Firewall: Make it possible to use NAT rules with servicegroups.

[people/teissler/ipfire-2.x.git] / config / forwardfw / rules.pl

diff --git a/config/forwardfw/rules.pl b/config/forwardfw/rules.pl
index fcaade2d6632f3416ff742b161642e8c72c73ba7..b3be47da03506e0bfbcfd673408bff389a113808 100755 (executable)
--- a/config/forwardfw/rules.pl
+++ b/config/forwardfw/rules.pl
@@ -53,16 +53,17 @@ my $configoutgoing  = "${General::swroot}/forward/outgoing";
 my $p2pfile                    = "${General::swroot}/forward/p2protocols";
 my $configgrp          = "${General::swroot}/fwhosts/customgroups";
 my $netsettings                = "${General::swroot}/ethernet/settings";
-my $errormessage='';
-my $orange;
-my $green;
-my $blue;
+my $errormessage       = '';
+my $orange                     = '';
+my $green                      = '';
+my $blue                       = '';
 my ($TYPE,$PROT,$SPROT,$DPROT,$SPORT,$DPORT,$TIME,$TIMEFROM,$TIMETILL,$SRC_TGT);
-my $CHAIN="FORWARDFW";
-my $conexists='off';
-my $command = 'iptables -A';
-my $dnat='';
-my $snat='';
+my $CHAIN                      = "FORWARDFW";
+my $conexists          = 'off';
+my $command                    = 'iptables -A';
+my $dnat                       ='';
+my $snat                       ='';
+
 &General::readhash("${General::swroot}/forward/settings", \%fwdfwsettings);
 &General::readhash("$netsettings", \%defaultNetworks);
 &General::readhasharray($configfwdfw, \%configfwdfw);
@@ -81,13 +82,13 @@ if (-f "/var/ipfire/red/active"){
 open (CONN1,"/var/ipfire/red/local-ipaddress");
 my $redip = <CONN1>;
 close(CONN1);
-################################
-#    DEBUG/TEST                #
-################################
+#################
+#    DEBUG/TEST #
+#################
 my $MODE=0;     # 0 - normal operation
-                               # 1 - print configline and rules to console     
-                               # 
-################################               
+                               # 1 - print configline and rules to console
+                               #
+#################
 my $param=shift;
 
