arno-iptables-firewall 2.0.1.f-1.1 / usr / share / arno-iptables-firewall / plugins / 90dmz-dnat.plugin

# ------------------------------------------------------------------------------
#            -= Arno's iptables firewall - DMZ-host default port forwarding plugin =-
#
PLUGIN_NAME="DMZ-host DNAT plugin"
PLUGIN_VERSION="0.07BETA (EXPERIMENTAL!)"
PLUGIN_CONF_FILE="dmz-dnat.conf"
#
# Last changed          : August 14, 2011
# Requirements          : kernel 2.6 and AIF 2.0.1+
# Comments              : This plugin allows forwarding of all traffic to a
#                         "DMZ" host.  It's only been tested with 1.9+.
#                         Updated to be IPv4-only
#                         Updated to support parse_rule()
#
# Author                : (C) Copyright 2010-2011 by Philip A. Prindeville
# Email                 : philipp AT redfish-solutions DOT com
#                         (note: you must remove all spaces and substitute the @ and the .
#                         at the proper locations!)
# ------------------------------------------------------------------------------
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# version 2 as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
# ------------------------------------------------------------------------------

# Plugin start function
plugin_start()
{
  # Forward all traffic that doesn't match an explicit port-forward to the
  # DMZ host.
  ip4tables -t nat -N NAT_PREROUTING_LOCAL 2>/dev/null
  ip4tables -t nat -F NAT_PREROUTING_LOCAL

  ip4tables -t nat -A POST_NAT_PREROUTING_CHAIN -j NAT_PREROUTING_LOCAL

  # bail if ICMP...
  IFS=' ,'
  for eif in $EXT_IF; do
    ip4tables -t nat -A NAT_PREROUTING_LOCAL -i $eif -p icmp -j RETURN
  done

  local open_tcp="" open_udp="" open_ip=""

  unset IFS
  for rule in $OPEN_TCP; do
    open_tcp="$open_tcp $ANYHOST$SEP$rule"
  done

  # intercept HOST_OPEN_TCP and HOST_OPEN_UDP (sigh... duplicate code...)
  unset IFS
  for rule in $HOST_OPEN_TCP $open_tcp; do
    if parse_rule "$rule" HOST_OPEN_TCP "interfaces-destips-hosts-ports"; then

      IFS=','
      for host in `ip_range "$hosts"`; do
        for port in $ports; do
          for destip in $destips; do
            for interface in $interfaces; do
              ip4tables -t nat -A NAT_PREROUTING_LOCAL -i $interface -s $host -d $destip -p tcp --dport $port -j RETURN
            done
          done
        done
      done
    fi
  done

  unset IFS
  for rule in $OPEN_UDP; do
    open_udp="$open_udp $ANYHOST$SEP$rule"
  done

  for rule in $HOST_OPEN_UDP $open_udp; do
    if parse_rule "$rule" HOST_OPEN_UDP "interfaces-destips-hosts-ports"; then

      IFS=','
      for host in `ip_range "$hosts"`; do
        for port in $ports; do
          for destip in $destips; do
            for interface in $interfaces; do
              ip4tables -t nat -A NAT_PREROUTING_LOCAL -i $interface -s $host -d $destip -p udp --dport $port -j RETURN
            done
          done
        done
      done
    fi
  done

  unset IFS
  for rule in $OPEN_IP; do
    open_ip="$open_ip $ANYHOST$SEP$rule"
  done

  for rule in $HOST_OPEN_IP $open_ip; do
    if parse_rule "$rule" HOST_OPEN_IP "interfaces-destips-hosts-protos"; then

      IFS=','
      for host in `ip_range "$hosts"`; do
        for proto in $protos; do
          for destip in $destips; do
            for interface in $interfaces; do
              ip4tables -t nat -A NAT_PREROUTING_LOCAL -i $interface -s $host -d $destip -p $proto -j RETURN
            done
          done
        done
      done
    fi
  done

  ## ICMP???

  echo "${INDENT}DMZ-DNAT: sending all non-local packets to $DMZ_IP"

  IFS=' ,'
  for eif in $EXT_IF; do
    ip4tables -t nat -A NAT_PREROUTING_LOCAL -i $eif -j DNAT --to-destination $DMZ_IP
    ip4tables -A POST_FORWARD_CHAIN -i $eif -d $DMZ_IP -j ACCEPT
  done

  return 0
}


# Plugin stop function
plugin_stop()
{
  ip4tables -t nat -D POST_NAT_PREROUTING_CHAIN -j NAT_PREROUTING_LOCAL

  ip4tables -t nat -F NAT_PREROUTING_LOCAL
  ip4tables -t nat -X NAT_PREROUTING_LOCAL 2>/dev/null

  IFS=' ,'
  for eif in $EXT_IF; do
    ip4tables -D POST_FORWARD_CHAIN -i $eif -d $DMZ_IP -j ACCEPT
  done

  return 0
}


# Plugin status function
plugin_status()
{
  return 0
}

# Check sanity of eg. environment
plugin_sanity_check()
{
  if [ -z "$DMZ_IP" ]; then
    printf "\033[40m\033[1;31m{$INDENT}ERROR: The plugin config file is not properly set!\033[0m\n" >&2
    return 1
  fi
  
  return 0
}


############
# Mainline #
############

# Check where to find the config file
CONF_FILE=""
if [ -n "$PLUGIN_CONF_PATH" ]; then
  CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE"
fi

# Preinit to success:
PLUGIN_RET_VAL=0

# Check if the config file exists
if [ ! -e "$CONF_FILE" ]; then
  printf "NOTE: Config file \"$CONF_FILE\" not found!\n        Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2
else
  # Source the plugin config file
  . "$CONF_FILE"

  if [ "$ENABLED" = "1" ] ||
     [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "stop" ] ||
     [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "status" ]; then
    # Show who we are:
    echo "${INDENT}$PLUGIN_NAME v$PLUGIN_VERSION"

    # Increment indention
    INDENT="$INDENT "

    # Only proceed if environment ok
    if ! plugin_sanity_check; then
      PLUGIN_RET_VAL=1
    else
      case $PLUGIN_CMD in
        start|'') plugin_start; PLUGIN_RET_VAL=$? ;;
        stop    ) plugin_stop; PLUGIN_RET_VAL=$? ;;
        status  ) plugin_status; PLUGIN_RET_VAL=$? ;;
        *       ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;;
      esac
    fi
  fi
fi