aboutsummaryrefslogtreecommitdiffstats
path: root/package/iptables/files/firewall.init
diff options
context:
space:
mode:
authorFelix Fietkau <nbd@openwrt.org>2006-12-20 05:58:41 +0000
committerFelix Fietkau <nbd@openwrt.org>2006-12-20 05:58:41 +0000
commit4323774d5953f0228a99ca0da502b1e2962bb9f3 (patch)
tree89fda13dac11b58a627c6afc5ce62c8fa6c2e3c2 /package/iptables/files/firewall.init
parent354a4b31a4da3a2a99acf468847a4f25f3ff1904 (diff)
downloadupstream-4323774d5953f0228a99ca0da502b1e2962bb9f3.tar.gz
upstream-4323774d5953f0228a99ca0da502b1e2962bb9f3.tar.bz2
upstream-4323774d5953f0228a99ca0da502b1e2962bb9f3.zip
prepare for moving part of the firewall to hotplug. created new chains {input,forwarding,prerouting}_wan for wan port forwardings and updated the examples. syntax of /etc/config/firewall unchanged and old firewall.user files are still compatible
SVN-Revision: 5878
Diffstat (limited to 'package/iptables/files/firewall.init')
-rwxr-xr-xpackage/iptables/files/firewall.init8
1 files changed, 8 insertions, 0 deletions
diff --git a/package/iptables/files/firewall.init b/package/iptables/files/firewall.init
index 6f1ba8b156..a4014f3ee7 100755
--- a/package/iptables/files/firewall.init
+++ b/package/iptables/files/firewall.init
@@ -18,10 +18,13 @@ start() {
done
iptables -N input_rule
+ iptables -N input_wan
iptables -N output_rule
iptables -N forwarding_rule
+ iptables -N forwarding_wan
iptables -t nat -N prerouting_rule
+ iptables -t nat -N prerouting_wan
iptables -t nat -N postrouting_rule
iptables -N LAN_ACCEPT
@@ -42,6 +45,7 @@ start() {
# insert accept rule or to jump to new accept-check table here
#
iptables -A INPUT -j input_rule
+ [ -z "$WAN" ] || iptables -A INPUT -i $WAN -j input_wan
# allow
iptables -A INPUT -j LAN_ACCEPT # allow from lan/wifi interfaces
@@ -85,6 +89,7 @@ start() {
# insert accept rule or to jump to new accept-check table here
#
iptables -A FORWARD -j forwarding_rule
+ [ -z "$WAN" ] || iptables -A FORWARD -i $WAN -j forwarding_wan
# allow
iptables -A FORWARD -i $LAN -o $LAN -j ACCEPT
@@ -95,6 +100,7 @@ start() {
### MASQ
iptables -t nat -A PREROUTING -j prerouting_rule
+ [ -z "$WAN" ] || iptables -t nat -A PREROUTING -i "$WAN" -j prerouting_wan
iptables -t nat -A POSTROUTING -j postrouting_rule
[ -z "$WAN" ] || iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
@@ -111,8 +117,10 @@ stop() {
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -F
+ iptables -X
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t nat -F
+ iptables -t nat -X
}