source: trunk/Modules/NetworkConfigRouterOS/Generators/FirewallNAT.php

Last change on this file was 929, checked in by chronos, 3 years ago
  • Modified: Removed commended out print_r and echo commands used only for debugging.
File size: 9.5 KB
Line 
1<?php
2
3class ConfigRouterOSFirewallNAT extends NetworkConfigItem
4{
5 function Run(): void
6 {
7 $Path = array('ip', 'firewall', 'nat');
8
9 $Routerboard = new Routerboard($this->System->Config['MainRouter']['HostName']);
10 $Routerboard->UserName = $this->System->Config['MainRouter']['UserName'];
11 $Routerboard->Timeout = $this->System->Config['MainRouter']['ConnectTimeout'];
12 $Routerboard->Debug = true;
13
14 $InetInterface = $this->System->Config['MainRouter']['InetInterface'];
15 $LocalInterface = $this->System->Config['MainRouter']['LocalInterface'];
16 $IPCentrala = '10.145.64.8';
17
18 $Items = array();
19
20 /*
21 // NTP redirect
22 $Items[] = array('chain' => 'srcnat', 'src-address' => '10.145.66.1', 'protocol' => 'udp', 'src-port' => 123, 'action' => 'src-nat', 'to-addresses' => '10.145.64.1', 'comment' => 'NTP_redirect_4');
23 $Items[] = array('chain' => 'srcnat', 'src-address' => '10.145.66.161', 'protocol' => 'udp', 'src-port' => 123, 'action' => 'src-nat', 'to-addresses' => '10.145.64.1', 'comment' => 'NTP_redirect_5');
24 $Items[] = array('chain' => 'srcnat', 'src-address' => '10.145.66.193', 'protocol' => 'udp', 'src-port' => 123, 'action' => 'src-nat', 'to-addresses' => '10.145.64.1', 'comment' => 'NTP_redirect_1');
25 $Items[] = array('chain' => 'srcnat', 'src-address' => '10.145.66.225', 'protocol' => 'udp', 'src-port' => 123, 'action' => 'src-nat', 'to-addresses' => '10.145.64.1', 'comment' => 'NTP_redirect_2');
26 $Items[] = array('chain' => 'srcnat', 'src-address' => '10.145.66.250', 'protocol' => 'udp', 'src-port' => 123, 'action' => 'src-nat', 'to-addresses' => '10.145.64.1', 'comment' => 'NTP_redirect_3');
27 $Items[] = array('chain' => 'srcnat', 'src-address' => '10.145.66.253', 'protocol' => 'udp', 'src-port' => 123, 'action' => 'src-nat', 'to-addresses' => '10.145.64.1', 'comment' => 'NTP_redirect_6');
28 */
29
30 // Chain for inet interface
31 $Items[] = array('chain' => 'srcnat', 'out-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-out', 'comment' => 'inet-out');
32 $Items[] = array('chain' => 'dstnat', 'in-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-in', 'comment' => 'inet-in');
33
34 // Skip local subnet
35 //$Items[] = array('chain' => 'inet-out', 'dst-address' => '172.16.1.1/30', 'action' => 'accept', 'comment' => 'Local_subnet');
36 //$Items[] = array('chain' => 'inet-in', 'dst-address' => '172.16.1.1/30', 'action' => 'accept', 'comment' => 'Local_subnet');
37
38 $DbResult = $this->Database->query('SELECT `Member`.*, `Subject`.`Name` FROM `Member` '.
39 'LEFT JOIN `Subject` ON `Subject`.`Id` = `Member`.`Subject` '.
40 'WHERE `Member`.`Blocked` = 0');
41 while ($Member = $DbResult->fetch_assoc())
42 {
43 echo($Member['Name'].': ');
44 // Hosts
45 $DbResult2 = $this->Database->query('SELECT `NetworkInterface`.*, `NetworkDevice`.`Name` AS `DeviceName`, `NetworkDevice`.`InboundNATPriority` FROM `NetworkInterface`'.
46 ' LEFT JOIN `NetworkDevice` ON `NetworkDevice`.`Id` = `NetworkInterface`.`Device` WHERE (`NetworkInterface`.`ExternalIP` <> "")'.
