aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJo-Philipp Wich <jow@openwrt.org>2010-10-03 18:11:59 +0000
committerJo-Philipp Wich <jow@openwrt.org>2010-10-03 18:11:59 +0000
commit7bf84dc4f8b3e2c373134049e4cfdad5b30c5405 (patch)
treedfcbd96088ef0b966246f0a236d1d5a80c40a606
parent0c99eb502318c4349fbe8e326a90281256344944 (diff)
downloadupstream-7bf84dc4f8b3e2c373134049e4cfdad5b30c5405.tar.gz
upstream-7bf84dc4f8b3e2c373134049e4cfdad5b30c5405.tar.bz2
upstream-7bf84dc4f8b3e2c373134049e4cfdad5b30c5405.zip
firewall: also establish forward rules when setting up nat reflection, back out early if reflection is disabled
SVN-Revision: 23201
-rw-r--r--package/firewall/Makefile2
-rw-r--r--package/firewall/files/reflection.hotplug21
2 files changed, 16 insertions, 7 deletions
diff --git a/package/firewall/Makefile b/package/firewall/Makefile
index 1f461567b3..59edb0e3f3 100644
--- a/package/firewall/Makefile
+++ b/package/firewall/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=firewall
PKG_VERSION:=2
-PKG_RELEASE:=18
+PKG_RELEASE:=19
include $(INCLUDE_DIR)/package.mk
diff --git a/package/firewall/files/reflection.hotplug b/package/firewall/files/reflection.hotplug
index b3b5e5ecce..33d121cec4 100644
--- a/package/firewall/files/reflection.hotplug
+++ b/package/firewall/files/reflection.hotplug
@@ -15,6 +15,11 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
iptables -t nat -A postrouting_rule -j nat_reflection_out
}
+ iptables -t filter -F nat_reflection_fwd 2>/dev/null || {
+ iptables -t filter -N nat_reflection_fwd
+ iptables -t filter -A forwarding_rule -j nat_reflection_fwd
+ }
+
find_networks() {
find_networks_cb() {
local cfg="$1"
@@ -34,10 +39,14 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
config_foreach find_networks_cb zone "$1"
}
-
+
setup_fwd() {
local cfg="$1"
+ local reflection
+ config_get_bool reflection "$cfg" reflection 1
+ [ "$reflection" == 1 ] || return
+
local src
config_get src "$cfg" src
@@ -56,10 +65,6 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
local proto
config_get proto "$cfg" proto
- local reflection
- config_get_bool reflection "$cfg" reflection 1
- [ "$reflection" == 1 ] || return
-
local epmin epmax extport
config_get extport "$cfg" src_dport
[ -n "$extport" ] || return
@@ -98,6 +103,11 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
-s $lanip/$lanmk -d $inthost \
-p $p --dport $ipmin${ipmax:+:$ipmax} \
-j SNAT --to-source $lanip
+
+ iptables -t filter -A nat_reflection_fwd \
+ -s $lanip/$lanmk -d $inthost \
+ -p $p --dport $ipmin${ipmax:+:$ipmax} \
+ -j ACCEPT
;;
esac
done
@@ -108,4 +118,3 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
config_load firewall
config_foreach setup_fwd redirect
fi
-