add fake name resolution to robinson state, add /etc/firewall.use, use cloud config

1. When in robinson state the router now resolves all domain names to
   an IP in the robinson fake net (as defined in
   /etc/config/cloud). All tcp traffic to this network (and the rest
   of the internet) is redirected to a local webserver.
2. The ip addresses in robinson state are now generated in the ranges
   given in /etc/config/cloud

1 files changed, 21 insertions, 0 deletions

diff --git a/files/common/etc/firewall.user b/files/common/etc/firewall.user
new file mode 100755
index 0000000..2f5e3b0
--- /dev/null
+++ b/files/common/etc/firewall.user
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+
+# create chains for the robinson fake net (depending on the inetable
+# state, this is used to route all TCP traffic to a local web server
+# or relay all traffic to the intended target):
+# - prerouting_robinson_fake: traffic destinated to the fake net
+# - prerouting_robinson_inet: traffic destinated to anything outside
+#   the robinson net
+net_robinson=$(uci get cloud.cur.net_robinson)
+net_fake=$(    uci get cloud.cur.net_fake)
+iptables -t nat -N prerouting_robinson_inet
+iptables -t nat -N prerouting_robinson_fake
+iptables -t nat -I PREROUTING -i br-mesh ! -d $net_robinson \
+    -j prerouting_robinson_inet
+iptables -t nat -I PREROUTING -i br-mesh   -d $net_fake \
+    -j prerouting_robinson_fake
+
+# reject all packets to the robinson fake net that have not been
+# catched by a nat rule in the preceeding chains
+iptables -t filter -I forward -d $net_fake \
+    -j REJECT --reject-with icmp-net-unreachable