safebox/firewall_containers
7
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Changing postrouting IP variables for correct rule parameters

Browse Source
This commit is contained in:
Gyorgy Berenyi
2022-05-19 06:44:34 +00:00
parent b7ec1b9549
commit 1e1ddbb0f9
1 changed files with 18 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
firewall/firewall-add
View File

@@ -40,16 +40,6 @@ elif [[ "$(echo $SOURCE_IP | cut -d . -f4)" == "0" ]] ; then
debug "source ip is $SOURCE_IP" debug "source ip is $SOURCE_IP"
# Modifying source or target IP addresses if POSTROUTING rules needed to applied # Modifying source or target IP addresses if POSTROUTING rules needed to applied
elif [[ ! -z "$POSTROUTING" ]]; then
if [[ ! -z "$SOURCE_IP" ]]; then
SOURCE_IP="$(echo $SOURCE_IP | cut -d . -f1-3).0/24";
debug "source ip is $SOURCE_IP"
fi
if [[ ! -z "$TARGET_IP" ]]; then
TARGET_IP="$(echo $TARGET_IP | cut -d . -f1-3).0/24";
debug "target ip is $TARGET_IP"
fi
fi; fi;
if [[ -z "$TARGET_IP" ]]; then if [[ -z "$TARGET_IP" ]]; then
@@ -79,8 +69,19 @@ prerouting() {
postrouting() { postrouting() {
if [[ ! -z "$SOURCE_IP" ]]; then
SOURCE_IP_FOR_POSTROUTING="$(echo $SOURCE_IP | cut -d . -f1-3).0/24";
debug "source ip is $SOURCE_IP_FOR_POSTROUTING"
fi
if [[ ! -z "$TARGET_IP" ]]; then
TARGET_IP_FOR_POSTROUTING="$(echo $TARGET_IP | cut -d . -f1-3).0/24";
debug "target ip is $TARGET_IP_FOR_POSTROUTING"
fi
if [ -n "$SOURCE_IP" ] ; then if [ -n "$SOURCE_IP" ] ; then
LINES=$($IPTABLES -L --line-number -n | grep POSTROUTING | grep $COMMENT | grep $SOURCE_IP | grep $SOURCE_PORT | awk '{print $1}'| tac) LINES=$($IPTABLES -L --line-number -n | grep POSTROUTING | grep $COMMENT | grep $SOURCE_IP_FOR_POSTROUTING | grep $SOURCE_PORT | awk '{print $1}'| tac)
debug "Previous postrouting lines: "$LINES debug "Previous postrouting lines: "$LINES
# DELETE UNECESSARY LINES FROM PREVIOUS RULES # DELETE UNECESSARY LINES FROM PREVIOUS RULES
@@ -92,12 +93,13 @@ postrouting() {
done done
fi fi
debug "$IPTABLES -I POSTROUTING -s $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j MASQUERADE" debug "$IPTABLES -I POSTROUTING -s $SOURCE_IP_FOR_POSTROUTING -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j MASQUERADE"
$IPTABLES -I POSTROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j MASQUERADE $IPTABLES -I POSTROUTING -d $SOURCE_IP_FOR_POSTROUTING -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j MASQUERADE
fi fi
if [ -n "$TARGET_IP" ] ; then if [ -n "$TARGET_IP" ] ; then
LINES=$($IPTABLES -L --line-number -n | grep $COMMENT | grep $TARGET_IP | grep $TARGET_PORT | awk '{print $1}'| tac) LINES=$($IPTABLES -L --line-number -n | grep $COMMENT | grep $TARGET_IP_FOR_POSTROUTING | grep $TARGET_PORT | awk '{print $1}'| tac)
debug "Previous postrouting lines: "$LINES debug "Previous postrouting lines: "$LINES
# DELETE UNECESSARY LINES FROM PREVIOUS RULES # DELETE UNECESSARY LINES FROM PREVIOUS RULES
@@ -108,8 +110,8 @@ postrouting() {
sleep 0.1 sleep 0.1
done done
fi fi
debug "$IPTABLES -I POSTROUTING -s $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE" debug "$IPTABLES -I POSTROUTING -s $TARGET_IP_FOR_POSTROUTING -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE"
$IPTABLES -I POSTROUTING -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE $IPTABLES -I POSTROUTING -d $TARGET_IP_FOR_POSTROUTING -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE
fi fi
} }