mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

MFC

Browse Source
This commit is contained in:
Scott Ullrich 2007-04-25 20:27:24 +00:00
parent 3f8b80656b
commit c8ccb72fb4
1 changed files with 50 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
etc/inc/filter.inc
View File

@ -684,15 +684,15 @@ function filter_nat_rules_generate() {
}
} else {
/* standard outbound rules (one for each interface) */
/* create ipsec passthru rule if requested */
if (isset($config['nat']['ipsecpassthru']['enable'])) {
$natrules .= filter_nat_rules_generate_if($wanif,
"{$lansa}/{$lancfg['subnet']}", 500, "", 500, null, 500, false);
}
update_filter_reload_status("Creating outbound NAT rules");
$natrules .= filter_nat_rules_generate_if($wanif, "{$lansa}/{$lancfg['subnet']}");
$natrules .= filter_nat_rules_generate_if($wanif,
"{$lansa}/{$lancfg['subnet']}", 500, "", 500, null, 500, false);
$natrules .= filter_nat_rules_generate_if($wanif,
"{$lansa}/{$lancfg['subnet']}", 5060, "", 5060, null, 5060, false);
$natrules .= filter_nat_rules_generate_if($wanif,
"{$lansa}/{$lancfg['subnet']}");
/* optional interfaces */
for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++) {
@ -706,23 +706,36 @@ function filter_nat_rules_generate() {
* interface if a gateway is defined
*/
if((interface_has_gateway("opt{$i}"))) {
$natrules .= filter_nat_rules_generate_if($optcfg['if'],
"{$lansa}/{$lancfg['subnet']}", 500, "", 500, null, 500, false);
$natrules .= filter_nat_rules_generate_if($optcfg['if'],
"{$lansa}/{$lancfg['subnet']}", 5060, "", 5060, null, 5060, false);
$natrules .= filter_nat_rules_generate_if($optcfg['if'],
"{$lansa}/{$lancfg['subnet']}", null, "", null, null, null, isset($optcfg['nonat']));
}
/* create outbound nat entries for primary wan */
$natrules .= filter_nat_rules_generate_if($wanif,
"{$optsa}/{$optcfg['subnet']}", 500, "", 500, null, 500, false);
$natrules .= filter_nat_rules_generate_if($wanif,
"{$optsa}/{$optcfg['subnet']}", 5060, "", 5060, null, 5060, false);
$natrules .= filter_nat_rules_generate_if($wanif,
"{$optsa}/{$optcfg['subnet']}", null, "", null, null, null, isset($optcfg['nonat']));
/* create outbound nat entries for all opt wans */
$optints = array();
generate_optcfg_array($optints);
foreach($optints as $oc) {
$opt_interface = $oc['if'];
if (interface_has_gateway("opt{$i}")) {
$natrules .= filter_nat_rules_generate_if($opt_interface,
"{$optsa}/{$optcfg['subnet']}", 500, "", 500, null, 500, false);
$natrules .= filter_nat_rules_generate_if($opt_interface,
"{$optsa}/{$optcfg['subnet']}", 5060, "", 5060, null, 5060, false);
$natrules .= filter_nat_rules_generate_if($opt_interface,
"{$optsa}/{$optcfg['subnet']}", null, "", null, null, null, isset($optcfg['nonat']));
}
}
/* create outbound nat entries for primary wan */
$natrules .= filter_nat_rules_generate_if($wanif,
"{$optsa}/{$optcfg['subnet']}", null, "", null, null, null, isset($optcfg['nonat']));
}
}
@ -731,6 +744,10 @@ function filter_nat_rules_generate() {
$pptp_subnet = $g['pptp_subnet'];
if($config['pptp']['pptp_subnet'] <> "")
$pptp_subnet = $config['pptp']['pptp_subnet'];
$natrules .= filter_nat_rules_generate_if($wanif,
"{$pptpdcfg['remoteip']}/{$pptp_subnet}", 500, "", 500, null, 500, false);
