external/iiab
1
0
Fork 0
mirror of https://github.com/iiab/iiab.git synced 2025-02-13 19:52:06 +00:00
Code Issues Releases Wiki Activity

Apply @jvonau's "$lan" != "none" to fwd'ing (not just masq'ing)

Browse source
This commit is contained in:
A Holt 2019-05-23 23:42:55 -04:00 committed by GitHub
parent 7012946f1b
commit a68ae48b4e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
roles/network/templates/gateway/iiab-gen-iptables
View file

@ -163,8 +163,9 @@ if [ "$wan" != "none" ]; then
$IPTABLES -A INPUT -p tcp -m multiport --dports $samba_tcp_mports -m state --state NEW -i $wan -j ACCEPT $IPTABLES -A INPUT -p tcp -m multiport --dports $samba_tcp_mports -m state --state NEW -i $wan -j ACCEPT
fi fi
if [ "$lan" != "none" ]; then
# Typically False, to keep client machines (e.g. students) off the Internet # Typically False, to keep client machines (e.g. students) off the Internet
if [ "$iiab_gateway_enabled" == "True" ] && [ "$lan" != "none" ]; then if [ "$iiab_gateway_enabled" == "True" ]; then
$IPTABLES -A POSTROUTING -t nat -o $wan -j MASQUERADE $IPTABLES -A POSTROUTING -t nat -o $wan -j MASQUERADE
fi fi
@ -180,13 +181,13 @@ if [ "$wan" != "none" ]; then
$IPTABLES -A FORWARD -i $wan -o $lan -j DROP $IPTABLES -A FORWARD -i $wan -o $lan -j DROP
# Enable routing (kernel IP forwarding) # Enable routing (kernel IP forwarding)
echo 1 > /proc/sys/net/ipv4/ip_forward echo 1 > /proc/sys/net/ipv4/ip_forward
fi
# 5 = "all but databases" # 5 = "all but databases"
if [ "$ports_externally_visible" -lt 5 ]; then if [ "$ports_externally_visible" -lt 5 ]; then
# Drop everything else arriving via WAN # Drop everything else arriving via WAN
$IPTABLES -A INPUT -i $wan -j DROP $IPTABLES -A INPUT -i $wan -j DROP
fi fi
fi fi
# TCP & UDP block of DNS port 53 if truly nec # TCP & UDP block of DNS port 53 if truly nec