 if($param eq 'flush'){
@@ -107,7 +108,7 @@ if($param eq 'flush'){
        if($MODE eq '0'){
                if ($fwdfwsettings{'POLICY'} eq 'MODE1'){
                        &p2pblock;
-                       system ("/usr/sbin/firewall-policy"); 
+                       system ("/usr/sbin/firewall-policy");
                }elsif($fwdfwsettings{'POLICY'} eq 'MODE2'){
                        &p2pblock;
                        system ("iptables -A $CHAIN -m conntrack --ctstate NEW -j ACCEPT");
@@ -123,7 +124,7 @@ sub flush
        system ("iptables -F OUTGOINGFW");
        system ("iptables -t nat -F NAT_DESTINATION");
        system ("iptables -t nat -F NAT_SOURCE");
-}                      
+}
 sub preparerules
 {
        if (! -z  "${General::swroot}/forward/config"){
@@ -236,12 +237,12 @@ sub buildrules
                                if($$hash{$key}[24] ne ''){push (@timeframe,"Sat");}
                                if($$hash{$key}[25] ne ''){push (@timeframe,"Sun");}
                                $TIME=join(",",@timeframe);
-                               
+
                                $TIMEFROM="--timestart $time1 ";
                                $TIMETILL="--timestop $time2 ";
                                $TIME="-m time --weekdays $TIME $TIMEFROM $TIMETILL";
                        }
-                       if ($MODE eq '1'){      
+                       if ($MODE eq '1'){
                                print "NR:$key ";
                                foreach my $i (0 .. $#{$$hash{$key}}){
                                        print "$i: $$hash{$key}[$i]  ";
@@ -277,16 +278,22 @@ sub buildrules
                                                                                        print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $fireport $TIME -j LOG --log-prefix 'DNAT' \n";
                                                                                }
                                                                                my ($ip,$sub) =split("/",$targethash{$b}[0]);
-                                                                               print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
-                                                                               $DPORT =~ s/\-/:/g;
-                                                                               if ($DPORT){
-                                                                                       $fwaccessdport="--dport ".substr($DPORT,1,);
-                                                                               }elsif(! $DPORT && $$hash{$key}[30] ne ''){
-                                                                                       if ($$hash{$key}[30]=~m/|/i){
-                                                                                               $$hash{$key}[30] =~ s/\|/,/g;
-                                                                                               $fwaccessdport="-m multiport --dport $$hash{$key}[30]";
-                                                                                       }else{
-                                                                                               $fwaccessdport="--dport $$hash{$key}[30]";
+                                                                               #Process NAT with servicegroup used
+                                                                               if ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[14] eq 'cust_srvgrp'){
+                                                                                       print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip $DPORT\n";
+                                                                                       $fwaccessdport=$DPORT;
+                                                                               }else{
+                                                                                       print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
+                                                                                       $DPORT =~ s/\-/:/g;
+                                                                                       if ($DPORT){
+                                                                                               $fwaccessdport="--dport ".substr($DPORT,1,);
+                                                                                       }elsif(! $DPORT && $$hash{$key}[30] ne ''){
+                                                                                               if ($$hash{$key}[30]=~m/|/i){
+                                                                                                       $$hash{$key}[30] =~ s/\|/,/g;
+                                                                                                       $fwaccessdport="-m multiport --dport $$hash{$key}[30]";
+                                                                                               }else{
+                                                                                                       $fwaccessdport="--dport $$hash{$key}[30]";
+                                                                                               }
                                                                                        }
                                                                                }
                                                                                print "iptables -A FORWARDFW $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
@@ -301,7 +308,10 @@ sub buildrules
                                                                        if ($PROT ne '-p ICMP'){
                                                                                print "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
                                                                        }
-                                                               }                               
+                                                                       if ($PROT eq '-p ICMP' && $$hash{$key}[9] eq 'All ICMP-Types'){
+                                                                               print "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
+                                                                       }
+                                                               }
                                                        }
                                                }
                                        }
@@ -338,16 +348,22 @@ sub buildrules
                                                                                        system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $fireport $TIME -j LOG --log-prefix 'DNAT' \n";
                                                                                }
                                                                                my ($ip,$sub) =split("/",$targethash{$b}[0]);
-                                                                               system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
-                                                                               $DPORT =~ s/\-/:/g;
-                                                                               if ($DPORT){
-                                                                                       $fwaccessdport="--dport ".substr($DPORT,1,);
-                                                                               }elsif(! $DPORT && $$hash{$key}[30] ne ''){
-                                                                                       if ($$hash{$key}[30]=~m/|/i){
-                                                                                               $$hash{$key}[30] =~ s/\|/,/g;
-                                                                                               $fwaccessdport="-m multiport --dport $$hash{$key}[30]";
-                                                                                       }else{
-                                                                                               $fwaccessdport="--dport $$hash{$key}[30]";
+                                                                               #Process NAT with servicegroup used
+                                                                               if ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[14] eq 'cust_srvgrp'){
+                                                                                       system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip $DPORT\n";
+                                                                                       $fwaccessdport=$DPORT;
+                                                                               }else{
+                                                                                       system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
+                                                                                       $DPORT =~ s/\-/:/g;
+                                                                                       if ($DPORT){
+                                                                                               $fwaccessdport="--dport ".substr($DPORT,1,);
+                                                                                       }elsif(! $DPORT && $$hash{$key}[30] ne ''){
+                                                                                               if ($$hash{$key}[30]=~m/|/i){
+                                                                                                       $$hash{$key}[30] =~ s/\|/,/g;
+                                                                                                       $fwaccessdport="-m multiport --dport $$hash{$key}[30]";
+                                                                                               }else{
+                                                                                                       $fwaccessdport="--dport $$hash{$key}[30]";
+                                                                                               }
                                                                                        }
                                                                                }
                                                                                system "iptables -A FORWARDFW $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
@@ -364,7 +380,11 @@ sub buildrules
                                                                        if ($PROT ne '-p ICMP'){
                                                                                system "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
                                                                        }
-                                                               }                               
+                                                                       #PROCESS Prot ICMP and type = All ICMP-Types
+                                                                       if ($PROT eq '-p ICMP' && $$hash{$key}[9] eq 'All ICMP-Types'){
+                                                                               system "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
+                                                                       }
+                                                               }
                                                        }
                                                }
                                        }
@@ -472,7 +492,7 @@ sub get_address
        my $type=shift; #src or tgt
        my $hash;
        if ($type eq 'src'){
-               $hash=\%sourcehash;     
+               $hash=\%sourcehash;
        }else{
                $hash=\%targethash;
        }