From c8ccb72fb478013c5a7aebdb3be85648362d4ed0 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Wed, 25 Apr 2007 20:27:24 +0000 Subject: [PATCH] MFC Merge 2nd pass NAT rule generation. Take ipsec and voip into account. --- etc/inc/filter.inc | 63 ++++++++++++++++++++++++++++++++++++---------- 1 file changed, 50 insertions(+), 13 deletions(-) diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc index 117463ad6a..115c4d4107 100644 --- a/etc/inc/filter.inc +++ b/etc/inc/filter.inc @@ -684,15 +684,15 @@ function filter_nat_rules_generate() { } } else { /* standard outbound rules (one for each interface) */ - /* create ipsec passthru rule if requested */ - if (isset($config['nat']['ipsecpassthru']['enable'])) { - $natrules .= filter_nat_rules_generate_if($wanif, - "{$lansa}/{$lancfg['subnet']}", 500, "", 500, null, 500, false); - } update_filter_reload_status("Creating outbound NAT rules"); - $natrules .= filter_nat_rules_generate_if($wanif, "{$lansa}/{$lancfg['subnet']}"); + $natrules .= filter_nat_rules_generate_if($wanif, + "{$lansa}/{$lancfg['subnet']}", 500, "", 500, null, 500, false); + $natrules .= filter_nat_rules_generate_if($wanif, + "{$lansa}/{$lancfg['subnet']}", 5060, "", 5060, null, 5060, false); + $natrules .= filter_nat_rules_generate_if($wanif, + "{$lansa}/{$lancfg['subnet']}"); /* optional interfaces */ for ($i = 1; isset($config['interfaces']['opt' . $i]); $i++) { @@ -706,23 +706,36 @@ function filter_nat_rules_generate() { * interface if a gateway is defined */ if((interface_has_gateway("opt{$i}"))) { + $natrules .= filter_nat_rules_generate_if($optcfg['if'], + "{$lansa}/{$lancfg['subnet']}", 500, "", 500, null, 500, false); + $natrules .= filter_nat_rules_generate_if($optcfg['if'], + "{$lansa}/{$lancfg['subnet']}", 5060, "", 5060, null, 5060, false); $natrules .= filter_nat_rules_generate_if($optcfg['if'], "{$lansa}/{$lancfg['subnet']}", null, "", null, null, null, isset($optcfg['nonat'])); } + + /* create outbound nat entries for primary wan */ + $natrules .= filter_nat_rules_generate_if($wanif, + "{$optsa}/{$optcfg['subnet']}", 500, "", 500, null, 500, false); + $natrules .= filter_nat_rules_generate_if($wanif, + "{$optsa}/{$optcfg['subnet']}", 5060, "", 5060, null, 5060, false); + $natrules .= filter_nat_rules_generate_if($wanif, + "{$optsa}/{$optcfg['subnet']}", null, "", null, null, null, isset($optcfg['nonat'])); + /* create outbound nat entries for all opt wans */ $optints = array(); generate_optcfg_array($optints); foreach($optints as $oc) { $opt_interface = $oc['if']; if (interface_has_gateway("opt{$i}")) { + $natrules .= filter_nat_rules_generate_if($opt_interface, + "{$optsa}/{$optcfg['subnet']}", 500, "", 500, null, 500, false); + $natrules .= filter_nat_rules_generate_if($opt_interface, + "{$optsa}/{$optcfg['subnet']}", 5060, "", 5060, null, 5060, false); $natrules .= filter_nat_rules_generate_if($opt_interface, "{$optsa}/{$optcfg['subnet']}", null, "", null, null, null, isset($optcfg['nonat'])); } } - - /* create outbound nat entries for primary wan */ - $natrules .= filter_nat_rules_generate_if($wanif, - "{$optsa}/{$optcfg['subnet']}", null, "", null, null, null, isset($optcfg['nonat'])); } } @@ -731,6 +744,10 @@ function filter_nat_rules_generate() { $pptp_subnet = $g['pptp_subnet']; if($config['pptp']['pptp_subnet'] <> "") $pptp_subnet = $config['pptp']['pptp_subnet']; + $natrules .