| 1 | <?php
|
|---|
| 2 |
|
|---|
| 3 | class ConfigRouterOSFirewallNAT extends NetworkConfigItem
|
|---|
| 4 | {
|
|---|
| 5 | function Run(): void
|
|---|
| 6 | {
|
|---|
| 7 | $Path = array('ip', 'firewall', 'nat');
|
|---|
| 8 |
|
|---|
| 9 | $Routerboard = new Routerboard($this->System->Config['MainRouter']['HostName']);
|
|---|
| 10 | $Routerboard->UserName = $this->System->Config['MainRouter']['UserName'];
|
|---|
| 11 | $Routerboard->Timeout = $this->System->Config['MainRouter']['ConnectTimeout'];
|
|---|
| 12 | $Routerboard->Debug = true;
|
|---|
| 13 |
|
|---|
| 14 | $InetInterface = $this->System->Config['MainRouter']['InetInterface'];
|
|---|
| 15 | $LocalInterface = $this->System->Config['MainRouter']['LocalInterface'];
|
|---|
| 16 | $IPCentrala = '10.145.64.8';
|
|---|
| 17 |
|
|---|
| 18 | $Items = array();
|
|---|
| 19 |
|
|---|
| 20 | /*
|
|---|
| 21 | // NTP redirect
|
|---|
| 22 | $Items[] = array('chain' => 'srcnat', 'src-address' => '10.145.66.1', 'protocol' => 'udp', 'src-port' => 123, 'action' => 'src-nat', 'to-addresses' => '10.145.64.1', 'comment' => 'NTP_redirect_4');
|
|---|
| 23 | $Items[] = array('chain' => 'srcnat', 'src-address' => '10.145.66.161', 'protocol' => 'udp', 'src-port' => 123, 'action' => 'src-nat', 'to-addresses' => '10.145.64.1', 'comment' => 'NTP_redirect_5');
|
|---|
| 24 | $Items[] = array('chain' => 'srcnat', 'src-address' => '10.145.66.193', 'protocol' => 'udp', 'src-port' => 123, 'action' => 'src-nat', 'to-addresses' => '10.145.64.1', 'comment' => 'NTP_redirect_1');
|
|---|
| 25 | $Items[] = array('chain' => 'srcnat', 'src-address' => '10.145.66.225', 'protocol' => 'udp', 'src-port' => 123, 'action' => 'src-nat', 'to-addresses' => '10.145.64.1', 'comment' => 'NTP_redirect_2');
|
|---|
| 26 | $Items[] = array('chain' => 'srcnat', 'src-address' => '10.145.66.250', 'protocol' => 'udp', 'src-port' => 123, 'action' => 'src-nat', 'to-addresses' => '10.145.64.1', 'comment' => 'NTP_redirect_3');
|
|---|
| 27 | $Items[] = array('chain' => 'srcnat', 'src-address' => '10.145.66.253', 'protocol' => 'udp', 'src-port' => 123, 'action' => 'src-nat', 'to-addresses' => '10.145.64.1', 'comment' => 'NTP_redirect_6');
|
|---|
| 28 | */
|
|---|
| 29 |
|
|---|
| 30 | // Chain for inet interface
|
|---|
| 31 | $Items[] = array('chain' => 'srcnat', 'out-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-out', 'comment' => 'inet-out');
|
|---|
| 32 | $Items[] = array('chain' => 'dstnat', 'in-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-in', 'comment' => 'inet-in');
|
|---|
| 33 |
|
|---|
| 34 | // Skip local subnet
|
|---|
| 35 | //$Items[] = array('chain' => 'inet-out', 'dst-address' => '172.16.1.1/30', 'action' => 'accept', 'comment' => 'Local_subnet');
|
|---|
| 36 | //$Items[] = array('chain' => 'inet-in', 'dst-address' => '172.16.1.1/30', 'action' => 'accept', 'comment' => 'Local_subnet');
|
|---|
| 37 |
|
|---|
| 38 | // Redirect ping from warp to inext test network
|
|---|
| 39 | $Items[] = array('chain' => 'inet-out', 'src-address' => '10.145.64.23', 'dst-address' => '172.20.195.192/29', 'protocol' => 'icmp',
|
|---|
| 40 | 'action' => 'src-nat', 'to-addresses' => '172.20.195.197', 'comment' => 'warp_ping_inext');
|
|---|
| 41 |
|
|---|
| 42 | $DbResult = $this->Database->query('SELECT `Member`.*, `Subject`.`Name` FROM `Member` '.
|
|---|
| 43 | 'LEFT JOIN `Subject` ON `Subject`.`Id` = `Member`.`Subject` '.
