safebox/firewall_containers
7
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fixing SOURE_PORT variables cycle.

Browse Source
This commit is contained in:
Gyorgy Berenyi
2021-06-18 12:27:30 +00:00
parent 47bcb30048
commit 1ace0d51e7
1 changed files with 51 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

98
firewall/firewall-add
View File

@@ -1,5 +1,6 @@
#!/bin/sh #!/bin/sh
NSENTER=$NSENTER NSENTER=$NSENTER
NAME=$NAME-$COMMENT
CHAIN=$CHAIN CHAIN=$CHAIN
COMMENT=$COMMENT COMMENT=$COMMENT
PROTOCOL=$TYPE PROTOCOL=$TYPE
@@ -18,74 +19,77 @@ COUNT_SOURCE_PORT=$(set |grep SOURCE_PORT |wc -l)
COUNT_TARGET_IP=$(set |grep TARGET_IP |wc -l) COUNT_TARGET_IP=$(set |grep TARGET_IP |wc -l)
COUNT_TARGET_PORT=$(set |grep TARGET_PORT |wc -l) COUNT_TARGET_PORT=$(set |grep TARGET_PORT |wc -l)
for source_ip_index in $(seq 1 $COUNT_SOURCE_IP) ; do for source_ip_index in $(seq 1 $COUNT_SOURCE_IP) ; do
if set |grep SOURCE_IP_ ; then if set |grep SOURCE_IP_ ; then
SOURCE_IP=$(eval "echo \${"SOURCE_IP_$source_ip_index"}") SOURCE_IP=$(eval "echo \${"SOURCE_IP_$source_ip_index"}")
fi fi
for target_ip_index in $(seq 1 $COUNT_TARGET_IP) ; do
if set |grep TARGET_IP_ ; then
TARGET_IP=$(eval "echo \${"TARGET_IP_$target_ip_index"}")
fi
for target_port_index in $(seq 1 $COUNT_TARGET_PORT) ; do
if set |grep TARGET_PORT_ ; then
TARGET_PORT=$(eval "echo \${"TARGET_PORT_$target_port_index"}")
fi
#############################
# NSENTER Specific settings #
if [[ "$NSENTER" == "true" ]] ; then
iptables="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- /sbin/iptables-legacy -t nat";
if $iptables --list POSTROUTING |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then
echo "nothing to do";
else $iptables -I POSTROUTING -m state --state established,related -j ACCEPT;
fi
for source_port_index in $(seq 1 $COUNT_SOURCE_PORT) ; do for source_port_index in $(seq 1 $COUNT_SOURCE_PORT) ; do
if set |grep SOURCE_PORT_ ; then if set |grep SOURCE_PORT_ ; then
SOURCE_PORT=$(eval "echo \${"SOURCE_PORT_$source_port_index"}") SOURCE_PORT=$(eval "echo \${"SOURCE_PORT_$source_port_index"}")
fi fi
for target_ip_index in $(seq 1 $COUNT_TARGET_IP) ; do
if set |grep TARGET_IP_ ; then
TARGET_IP=$(eval "echo \${"TARGET_IP_$target_ip_index"}")
fi
for target_port_index in $(seq 1 $COUNT_TARGET_PORT) ; do # DELETE UNECESSARY LINES FROM PREVIOUS RULES
if set |grep TARGET_PORT_ ; then LINES=$($iptables --line-number -n --list POSTROUTING | grep $SOURCE_IP |grep $TARGET_IP |grep $PROTOCOL |grep $SOURCE_PORT |grep $TARGET_PORT | awk '{print $1}'| tac)
TARGET_PORT=$(eval "echo \${"TARGET_PORT_$target_port_index"}")
fi
############################# if [ -n "$LINES" ] ; then
for i in $LINES; do
$iptables -D PREROUTING $i
sleep 0.1
done
fi
# NSENTER Specific settings # $iptables -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT
if [[ "$NSENTER" == "true" ]] ; then
iptables="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- /sbin/iptables-legacy -t nat";
if $iptables --list POSTROUTING |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then
else $iptables -I POSTROUTING -m state --state established,related -j ACCEPT;
fi
# DELETE UNECESSARY LINES FROM PREVIOUS RULES
LINES=$($iptables --line-number -n --list POSTROUTING | grep $SOURCE_IP |grep $TARGET_IP |grep $PROTOCOL |grep $SOURCE_PORT |grep $TARGET_PORT | awk '{print $1}'| tac)
if [ -n "$LINES" ] ; then
for i in $LINES; do
$iptables -D PREROUTING $i
sleep 0.1
done
fi
$iptables -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT
done
else else
iptables="/sbin/iptables-legacy" iptables="/sbin/iptables-legacy"
if $iptables --list $CHAIN |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then if $iptables --list $CHAIN |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then
else $iptables -I $CHAIN -m state --state established,related -j ACCEPT; echo "nothing to do";
else $iptables -I $CHAIN -m state --state established,related -j ACCEPT;
fi fi
# #
# DELETE UNECESSARY LINES FROM PREVIOUS RULES # DELETE UNECESSARY LINES FROM PREVIOUS RULES
LINES=$($iptables --line-number -n --list $CHAIN | grep $SOURCE_IP |grep $TARGET_IP |grep $PROTOCOL |grep $TARGET_PORT | awk '{print $1}'| tac) LINES=$($iptables --line-number -n --list $CHAIN | grep $SOURCE_IP |grep $TARGET_IP |grep $PROTOCOL |grep $TARGET_PORT | awk '{print $1}'| tac)
if [ -n "$LINES" ] ; then if [ -n "$LINES" ] ; then
for i in $LINES; do for i in $LINES; do
$iptables -D $CHAIN $i $iptables -D $CHAIN $i
sleep 0.1 sleep 0.1
done done
fi fi
$iptables -I $CHAIN -s $SOURCE_IP -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT $iptables -I $CHAIN -s $SOURCE_IP -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT
############################# #############################
fi fi
done
done done # target_port
done done # target_ip
done done # source_ip