47 ' AND (`NetworkInterface`.`LocalIP` <> "")'.
48 ' AND (`NetworkDevice`.`Member` = '.$Member['Id'].') AND (`NetworkInterface`.`LocalIP` != `NetworkInterface`.`ExternalIP`) ORDER BY `id` DESC');
49 while ($Interface = $DbResult2->fetch_assoc())
50 {
51 $Name = $Interface['DeviceName'];
52 if ($Interface['Name'] != '') $Name .= '-'.$Interface['Name'];
53 $Name = RouterOSIdent($Name);
54 echo($Name.'('.$Interface['LocalIP'].'), ');
55 if ($Member['Blocked'] == 0)
56 {
57 $Items[] = array('chain' => 'inet-out', 'src-address' => $Interface['LocalIP'], 'action' => 'src-nat', 'to-addresses' => $Interface['ExternalIP'], 'comment' => $Name.'-out');
58 if ($Interface['InboundNATPriority'] > 0)
59 $Items[] = array('chain' => 'inet-in', 'dst-address' => $Interface['ExternalIP'], 'action' => 'dst-nat', 'to-addresses' => $Interface['LocalIP'], 'comment' => $Name.'-in');
60 } else
61 {
62 $Items[] = array('chain' => 'dstnat', 'src-address' => $Interface['LocalIP'], 'protocol' => 'tcp', 'dst-port' => 80, 'action' => 'dst-nat', 'to-addresses' => $IPCentrala, 'to-ports' => 81, 'comment' => $Name.'-out');
63 }
64 }
65
66 // Subnets
67 $DbResult2 = $this->Database->select('NetworkSubnet', '*', '`Member`='.$Member['Id']);
68 while ($Subnet = $DbResult2->fetch_assoc())
69 {
70 $Subnet['Name'] = RouterOSIdent('subnet-'.$Subnet['Name']);
71 echo($Subnet['Name'].'('.$Subnet['AddressRange'].'/'.$Subnet['Mask'].'), ');
72 if ($Member['Blocked'] == 0)
73 {
74 $NewAddress = new NetworkAddressIPv4();
75 $NewAddress->AddressFromString($Subnet['ExtAddressRange']);
76 $NewAddress->Prefix = $Subnet['ExtMask'];
77 $Range = $NewAddress->GetRange();
78 if ($Subnet['ExtMask'] != 32) $Range = $Range['From']->AddressToString().'-'.$Range['To']->AddressToString();
79 else $Range = $Range['From']->AddressToString();
80 if ($Subnet['Mask'] == 32) $Src = $Subnet['AddressRange'];
81 else $Src = $Subnet['AddressRange'].'/'.$Subnet['Mask'];
82 $Items[] = array('chain' => 'inet-out', 'src-address' => $Src, 'action' => 'src-nat', 'to-addresses' => $Range, 'comment' => $Subnet['Name'].'-out');
83
84 $NewAddress = new NetworkAddressIPv4();
85 $NewAddress->AddressFromString($Subnet['AddressRange']);
86 $NewAddress->Prefix = $Subnet['Mask'];
87 $Range = $NewAddress->GetRange();
88 if ($Subnet['Mask'] != 32) $Range = $Range['From']->AddressToString().'-'.$Range['To']->AddressToString();
89 else $Range = $Range['From']->AddressToString();
90 if ($Subnet['ExtMask'] == 32) $Dest = $Subnet['ExtAddressRange'];
91 else $Dest = $Subnet['ExtAddressRange'].'/'.$Subnet['ExtMask'];
92 $Items[] = array('chain' => 'inet-in', 'dst-address' => $Dest, 'action' => 'dst-nat', 'to-addresses' => $Range, 'comment' => $Subnet['Name'].'-in');
93 } else
94 {
95 if ($Subnet['Mask'] == 32) $Src = $Subnet['AddressRange'];
96 else $Src = $Subnet['AddressRange'].'/'.$Subnet['Mask'];
97 $Items[] = array('chain' => 'dstnat', 'src-address' => $Src, 'protocol' => 'tcp', 'dst-port' => 80, 'action' => 'dst-nat', 'to-addresses' => $IPCentrala, 'to-ports' => 81, 'comment' => $Subnet['Name'].'-out');
98 }
99 }
100 echo("\n");
101 }
102
103 // Redirect DNS port
