diff options
| author | Jo-Philipp Wich <jow@openwrt.org> | 2010-09-11 20:04:34 +0000 |
|---|---|---|
| committer | Jo-Philipp Wich <jow@openwrt.org> | 2010-09-11 20:04:34 +0000 |
| commit | f3dd8278bbc3cc62c35239a2721144e220b24004 (patch) | |
| tree | 275acc3ef643b0347281335c06d6df52970f33cc /package/firewall/files/lib/core_init.sh | |
| parent | 9499018b9ac80ef74aeac3bffea006855dc11bfe (diff) | |
| download | master-31e0f0ae-f3dd8278bbc3cc62c35239a2721144e220b24004.tar.gz master-31e0f0ae-f3dd8278bbc3cc62c35239a2721144e220b24004.tar.bz2 master-31e0f0ae-f3dd8278bbc3cc62c35239a2721144e220b24004.zip | |
firewall: - simplify masquerade rule setup - remove various subshell invocations - speedup fw() by not relying on xargs and pipes - rework SNAT support - attach to dest zone, use src_dip/src_dport as snat source
SVN-Revision: 23024
Diffstat (limited to 'package/firewall/files/lib/core_init.sh')
| -rw-r--r-- | package/firewall/files/lib/core_init.sh | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/package/firewall/files/lib/core_init.sh b/package/firewall/files/lib/core_init.sh index bce94afe02..e1f80ba3fc 100644 --- a/package/firewall/files/lib/core_init.sh +++ b/package/firewall/files/lib/core_init.sh @@ -212,9 +212,6 @@ fw_load_zone() { fw add $mode r ${chain}_notrack - [ $zone_masq == 1 ] && \ - fw add $mode n POSTROUTING ${chain}_nat $ - [ $zone_mtu_fix == 1 ] && \ fw add $mode f FORWARD ${chain}_MSSFIX ^ @@ -243,6 +240,18 @@ fw_load_zone() { done } + # NB: if MASQUERADING for IPv6 becomes available we'll need a family check here + if [ "$zone_masq" == 1 ]; then + local msrc mdst + for msrc in ${zone_masq_src:-0.0.0.0/0}; do + [ "${msrc#!}" != "$msrc" ] && msrc="! -s ${msrc#!}" || msrc="-s $msrc" + for mdst in ${zone_masq_dest:-0.0.0.0/0}; do + [ "${mdst#!}" != "$mdst" ] && mdst="! -d ${mdst#!}" || mdst="-d $mdst" + fw add $mode n ${chain}_nat MASQUERADE $ { $msrc $mdst } + done + done + fi + fw_callback post zone } |