From: Alexander Marx <amarx@ipfire.org>
Date: Mon, 24 Feb 2014 10:48:41 +0000 (+0100)
Subject: Firewall: modified DNAT and SNAT rulecreation
X-Git-Url: http://git.ipfire.org/?p=people%2Fteissler%2Fipfire-2.x.git;a=commitdiff_plain;h=525204e00fc28fa3fe9971c4fb31c61279b10bbb;ds=sidebyside

Firewall: modified DNAT and SNAT rulecreation
---

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 377483e6d..d315a6c01 100755
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -286,10 +286,10 @@ sub buildrules
 										my ($ip,$sub) =split("/",$targethash{$b}[0]);
 										#Process NAT with servicegroup used
 										if ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[14] eq 'cust_srvgrp'){
-											print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip $DPORT\n";
+											print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to-destination $ip $DPORT\n";
 											$fwaccessdport=$DPORT;
 										}else{
-											print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
+											print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to-destination $ip$DPORT\n";
 											$DPORT =~ s/\-/:/g;
 											if ($DPORT){
 												$fwaccessdport="--dport ".substr($DPORT,1,);
@@ -310,7 +310,7 @@ sub buildrules
 										if ($$hash{$key}[17] eq 'ON' ){
 											print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG --log-prefix 'SNAT' \n";
 										}
-										print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip\n";
+										print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to-source $natip\n";
 									}
 									#PROCESS EVERY OTHER RULE (If NOT ICMP, else the rule would be applied double)
 									if ($PROT ne '-p ICMP'){
@@ -370,10 +370,10 @@ sub buildrules
 										my ($ip,$sub) =split("/",$targethash{$b}[0]);
 										#Process NAT with servicegroup used
 										if ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[14] eq 'cust_srvgrp'){
-											system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip $DPORT\n";
+											system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to-destination $ip $DPORT\n";
 											$fwaccessdport=$DPORT;
 										}else{
-											system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
+											system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to-destination $ip$DPORT\n";
 											$DPORT =~ s/\-/:/g;
 											if ($DPORT){
 												$fwaccessdport="--dport ".substr($DPORT,1,);
@@ -394,7 +394,7 @@ sub buildrules
 										if ($$hash{$key}[17] eq 'ON' ){
 											system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG --log-prefix 'SNAT' \n";
 										}
-										system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip\n";
+										system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to-source $natip\n";
 									}
 									#PROCESS EVERY OTHER RULE (If NOT ICMP, else the rule would be applied double)
 									if ($PROT ne '-p ICMP'){