                               $fireport='--dport '.$$hash{$key}[30] if ($$hash{$key}[30]>0);
+                               if ($$hash{$key}[30] =~ /\|/){
+                                       $$hash{$key}[30]=~ tr/|/,/;
+                                       $fireport='-m multiport --dport '.$$hash{$key}[30];
+                               }else{
+                                       $fireport='--dport '.$$hash{$key}[30] if ($$hash{$key}[30]>0);
+                               }
                        }else{
                                $nat='SNAT';
                        }
@@ -209,8 +215,20 @@ sub buildrules
                                        }
                                }
                        }elsif($$hash{$key}[5] eq 'ipfire'){
-                               if($$hash{$key}[6] eq 'Default IP'){
-                                       open(FILE, "/var/ipfire/red/local-ipaddress") or die 'Unable to open config file.';
+                               if($$hash{$key}[6] eq 'GREEN'){
+                                       $targethash{$key}[0]=$defaultNetworks{'GREEN_ADDRESS'};
+                               }
+                               if($$hash{$key}[6] eq 'BLUE'){
+                                       $targethash{$key}[0]=$defaultNetworks{'BLUE_ADDRESS'};
+                               }
+                               if($$hash{$key}[6] eq 'ORANGE'){
+                                       $targethash{$key}[0]=$defaultNetworks{'ORANGE_ADDRESS'};
+                               }
+                               if($$hash{$key}[6] eq 'ALL'){
+                                       $targethash{$key}[0]='0.0.0.0/0';
+                               }
+                               if($$hash{$key}[6] eq 'RED' || $$hash{$key}[6] eq 'RED1'){
+                                       open(FILE, "/var/ipfire/red/local-ipaddress")or die "Couldn't open local-ipaddress";
                                        $targethash{$key}[0]= <FILE>;
                                        close(FILE);
                                }else{
@@ -291,10 +309,19 @@ sub buildrules
                                                                                my ($ip,$sub) =split("/",$targethash{$b}[0]);
                                                                                print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
                                                                                $DPORT =~ s/\-/:/g;
-                                                                               my $fwaccessdport="--dport ".substr($DPORT,1,) if ($DPORT);
+                                                                               if ($DPORT){
+                                                                                       $fwaccessdport="--dport ".substr($DPORT,1,);
+                                                                               }elsif(! $DPORT && $$hash{$key}[30] ne ''){
+                                                                                       if ($$hash{$key}[30]=~m/|/i){
+                                                                                               $$hash{$key}[30] =~ s/\|/,/g;
+                                                                                               $fwaccessdport="-m multiport --dport $$hash{$key}[30]";
+                                                                                       }else{
+                                                                                               $fwaccessdport="--dport $$hash{$key}[30]";
+                                                                                       }
+                                                                               }
                                                                                print "iptables -A PORTFWACCESS $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
-                                                                       }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[32] eq 'snat'){
-                                                                               print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip$fireport\n";
+                                                                       }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){
+                                                                               print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip\n";
                                                                        }
                                                                }                               
                                                        }
@@ -332,9 +359,17 @@ sub buildrules
                                                                                my ($ip,$sub) =split("/",$targethash{$b}[0]);
                                                                                system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
                                                                                $DPORT =~ s/\-/:/g;
-                                                                               my $fwaccessdport="--dport ".substr($DPORT,1,) if ($DPORT);
+                                                                               if ($DPORT){
+                                                                                       $fwaccessdport="--dport ".substr($DPORT,1,);
+                                                                               }elsif(! $DPORT && $$hash{$key}[30] ne ''){
+                                                                                       if ($$hash{$key}[30]=~m/|/i){
+                                                                                               $$hash{$key}[30] =~ s/\|/,/g;
+                                                                                               $fwaccessdport="-m multiport --dport $$hash{$key}[30]";
+                                                                                       }else{
+                                                                                               $fwaccessdport="--dport $$hash{$key}[30]";
+                                                                                       }
+                                                                               }
                                                                                system "iptables -A PORTFWACCESS $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
-                                                                               
                                                                        }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){
                                                                                if ($$hash{$key}[17] eq 'ON'){
                                                                                        system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG --log-prefix 'SNAT '\n";
@@ -359,17 +394,22 @@ sub buildrules
 sub get_nat_ip
 {
        my $val=shift;
+       my $type=shift;
        my $result;
        if($val eq 'RED' || $val eq 'GREEN' || $val eq 'ORANGE' || $val eq 'BLUE'){
                $result=$defaultNetworks{$val.'_ADDRESS'};
        }elsif($val eq 'ALL'){
                $result='-i '.$con;
-       }elsif($val eq 'Default IP'){
+       }elsif($val eq 'Default IP' && $type eq 'dnat'){
                $result='-d '.$redip;
+       }elsif($val eq 'Default IP' && $type eq 'snat'){
+               $result=$redip;
        }else{
                foreach my $al (sort keys %aliases){
-                       if($val eq $al){
+                       if($val eq $al && $type eq 'dnat'){
                                $result='-d '.$aliases{$al}{'IPT'};
+                       }elsif($val eq $al && $type eq 'snat'){
+                               $result=$aliases{$al}{'IPT'};
                        }
                }
        }
@@ -466,7 +506,7 @@ sub get_address
        }elsif($base eq 'ovpn_host_src' ||$base eq 'ovpn_host_tgt' || $base eq 'OpenVPN static host'){
                $$hash{$key}[0]=&fwlib::get_ovpn_host_ip($base2,33);
        }elsif($base eq 'ovpn_n2n_src' ||$base eq 'ovpn_n2n_tgt' || $base eq 'OpenVPN N-2-N'){
-               $$hash{$key}[0]=&fwlib::get_ovpn_n2n_ip($base2,27);
+               $$hash{$key}[0]=&fwlib::get_ovpn_n2n_ip($base2,11);
        }elsif($base eq 'ipsec_net_src' || $base eq 'ipsec_net_tgt' || $base eq 'IpSec Network'){
                $$hash{$key}[0]=&fwlib::get_ipsec_net_ip($base2,11);
        }
@@ -499,6 +539,10 @@ sub get_prot
                        return &fwlib::get_srvgrp_prot($$hash{$key}[15]);
                }
        }
+       #DNAT
+       if ($SRC_TGT eq '' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[11] eq '' && $$hash{$key}[12] ne ''){
+               return "$$hash{$key}[12]";
+       }
 }
 sub get_port
 {