firewall/ipt-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add options 'restrict_local_service_to_net' and 'restrict_local_net_to_net'

Browse Source
This commit is contained in:
Christoph
2017-07-15 14:10:06 +02:00
parent 350f2dc487
commit a3d0c9161a
4 changed files with 232 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
ip6t-firewall-server.conf.sample
View File

@@ -179,6 +179,58 @@ local_2_ip=""
local_2_ip=""
# -------------
# ---- Restrict local Servive to given (extern) IP-Address/Network
# -------------
# - restrict_local_service_to_net
# -
# - restrict_local_service_to_net="ext-netr,local-address,port,protocol"
# -
# - Note:
# - =====
# - - Only 'tcp' and 'udp' are allowed valuse for protocol.
# - - Traffic recieved on natted interfaces will be ommitted!
# -
# - Use this parameter to (only) give some extern netwoks access to special local
# - services.
# -
# - Example:
# - allow access from 2003:45:4612:3a00::/56 to tcp service at 2a01:30:0:13:211:84ff:feb7:7f9c on port 1036
# - allow access from 2a01:30:1fff:fd00:: to https service at 2a01:30:0:13:211:84ff:feb7:7f9c
# -
# - restrict_local_service_to_net="2003:45:4612:3a00::/56,2a01:30:0:13:211:84ff:feb7:7f9c,1036,tcp
# - 2a01:30:1fff:fd00::/64,2a01:30:0:13:211:84ff:feb7:7f9c,443,tcp"
# -
# - Blank separated list
# -
restrict_local_service_to_net=""
# -------------
# ---- Restrict local Network to given extern IP-Address/Network
# -------------
# - restrict_local_net_to_net
# -
# - restrict_local_net_to_net="<src-ext-net>,<dst-local-net> [<src-ext-net>,<dst-local-net>] [..]"
# -
# - All traffic from the given first network to the given second network is allowed
# -
# - Note:
# - =====
# - - Traffic recieved on natted interfaces will be ommitted!
# - - If you want allow both directions, you have to make two entries - one for evry directions.
# -
# - Example:
# - allow_ext_net_to_local_net="2003:45:4612:3a00::/56,2a01:30:0:13:211:84ff:feb7:7f9c/128
# - 2a01:30:1fff:fd00::/64,2a01:30:0:13:211:84ff:feb7:7f9c/128"
# -
# - Blank separated list
# -
restrict_local_net_to_net=""
# -------------
# --- Services local Network
# -------------
@@ -422,6 +474,22 @@ for _dev in $unprotected_ifs ; do
unprotected_if_arr+=("$_dev")
done
# ---
# - Restrict local Servive to given IP-Address/Network
# ---
declare -a restrict_local_service_to_net_arr
for _val in $restrict_local_service_to_net ; do
restrict_local_service_to_net_arr+=("$_val")
done
# ---
# - Restrict local Network to given IP-Address/Network
# ---
declare -a restrict_local_net_to_net_arr
for _val in $restrict_local_net_to_net ; do
restrict_local_net_to_net_arr+=("$_val")
done
# ---
# - Generally block ports
# ---