|
|---|
| 44 | 'WHERE `Member`.`Blocked` = 0');
|
|---|
| 45 | while ($Member = $DbResult->fetch_assoc())
|
|---|
| 46 | {
|
|---|
| 47 | echo($Member['Name'].': ');
|
|---|
| 48 | // Hosts
|
|---|
| 49 | $DbResult2 = $this->Database->query('SELECT `NetworkInterface`.*, `NetworkDevice`.`Name` AS `DeviceName`, `NetworkDevice`.`InboundNATPriority` FROM `NetworkInterface`'.
|
|---|
| 50 | ' LEFT JOIN `NetworkDevice` ON `NetworkDevice`.`Id` = `NetworkInterface`.`Device` WHERE (`NetworkInterface`.`ExternalIP` <> "")'.
|
|---|
| 51 | ' AND (`NetworkInterface`.`LocalIP` <> "")'.
|
|---|
| 52 | ' AND (`NetworkDevice`.`Member` = '.$Member['Id'].') AND (`NetworkInterface`.`LocalIP` != `NetworkInterface`.`ExternalIP`) ORDER BY `id` DESC');
|
|---|
| 53 | while ($Interface = $DbResult2->fetch_assoc())
|
|---|
| 54 | {
|
|---|
| 55 | $Name = $Interface['DeviceName'];
|
|---|
| 56 | if ($Interface['Name'] != '') $Name .= '-'.$Interface['Name'];
|
|---|
| 57 | $Name = RouterOSIdent($Name);
|
|---|
| 58 | echo($Name.'('.$Interface['LocalIP'].'), ');
|
|---|
| 59 | if ($Member['Blocked'] == 0)
|
|---|
| 60 | {
|
|---|
| 61 | $Items[] = array('chain' => 'inet-out', 'src-address' => $Interface['LocalIP'], 'action' => 'src-nat', 'to-addresses' => $Interface['ExternalIP'], 'comment' => $Name.'-out');
|
|---|
| 62 | if ($Interface['InboundNATPriority'] > 0)
|
|---|
| 63 | $Items[] = array('chain' => 'inet-in', 'dst-address' => $Interface['ExternalIP'], 'action' => 'dst-nat', 'to-addresses' => $Interface['LocalIP'], 'comment' => $Name.'-in');
|
|---|
| 64 | } else
|
|---|
| 65 | {
|
|---|
| 66 | $Items[] = array('chain' => 'dstnat', 'src-address' => $Interface['LocalIP'], 'protocol' => 'tcp', 'dst-port' => 80, 'action' => 'dst-nat', 'to-addresses' => $IPCentrala, 'to-ports' => 81, 'comment' => $Name.'-out');
|
|---|
| 67 | }
|
|---|
| 68 | }
|
|---|
| 69 |
|
|---|
| 70 | // Subnets
|
|---|
| 71 | $DbResult2 = $this->Database->select('NetworkSubnet', '*', '`Member`='.$Member['Id']);
|
|---|
| 72 | while ($Subnet = $DbResult2->fetch_assoc())
|
|---|
| 73 | {
|
|---|
| 74 | $Subnet['Name'] = RouterOSIdent('subnet-'.$Subnet['Name']);
|
|---|
| 75 | echo($Subnet['Name'].'('.$Subnet['AddressRange'].'/'.$Subnet['Mask'].'), ');
|
|---|
| 76 | if ($Member['Blocked'] == 0)
|
|---|
| 77 | {
|
|---|
| 78 | $NewAddress = new NetworkAddressIPv4();
|
|---|
| 79 | $NewAddress->AddressFromString($Subnet['ExtAddressRange']);
|
|---|
| 80 | $NewAddress->Prefix = $Subnet['ExtMask'];
|
|---|
| 81 | $Range = $NewAddress->GetRange();
|
|---|
| 82 | if ($Subnet['ExtMask'] != 32) $Range = $Range['From']->AddressToString().'-'.$Range['To']->AddressToString();
|
|---|
| 83 | else $Range = $Range['From']->AddressToString();
|
|---|
| 84 | if ($Subnet['Mask'] == 32) $Src = $Subnet['AddressRange'];
|
|---|
| 85 | else $Src = $Subnet['AddressRange'].'/'.$Subnet['Mask'];
|
|---|
| 86 | $Items[] = array('chain' => 'inet-out', 'src-address' => $Src, 'action' => 'src-nat', 'to-addresses' => $Range, 'comment' => $Subnet['Name'].'-out');
|
|---|
| 87 |
|
|---|
| 88 | $NewAddress = new NetworkAddressIPv4();
|
|---|
| 89 | $NewAddress->AddressFromString($Subnet['AddressRange']);
|
|---|
| 90 | $NewAddress->Prefix = $Subnet['Mask'];
|
|---|
| 91 | $Range = $NewAddress->GetRange();
|
|---|
| 92 | if ($Subnet['Mask'] != 32) $Range = $Range['From']->AddressToString().'-'.$Range['To']->AddressToString();
|
|---|
| 93 | else $Range = $Range['From']->AddressToString();
|
|---|