$natrules .= filter_nat_rules_generate_if($wanif,
"{$pptpdcfg['remoteip']}/{$pptp_subnet}", 5060, "", 5060, null, 5060, false);
$natrules .= filter_nat_rules_generate_if($wanif,
"{$pptpdcfg['remoteip']}/{$pptp_subnet}");
@ -738,6 +755,10 @@ function filter_nat_rules_generate() {
foreach($optints as $oc) {
$opt_interface = $oc['if'];
if ((is_private_ip($pptpdcfg['remoteip'])) && (interface_has_gateway($opt_interface))) {
$natrules .= filter_nat_rules_generate_if($opt_interface,
"{$pptpdcfg['remoteip']}/{$pptp_subnet}", 500, "", 500, null, 500, false);
$natrules .= filter_nat_rules_generate_if($opt_interface,
"{$pptpdcfg['remoteip']}/{$pptp_subnet}", 5060, "", 5060, null, 5060, false);
$natrules .= filter_nat_rules_generate_if($opt_interface,
"{$pptpdcfg['remoteip']}/{$pptp_subnet}");
}
@ -749,6 +770,10 @@ function filter_nat_rules_generate() {
$pppoe_subnet = $g['pppoe_subnet'];
if($config['pppoe']['pppoe_subnet'] <> "")
$pppoe_subnet = $config['pppoe']['pppoe_subnet'];
$natrules .= filter_nat_rules_generate_if($wanif,
"{$pppoecfg['remoteip']}/{$pppoe_subnet}", 500, "", 500, null, 500, false);
$natrules .= filter_nat_rules_generate_if($wanif,
"{$pppoecfg['remoteip']}/{$pppoe_subnet}", 5060, "", 5060, null, 5060, false);
$natrules .= filter_nat_rules_generate_if($wanif,
"{$pppoecfg['remoteip']}/{$pppoe_subnet}");
@ -756,6 +781,10 @@ function filter_nat_rules_generate() {
foreach($optints as $oc) {
$opt_interface = $oc['if'];
if ((is_private_ip($pppoecfg['remoteip'])) && (interface_has_gateway($opt_interface))) {
$natrules .= filter_nat_rules_generate_if($opt_interface,
"{$pppoecfg['remoteip']}/{$pppoe_subnet}", 500, "", 500, null, 500, false);
$natrules .= filter_nat_rules_generate_if($opt_interface,
"{$pppoecfg['remoteip']}/{$pppoe_subnet}", 5060, "", 5060, null, 5060, false);
$natrules .= filter_nat_rules_generate_if($opt_interface,
"{$pppoecfg['remoteip']}/{$pppoe_subnet}");
}
@ -768,14 +797,22 @@ function filter_nat_rules_generate() {
$netip = explode("/", $route['network']);
if ((! interface_has_gateway($route['interface'])) && (is_private_ip($netip[0]))) {
$natrules .= filter_nat_rules_generate_if($wanif,
$route['network'], "", null);
"{$route['network']}", 500, "", 500, null, 500, false);
$natrules .= filter_nat_rules_generate_if($wanif,
"{$route['network']}", 5060, "", 5060, null, 5060, false);
$natrules .= filter_nat_rules_generate_if($wanif,
"{$route['network']}", "", null);
}
/* generate nat mapping for static routes on opts */
foreach($optints as $oc) {
$opt_interface = $oc['if'];
if ((! interface_has_gateway($route['interface'])) && (is_private_ip($netip[0])) && (interface_has_gateway($opt_interface))) {
$natrules .= filter_nat_rules_generate_if($opt_interface,
$route['network'], "", null);
"{$route['network']}", 500, "", 500, null, 500, false);
$natrules .= filter_nat_rules_generate_if($opt_interface,
"{$route['network']}", 5060, "", 5060, null, 5060, false);
$natrules .= filter_nat_rules_generate_if($opt_interface,
"{$route['network']}", "", null);
}
}
@ -784,7 +821,7 @@ function filter_nat_rules_generate() {
}
$natrules .= "#SSH Lockout Table\n";
$natrules .= "\n#SSH Lockout Table\n";
$natrules .= "table <sshlockout> persist\n\n";
/* is SPAMD insalled? */