safebox/firewall_containers
7
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Prerouting and postrouting rules created in functions.

Browse Source
This commit is contained in:
Gyorgy Berenyi
2021-12-15 07:52:50 +00:00
parent 404cc9362e
commit 09b2c0fe2a
1 changed files with 52 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

63
firewall/firewall-add
View File

@@ -21,6 +21,34 @@ IPTABLES=/sbin/iptables-legacy
############################### ###############################
prerouting() {
LINES=$($iptables --line-number -n | grep $COMMENT | grep PREROUTING |awk '{print $1}'| tac)
# DELETE UNECESSARY LINES FROM PREVIOUS RULES
if [ -n "$LINES" ] ; then
for i in $LINES; do
$iptables -D $i
sleep 0.1
done
fi
$iptables -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT
}
postrouting() {
LINES=$($iptables --line-number -n | grep $COMMENT | grep POSTROUTING | awk '{print $1}'| tac)
# DELETE UNECESSARY LINES FROM PREVIOUS RULES
if [ -n "$LINES" ] ; then
for i in $LINES; do
$iptables -D $i
sleep 0.1
done
fi
$iptables -I POSTROUTING -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE
}
COUNT_SOURCE_IP=$(set |grep SOURCE_IP |wc -l) COUNT_SOURCE_IP=$(set |grep SOURCE_IP |wc -l)
COUNT_SOURCE_PORT=$(set |grep SOURCE_PORT |wc -l) COUNT_SOURCE_PORT=$(set |grep SOURCE_PORT |wc -l)
COUNT_TARGET_IP=$(set |grep TARGET_IP |wc -l) COUNT_TARGET_IP=$(set |grep TARGET_IP |wc -l)
@@ -54,31 +82,10 @@ if [[ "$NSENTER" == "true" ]] ; then
iptables="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- $IPTABLES -t nat"; iptables="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- $IPTABLES -t nat";
if [[ "$PREROUTING" == "true" ]] ; then if [[ "$PREROUTING" == "true" ]] ; then
LINES=$($iptables --line-number -n | grep $COMMENT | grep PREROUTING |awk '{print $1}'| tac) prerouting;
# DELETE UNECESSARY LINES FROM PREVIOUS RULES
if [ -n "$LINES" ] ; then
for i in $LINES; do
$iptables -D $i
sleep 0.1
done
fi
$iptables -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT
elif [[ "$POSTROUTING" == "true" ]] ; then elif [[ "$POSTROUTING" == "true" ]] ; then
LINES=$($iptables --line-number -n | grep $COMMENT | grep POSTROUTING | awk '{print $1}'| tac) postrouting;
# DELETE UNECESSARY LINES FROM PREVIOUS RULES
if [ -n "$LINES" ] ; then
for i in $LINES; do
$iptables -D $i
sleep 0.1
done
fi
$iptables -I POSTROUTING -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE
else else
ip_route="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- ip route"; ip_route="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- ip route";
@@ -87,6 +94,14 @@ if [[ "$NSENTER" == "true" ]] ; then
else else
if [[ "$PREROUTING" == "true" ]] || [[ "$POSTROUTING" == "true" ]] ; then
if [[ "$PREROUTING" == "true" ]] ; then
prerouting;
elif [[ "$POSTROUTING" == "true" ]] ; then
postrouting;
else
if $IPTABLES --list $CHAIN |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then if $IPTABLES --list $CHAIN |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then
echo "nothing to do"; echo "nothing to do";
else $IPTABLES -I $CHAIN -m state --state established,related -j ACCEPT; else $IPTABLES -I $CHAIN -m state --state established,related -j ACCEPT;
@@ -106,7 +121,7 @@ else
$IPTABLES -I $CHAIN -s $SOURCE_IP -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT $IPTABLES -I $CHAIN -s $SOURCE_IP -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT
############################# #############################
fi
fi fi
done # target_port done # target_port