104 $Items[] = array('chain' => 'dstnat', 'dst-address' => '212.111.4.174', 'protocol' => 'tcp', 'dst-port' => 53, 'in-interface' => $InetInterface, 'action' => 'dst-nat', 'to-addresses' => '10.145.64.8', 'to-ports' => 53, 'comment' => 'DNS_redirection_TCP');
105 $Items[] = array('chain' => 'dstnat', 'dst-address' => '212.111.4.174', 'protocol' => 'udp', 'dst-port' => 53, 'in-interface' => $InetInterface, 'action' => 'dst-nat', 'to-addresses' => '10.145.64.8', 'to-ports' => 53, 'comment' => 'DNS_redirection_UDP');
106
107 // Chain for local interface
108 $Items[] = array('chain' => 'srcnat', 'out-interface' => $LocalInterface, 'action' => 'jump', 'jump-target' => 'local-out', 'comment' => 'local-out');
109 $Items[] = array('chain' => 'dstnat', 'in-interface' => $LocalInterface, 'action' => 'jump', 'jump-target' => 'local-in', 'comment' => 'local-in');
110
111 // Accept free-access clients
112 //$Items[] = array('chain' => 'dstnat', 'dst-address' => '!10.145.0.0/16',
113 // 'src-address-list' => 'free-access', 'in-interface' => $LocalInterface,
114 // 'action' => 'accept', 'comment' => 'Free_access');
115 // Redirect unregistred clients to free access activation page
116 //$Items[] = array('chain' => 'dstnat', 'dst-address' => '!10.145.0.0/16',
117 // 'src-address-list' => 'unregistred', 'in-interface' => $LocalInterface, 'protocol' => 'tcp',
118 // 'action' => 'dst-nat', 'to-addresses' => '10.145.64.70', 'to-ports' => 8080, 'comment' => 'Redirect_unregistred');
119
120 // Masquerade hosts without public ip
121 $Items[] = array('chain' => 'inet-out', 'src-address'=> '!212.111.4.174', 'action' => 'src-nat', 'to-addresses' => '77.92.221.188', 'comment' => 'Default_NAT');
122
123 // Translate own public IP addresses into local IP address for local network
124 $DbResult2 = $this->Database->query('SELECT `NetworkInterface`.*, `NetworkDevice`.`Name` AS `DeviceName`, `NetworkDevice`.`InboundNATPriority` FROM `NetworkInterface`'.
125 ' LEFT JOIN `NetworkDevice` ON `NetworkDevice`.`Id` = `NetworkInterface`.`Device`'.
126 ' WHERE (`NetworkInterface`.`ExternalIP` <> "") AND (`NetworkInterface`.`LocalIP` <> "") AND (`NetworkInterface`.`Enabled` = 1)'.
127 ' AND (`NetworkInterface`.`LocalIP` != `NetworkInterface`.`ExternalIP`) ORDER BY `id` DESC');
128 while ($Interface = $DbResult2->fetch_assoc())
129 {
130 $Name = $Interface['DeviceName'];
131 if ($Interface['Name'] != '') $Name .= '-'.$Interface['Name'];
132 $Name = RouterOSIdent($Name);
133 $Items[] = array('chain' => 'local-in', 'dst-address' => $Interface['ExternalIP'], 'action' => 'dst-nat', 'to-addresses' => $Interface['LocalIP'], 'comment' => $Name.'-ext');
134 }
135
136 /*
137 // Map returned local traffic to virtual subnet
138 $Items[] = array('chain' => 'local-out', 'src-address' => '10.145.0.0/16', 'dst-address' => '10.145.0.0/16', 'action' => 'netmap', 'to-addresses' => '10.45.0.0-10.45.255.255', 'comment' => 'map-local');
139 */
140
141 $Routerboard->ListUpdate($Path, array('chain', 'dst-address', 'in-interface', 'src-address', 'out-interface', 'to-ports', 'dst-port', 'protocol', 'action', 'to-addresses', 'comment', 'jump-target', 'src-port'), $Items);
142 }
143}
Note: See TracBrowser for help on using the repository browser.