1 #!/bin/sh /etc/rc.common
6 config_get proto "$cfg" proto
7 config_get dport "$cfg" dport
8 config_get iface "$cfg" iface
9 config_get to "$cfg" to
11 config_get ifname "$iface" ifname
13 [ -n "$proto" ] || return 0
14 [ -n "$dport" ] || return 0
15 [ -n "$ifname" ] || return 0
16 [ -n "$to" ] || return 0
18 ports=$(echo $to | cut -sd: -f2)
19 if [ -n "$ports" ]; then
20 ports="--dport $(echo $ports | sed -e 's/-/:/')"
22 ports="--dport $dport"
25 ip=$(echo $to | cut -d: -f1)
27 if ([ "$proto" == "tcpudp" ] || [ "$proto" == "tcp" ]); then
28 iptables -t nat -A luci_fw_prerouting -i "$ifname" -p tcp --dport "$dport" -j DNAT --to "$to"
29 iptables -A luci_fw_forward -i "$ifname" -p tcp -d "$ip" $ports -j ACCEPT
32 if ([ "$proto" == "tcpudp" ] || [ "$proto" == "udp" ]); then
33 iptables -t nat -A luci_fw_prerouting -i "$ifname" -p udp --dport "$dport" -j DNAT --to "$to"
34 iptables -A luci_fw_forward -i "$ifname" -p udp -d "$ip" $ports -j ACCEPT
40 config_get iface "$cfg" iface
41 config_get oface "$cfg" oface
42 config_get_bool fwd "$cfg" fwd
43 config_get_bool nat "$cfg" nat
44 config_get_bool bidi "$cfg" bidi
46 config_get ifname "$iface" ifname
47 config_get ofname "$oface" ifname
49 [ -n "$ifname" ] || return 0
50 [ -n "$ofname" ] || return 0
53 iptables -A luci_fw_forward -i "$ifname" -o "$ofname" -j ACCEPT
54 [ "$bidi" -gt 0 ] && iptables -A luci_fw_forward -i "$ofname" -o "$ifname" -j ACCEPT
58 config_get ifip "$iface" ipaddr
59 config_get ifmask "$iface" netmask
60 eval "$(ipcalc.sh $ifip $ifmask)"
62 iptables -t nat -A luci_fw_postrouting -s "$NETWORK/$PREFIX" -o "$ofname" -j MASQUERADE
64 [ "$bidi" -gt 0 ] && {
65 config_get ofip "$oface" ipaddr
66 config_get ofmask "$oface" netmask
67 eval "$(ipcalc.sh $ofip $ofmask)"
69 iptables -t nat -A luci_fw_postrouting -s "$NETWORK/$PREFIX" -o "$ifname" -j MASQUERADE
78 config_get chain "$cfg" chain
79 [ -n "$chain" ] || return 0
80 [ "$chain" == "forward" ] && cmd="$cmd -A luci_fw_forward"
81 [ "$chain" == "input" ] && cmd="$cmd -A luci_fw_input"
82 [ "$chain" == "output" ] && cmd="$cmd -A luci_fw_output"
83 [ "$chain" == "prerouting" ] && cmd="$cmd -t nat -A luci_fw_prerouting"
84 [ "$chain" == "postrouting" ] && cmd="$cmd -t nat -A luci_fw_postrouting"
86 config_get iface "$cfg" iface
87 config_get ifname "$iface" ifname
88 [ -n "$ifname" ] && cmd="$cmd -i $ifname"
90 config_get oface "$cfg" oface
91 config_get ofname "$oface" ifname
92 [ -n "$ofname" ] && cmd="$cmd -o $ofname"
94 config_get proto "$cfg" proto
95 [ -n "$proto" ] && cmd="$cmd -p $proto"
97 config_get source "$cfg" source
98 [ -n "$source" ] && cmd="$cmd -s $source"
100 config_get destination "$cfg" destination
101 [ -n "$destination" ] && cmd="$cmd -d $destination"
103 config_get sport "$cfg" sport
104 [ -n "$sport" ] && cmd="$cmd --sport $sport"
106 config_get dport "$cfg" dport
107 [ -n "$dport" ] && cmd="$cmd --dport $dport"
109 config_get todest "$cfg" todest
110 [ -n "$todest" ] && cmd="$cmd --to-destination $todest"
112 config_get tosrc "$cfg" tosrc
113 [ -n "$tosrc" ] && cmd="$cmd --to-source $tosrc"
115 config_get mac "$cfg" mac
116 [ -n "$mac" ] && cmd="$cmd -m mac --mac-source $mac"
118 config_get jump "$cfg" jump
119 [ -n "$jump" ] && cmd="$cmd -j $jump"
121 config_get command "$cfg" command
122 [ -n "$command" ] && cmd="$cmd $command"
129 iptables -N luci_fw_input
130 iptables -N luci_fw_output
131 iptables -N luci_fw_forward
132 iptables -t nat -N luci_fw_prerouting
133 iptables -t nat -N luci_fw_postrouting
135 ### Hook in the chains
136 iptables -A input_rule -j luci_fw_input
137 iptables -A output_rule -j luci_fw_output
138 iptables -A forwarding_rule -j luci_fw_forward
139 iptables -t nat -A prerouting_rule -j luci_fw_prerouting
140 iptables -t nat -A postrouting_rule -j luci_fw_postrouting
142 ### Scan network interfaces
146 ### Read chains from config
148 config_foreach apply_rule rule
149 config_foreach apply_portfw portfw
150 config_foreach apply_routing routing
154 ### Hook out the chains
155 iptables -D input_rule -j luci_fw_input
156 iptables -D output_rule -j luci_fw_output
157 iptables -D forwarding_rule -j luci_fw_forward
158 iptables -t nat -D prerouting_rule -j luci_fw_prerouting
159 iptables -t nat -D postrouting_rule -j luci_fw_postrouting
162 iptables -F luci_fw_input
163 iptables -F luci_fw_output
164 iptables -F luci_fw_forward
165 iptables -t nat -F luci_fw_prerouting
166 iptables -t nat -F luci_fw_postrouting
169 iptables -X luci_fw_input
170 iptables -X luci_fw_output
171 iptables -X luci_fw_forward
172 iptables -t nat -X luci_fw_prerouting
173 iptables -t nat -X luci_fw_postrouting