diff options
Diffstat (limited to 'files/common/etc/firewall.user')
| -rwxr-xr-x | files/common/etc/firewall.user | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/files/common/etc/firewall.user b/files/common/etc/firewall.user new file mode 100755 index 0000000..2f5e3b0 --- /dev/null +++ b/files/common/etc/firewall.user @@ -0,0 +1,21 @@ +#!/bin/sh -e + +# create chains for the robinson fake net (depending on the inetable +# state, this is used to route all TCP traffic to a local web server +# or relay all traffic to the intended target): +# - prerouting_robinson_fake: traffic destinated to the fake net +# - prerouting_robinson_inet: traffic destinated to anything outside +# the robinson net +net_robinson=$(uci get cloud.cur.net_robinson) +net_fake=$( uci get cloud.cur.net_fake) +iptables -t nat -N prerouting_robinson_inet +iptables -t nat -N prerouting_robinson_fake +iptables -t nat -I PREROUTING -i br-mesh ! -d $net_robinson \ + -j prerouting_robinson_inet +iptables -t nat -I PREROUTING -i br-mesh -d $net_fake \ + -j prerouting_robinson_fake + +# reject all packets to the robinson fake net that have not been +# catched by a nat rule in the preceeding chains +iptables -t filter -I forward -d $net_fake \ + -j REJECT --reject-with icmp-net-unreachable |