Allow a redirect like:
config redirect
option src 'wan'
option dest 'lan'
option src_dport '22001'
option dest_port '22'
option proto 'tcp'
note the absence of the "dest_ip" field, meaning to terminate the connection on
the firewall itself.
This patch makes three changes:
(1) moves the conntrack module into the conntrack package (but not any of the
conntrack_* helpers).
(2) fixes a bug where the wrong table is used when the "dest_ip" field is
absent.
(3) accepts incoming connections on the destination port on the input_ZONE
table, but only for DNATted
connections.
In the above example,
ssh -p 22 root@myrouter
would fail from the outside, but:
ssh -p 22001 root@myrouter
would succeed. This is handy if:
(1) you want to avoid ssh probes on your router, or
(2) you want to redirect incoming connections on port 22 to some machine inside
your firewall, but
still want to allow firewall access from outside.
Signed-off-by: Philip Prindeville <[email protected]>
Index: include/netfilter.mk
===================================================================
--- include/netfilter.mk (revision 26567)
+++ include/netfilter.mk (working copy)
@@ -60,6 +60,8 @@
$(eval $(call nf_add,IPT_CONNTRACK,CONFIG_IP_NF_RAW, $(P_V4)iptable_raw))
$(eval $(call nf_add,IPT_CONNTRACK,CONFIG_IP_NF_TARGET_NOTRACK,
$(P_V4)ipt_NOTRACK))
$(eval $(call nf_add,IPT_CONNTRACK,CONFIG_NETFILTER_XT_TARGET_NOTRACK,
$(P_XT)xt_NOTRACK))
+$(eval $(call nf_add,IPT_CONNTRACK,CONFIG_IP_NF_MATCH_CONNTRACK,
$(P_V4)ipt_conntrack))
+$(eval $(call nf_add,IPT_CONNTRACK,CONFIG_NETFILTER_XT_MATCH_CONNTRACK,
$(P_XT)xt_conntrack))
# conntrack-extra
@@ -68,8 +70,6 @@
$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_MATCH_CONNBYTES,
$(P_XT)xt_connbytes))
$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_IP_NF_MATCH_CONNMARK,
$(P_V4)ipt_connmark))
$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_MATCH_CONNMARK,
$(P_XT)xt_connmark))
-$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_IP_NF_MATCH_CONNTRACK,
$(P_V4)ipt_conntrack))
-$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_MATCH_CONNTRACK,
$(P_XT)xt_conntrack))
$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_IP_NF_MATCH_HELPER,
$(P_V4)ipt_helper))
$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_NETFILTER_XT_MATCH_HELPER,
$(P_XT)xt_helper))
$(eval $(call nf_add,IPT_CONNTRACK_EXTRA,CONFIG_IP_NF_MATCH_RECENT,
$(P_V4)ipt_recent))
Index: package/kernel/modules/netfilter.mk
===================================================================
--- package/kernel/modules/netfilter.mk (revision 26567)
+++ package/kernel/modules/netfilter.mk (working copy)
@@ -76,7 +76,7 @@
Includes:
- connbytes
- connmark/CONNMARK
- - conntrack
+ - conntrack_*
- helper
- recent
endef
Index: package/firewall/files/lib/core_redirect.sh
===================================================================
--- package/firewall/files/lib/core_redirect.sh (revision 26556)
+++ package/firewall/files/lib/core_redirect.sh (working copy)
@@ -34,7 +34,7 @@
return 0
}
- fwdchain="zone_${redirect_src}_forward"
+ fwdchain="zone_${redirect_src}${redirect_dest_ip:+_forward}"
natopt="--to-destination"
natchain="zone_${redirect_src}_prerouting"
@@ -100,9 +100,8 @@
$natopt $nataddr${natports:+:$natports} \
}
- [ -n "$destaddr" ] && \
fw add $mode f ${fwdchain:-forward} ACCEPT ^ { $redirect_src_ip
$redirect_dest_ip } { \
- $srcaddr $destaddr \
+ $srcaddr ${destaddr:--m conntrack --ctstate DNAT} \
${redirect_proto:+-p $redirect_proto} \
${srcports:+--sport $srcports} \
${destports:+--dport $destports} \
_______________________________________________
openwrt-devel mailing list
[email protected]
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