= filter_nat_rules_generate_if($wanif, + "{$pptpdcfg['remoteip']}/{$pptp_subnet}", 500, "", 500, null, 500, false); + $natrules .= filter_nat_rules_generate_if($wanif, + "{$pptpdcfg['remoteip']}/{$pptp_subnet}", 5060, "", 5060, null, 5060, false); $natrules .= filter_nat_rules_generate_if($wanif, "{$pptpdcfg['remoteip']}/{$pptp_subnet}"); @@ -738,6 +755,10 @@ function filter_nat_rules_generate() { foreach($optints as $oc) { $opt_interface = $oc['if']; if ((is_private_ip($pptpdcfg['remoteip'])) && (interface_has_gateway($opt_interface))) { + $natrules .= filter_nat_rules_generate_if($opt_interface, + "{$pptpdcfg['remoteip']}/{$pptp_subnet}", 500, "", 500, null, 500, false); + $natrules .= filter_nat_rules_generate_if($opt_interface, + "{$pptpdcfg['remoteip']}/{$pptp_subnet}", 5060, "", 5060, null, 5060, false); $natrules .= filter_nat_rules_generate_if($opt_interface, "{$pptpdcfg['remoteip']}/{$pptp_subnet}"); } @@ -749,6 +770,10 @@ function filter_nat_rules_generate() { $pppoe_subnet = $g['pppoe_subnet']; if($config['pppoe']['pppoe_subnet'] <> "") $pppoe_subnet = $config['pppoe']['pppoe_subnet']; + $natrules .= filter_nat_rules_generate_if($wanif, + "{$pppoecfg['remoteip']}/{$pppoe_subnet}", 500, "", 500, null, 500, false); + $natrules .= filter_nat_rules_generate_if($wanif, + "{$pppoecfg['remoteip']}/{$pppoe_subnet}", 5060, "", 5060, null, 5060, false); $natrules .= filter_nat_rules_generate_if($wanif, "{$pppoecfg['remoteip']}/{$pppoe_subnet}"); @@ -756,6 +781,10 @@ function filter_nat_rules_generate() { foreach($optints as $oc) { $opt_interface = $oc['if']; if ((is_private_ip($pppoecfg['remoteip'])) && (interface_has_gateway($opt_interface))) { + $natrules .= filter_nat_rules_generate_if($opt_interface, + "{$pppoecfg['remoteip']}/{$pppoe_subnet}", 500, "", 500, null, 500, false); + $natrules .= filter_nat_rules_generate_if($opt_interface, + "{$pppoecfg['remoteip']}/{$pppoe_subnet}", 5060, "", 5060, null, 5060, false); $natrules .= filter_nat_rules_generate_if($opt_interface, "{$pppoecfg['remoteip']}/{$pppoe_subnet}"); } @@ -768,14 +797,22 @@ function filter_nat_rules_generate() { $netip = explode("/", $route['network']); if ((! interface_has_gateway($route['interface'])) && (is_private_ip($netip[0]))) { $natrules .= filter_nat_rules_generate_if($wanif, - $route['network'], "", null); + "{$route['network']}", 500, "", 500, null, 500, false); + $natrules .= filter_nat_rules_generate_if($wanif, + "{$route['network']}", 5060, "", 5060, null, 5060, false); + $natrules .= filter_nat_rules_generate_if($wanif, + "{$route['network']}", "", null); } /* generate nat mapping for static routes on opts */ foreach($optints as $oc) { $opt_interface = $oc['if']; if ((! interface_has_gateway($route['interface'])) && (is_private_ip($netip[0])) && (interface_has_gateway($opt_interface))) { $natrules .= filter_nat_rules_generate_if($opt_interface, - $route['network'], "", null); + "{$route['network']}", 500, "", 500, null, 500, false); + $natrules .= filter_nat_rules_generate_if($opt_interface, + "{$route['network']}", 5060, "", 5060, null, 5060, false); + $natrules .= filter_nat_rules_generate_if($opt_interface, + "{$route['network']}", "", null); } } @@ -784,7 +821,7 @@ function filter_nat_rules_generate() { } - $natrules .= "#SSH Lockout Table\n"; + $natrules .= "\n#SSH Lockout Table\n"; $natrules .= "table persist\n\n"; /* is SPAMD insalled? */