firewall_containers/firewall/firewall-add

#!/bin/sh

# Debugging function
debug() {
        if [ $DEBUG -eq 1 ]; then
                echo "DEBUG: "$1 $2 $3
        fi; 
}

# Task type variables
ROUTE=$ROUTE
HOST=$HOST
PREROUTING=$PREROUTING
POSTROUTING=$POSTROUTING

# Mandatory task variables
CHAIN=$CHAIN
NAME=$NAME
COMMENT=$COMMENT
NAME=$NAME-$COMMENT
PROTOCOL=$TYPE

EXTRA_OPTIONS="$2 $3 $4"
      
      # turn on debug mode by extra option "debug"
      if [[ "$(echo "$EXTRA_OPTIONS" | grep debug)" != "" ]] ; then
              DEBUG=1
      fi;


if [[ -z "$TYPE" ]]; then
	TYPE="tcp"
fi;
if [[ -z "$SOURCE_IP" ]]; then
	SOURCE_IP="0.0.0.0/0"
fi;
if [[ -z "$TARGET_IP" ]]; then
	TARGET_IP="0.0.0.0/0"
fi;

##############################

echo 1 > /proc/sys/net/ipv4/ip_forward

##############################

IPTABLES=/sbin/iptables-legacy

###############################

prerouting() {
	LINES=$($IPTABLES --line-number -n | grep $COMMENT | grep PREROUTING |awk '{print $1}'| tac)

	# DELETE UNECESSARY LINES FROM PREVIOUS RULES
	if [ -n "$LINES" ] ; then
		for i in $LINES; do 
			debug "$IPTABLES -D $i"
			$IPTABLES -D $i
			sleep 0.1
		done
	fi

	debug "$IPTABLES -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT"
	$IPTABLES -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT
}

postrouting() {
	LINES=$($IPTABLES --line-number -n | grep $COMMENT | grep POSTROUTING | awk '{print $1}'| tac)

	# DELETE UNECESSARY LINES FROM PREVIOUS RULES
	if [ -n "$LINES" ] ; then
		for i in $LINES; do 
			debug "$IPTABLES -D $i"
			$IPTABLES -D $i
			sleep 0.1
		done
	fi

	debug "$IPTABLES -I POSTROUTING -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE"	
	$IPTABLES -I POSTROUTING -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE	
}

ip_route() {

	COUNT_NETWORK=$(set |grep NETWORK |wc -l)
	
	for network_index in $(seq 1 $COUNT_NETWORK) ; do
		if set |grep NETWORK_ ; then
			NETWORK=$(eval "echo \${"NETWORK_$network_index"}")
			GATEWAY=$(eval "echo \${"GATEWAY_$network_index"}")
		fi
		debug "ip route add "$NETWORK"/24 via "$GATEWAY
		$IP_ROUTE add $NETWORK/24 via $GATEWAY
	done
}

COUNT_SOURCE_IP=$(set |grep SOURCE_IP |wc -l)
COUNT_SOURCE_PORT=$(set |grep SOURCE_PORT |wc -l)
COUNT_TARGET_IP=$(set |grep TARGET_IP |wc -l)
COUNT_TARGET_PORT=$(set |grep TARGET_PORT |wc -l)

if [ "$COUNT_SOURCE_IP" == 0 ] ; then COUNT_SOURCE_IP=1 ; fi
for source_ip_index in $(seq 1 $COUNT_SOURCE_IP) ; do
	if set |grep SOURCE_IP_ ; then
		SOURCE_IP=$(eval "echo \${"SOURCE_IP_$source_ip_index"}")
	fi
	
	if [ "$COUNT_SOURCE_PORT" == 0 ] ; then COUNT_SOURCE_PORT=1 ; fi
	for source_port_index in $(seq 1 $COUNT_SOURCE_PORT) ; do
		if set |grep SOURCE_PORT_ ; then
			SOURCE_PORT=$(eval "echo \${"SOURCE_PORT_$source_port_index"}")
		fi
	
		if [ "$COUNT_TARGET_IP" == 0 ] ; then COUNT_TARGET_IP=1 ; fi
		for target_ip_index in $(seq 1 $COUNT_TARGET_IP) ; do
			if set |grep TARGET_IP_ ; then
				TARGET_IP=$(eval "echo \${"TARGET_IP_$target_ip_index"}")                 
			fi                                                                               
	
			if [ "$COUNT_TARGET_PORT" == 0 ] ; then COUNT_TARGET_PORT=1 ; fi
			for target_port_index in $(seq 1 $COUNT_TARGET_PORT) ; do
				if set |grep TARGET_PORT_ ; then
					TARGET_PORT=$(eval "echo \${"TARGET_PORT_$target_port_index"}")
				fi

#############################
# NSENTER Specific settings #

if [[ "$PREROUTING" == "true" ]] || [[ "$POSTROUTING" == "true" ]] || [[ "$HOST" == "true" ]] ; then
	
	if [ "$HOST" == "true" ] ; then
		IPTABLES="/sbin/iptables -t nat";
	else
		IPTABLES="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- $IPTABLES -t nat";
	fi
	
	debug "iptables: "$IPTABLES;
	
	if [[ "$PREROUTING" == "true" ]] ; then
		prerouting;

	elif [[ "$POSTROUTING" == "true" ]] ; then
		postrouting;
	
	fi;

else 

############################
# Host firewall settings ###

	if $IPTABLES --list $CHAIN |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then 
		echo "nothing to do";
	else
		$IPTABLES -I $CHAIN -m state --state established,related -j ACCEPT;
	fi

	# 
	# DELETE UNECESSARY LINES FROM PREVIOUS RULES
	LINES=$($IPTABLES --line-number -n --list $CHAIN | grep $SOURCE_IP |grep $TARGET_IP |grep $PROTOCOL |grep $TARGET_PORT | awk '{print $1}'| tac)

	if [ -n "$LINES" ] ; then
		for i in $LINES; do 
			debug "$IPTABLES -D $CHAIN $i"
			$IPTABLES -D $CHAIN $i
			sleep 0.1
		done
	fi

	debug "$IPTABLES -I $CHAIN -p $PROTOCOL -s $SOURCE_IP --sport $SOURCE_PORT -d $TARGET_IP --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT"
	$IPTABLES -I $CHAIN -p $PROTOCOL -s $SOURCE_IP --sport $SOURCE_PORT -d $TARGET_IP --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT

	#############################
fi

			done # target_port
		done # target_ip
	done # source_port
done # source_ip


if [[ "$ROUTE" == "true" ]] ; then
	IP_ROUTE="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- ip route";

	debug "ip_route: "$IP_ROUTE;
	ip_route;
fi