safebox/firewall_containers
7
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

NSENTER selector and nat table seletors included

Browse Source
This commit is contained in:
Gyorgy Berenyi
2021-12-12 20:42:35 +00:00
parent 9a748efe8c
commit 0f8df0c749
1 changed files with 37 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
firewall/firewall-add
View File

@@ -1,11 +1,15 @@
#!/bin/sh #!/bin/sh
# Task type variables
NSENTER=$NSENTER NSENTER=$NSENTER
PREROUTING=$PREROUTING
POSTROUTING=$POSTROUTING
# Mandatory task variables
NAME=$NAME-$COMMENT NAME=$NAME-$COMMENT
CHAIN=$CHAIN CHAIN=$CHAIN
COMMENT=$COMMENT COMMENT=$COMMENT
PROTOCOL=$TYPE PROTOCOL=$TYPE
VPN_IP=$VPN_IP
VPN_NETWORK=$VPN_NETWORK
############################## ##############################
@@ -41,21 +45,41 @@ for source_ip_index in $(seq 1 $COUNT_SOURCE_IP) ; do
# NSENTER Specific settings # # NSENTER Specific settings #
if [[ "$NSENTER" == "true" ]] ; then if [[ "$NSENTER" == "true" ]] ; then
iptables="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- $IPTABLES -t nat"; if [[ "$PREROUTING" == "true" ]] || [[ "$POSTROUTING" == "true" ]] ; then
iptables="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- $IPTABLES -t nat";
# DELETE UNECESSARY LINES FROM PREVIOUS RULES if [[ "$PREROUTING" == "true" ]] ; then
LINES=$($iptables --line-number -n | grep $VPN_NETWORK | awk '{print $1}'| tac) LINES=$($iptables --line-number -n | grep $COMMENT | awk '{print $1}'| tac)
if [ -n "$LINES" ] ; then # DELETE UNECESSARY LINES FROM PREVIOUS RULES
for i in $LINES; do if [ -n "$LINES" ] ; then
$iptables -D $CHAIN $i for i in $LINES; do
sleep 0.1 $iptables -D PREROUTING $i
done sleep 0.1
fi done
fi
$iptables -I POSTROUTING -m state --state established,related -j ACCEPT; $iptables -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT
elif [[ "$POSTROUTING" == "true" ]] ; then
LINES=$($iptables --line-number -n | grep $COMMENT | awk '{print $1}'| tac)
# DELETE UNECESSARY LINES FROM PREVIOUS RULES
if [ -n "$LINES" ] ; then
for i in $LINES; do
$iptables -D POSTROUTING $i
sleep 0.1
done
fi
$iptables -I POSTROUTING -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE
else
ip_route="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- ip route";
fi
$iptables -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT
else else
if $IPTABLES --list $CHAIN |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then if $IPTABLES --list $CHAIN |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then