| 94 | if ($Subnet['ExtMask'] == 32) $Dest = $Subnet['ExtAddressRange'];
|
|---|
| 95 | else $Dest = $Subnet['ExtAddressRange'].'/'.$Subnet['ExtMask'];
|
|---|
| 96 | $Items[] = array('chain' => 'inet-in', 'dst-address' => $Dest, 'action' => 'dst-nat', 'to-addresses' => $Range, 'comment' => $Subnet['Name'].'-in');
|
|---|
| 97 | } else
|
|---|
| 98 | {
|
|---|
| 99 | if ($Subnet['Mask'] == 32) $Src = $Subnet['AddressRange'];
|
|---|
| 100 | else $Src = $Subnet['AddressRange'].'/'.$Subnet['Mask'];
|
|---|
| 101 | $Items[] = array('chain' => 'dstnat', 'src-address' => $Src, 'protocol' => 'tcp', 'dst-port' => 80, 'action' => 'dst-nat', 'to-addresses' => $IPCentrala, 'to-ports' => 81, 'comment' => $Subnet['Name'].'-out');
|
|---|
| 102 | }
|
|---|
| 103 | }
|
|---|
| 104 | echo("\n");
|
|---|
| 105 | }
|
|---|
| 106 |
|
|---|
| 107 | // Redirect DNS port
|
|---|
| 108 | $Items[] = array('chain' => 'dstnat', 'dst-address' => '212.111.4.174', 'protocol' => 'tcp', 'dst-port' => 53, 'in-interface' => $InetInterface, 'action' => 'dst-nat', 'to-addresses' => '10.145.64.8', 'to-ports' => 53, 'comment' => 'DNS_redirection_TCP');
|
|---|
| 109 | $Items[] = array('chain' => 'dstnat', 'dst-address' => '212.111.4.174', 'protocol' => 'udp', 'dst-port' => 53, 'in-interface' => $InetInterface, 'action' => 'dst-nat', 'to-addresses' => '10.145.64.8', 'to-ports' => 53, 'comment' => 'DNS_redirection_UDP');
|
|---|
| 110 |
|
|---|
| 111 | // Chain for local interface
|
|---|
| 112 | $Items[] = array('chain' => 'srcnat', 'out-interface' => $LocalInterface, 'action' => 'jump', 'jump-target' => 'local-out', 'comment' => 'local-out');
|
|---|
| 113 | $Items[] = array('chain' => 'dstnat', 'in-interface' => $LocalInterface, 'action' => 'jump', 'jump-target' => 'local-in', 'comment' => 'local-in');
|
|---|
| 114 |
|
|---|
| 115 | // Accept free-access clients
|
|---|
| 116 | //$Items[] = array('chain' => 'dstnat', 'dst-address' => '!10.145.0.0/16',
|
|---|
| 117 | // 'src-address-list' => 'free-access', 'in-interface' => $LocalInterface,
|
|---|
| 118 | // 'action' => 'accept', 'comment' => 'Free_access');
|
|---|
| 119 | // Redirect unregistred clients to free access activation page
|
|---|
| 120 | //$Items[] = array('chain' => 'dstnat', 'dst-address' => '!10.145.0.0/16',
|
|---|
| 121 | // 'src-address-list' => 'unregistred', 'in-interface' => $LocalInterface, 'protocol' => 'tcp',
|
|---|
| 122 | // 'action' => 'dst-nat', 'to-addresses' => '10.145.64.70', 'to-ports' => 8080, 'comment' => 'Redirect_unregistred');
|
|---|
| 123 |
|
|---|
| 124 | // Masquerade hosts without public ip
|
|---|
| 125 | $Items[] = array('chain' => 'inet-out', 'src-address'=> '!212.111.4.174', 'action' => 'src-nat', 'to-addresses' => '77.92.221.188', 'comment' => 'Default_NAT');
|
|---|
| 126 |
|
|---|
| 127 | // Translate own public IP addresses into local IP address for local network
|
|---|
| 128 | $DbResult2 = $this->Database->query('SELECT `NetworkInterface`.*, `NetworkDevice`.`Name` AS `DeviceName`, `NetworkDevice`.`InboundNATPriority` FROM `NetworkInterface`'.
|
|---|
| 129 | ' LEFT JOIN `NetworkDevice` ON `NetworkDevice`.`Id` = `NetworkInterface`.`Device`'.
|
|---|
| 130 | ' WHERE (`NetworkInterface`.`ExternalIP` <> "") AND (`NetworkInterface`.`LocalIP` <> "") AND (`NetworkInterface`.`Enabled` = 1)'.
|
|---|
| 131 | ' AND (`NetworkInterface`.`LocalIP` != `NetworkInterface`.`ExternalIP`) ORDER BY `id` DESC');
|
|---|
| 132 | while ($Interface = $DbResult2->fetch_assoc())
|
|---|
| 133 | {
|
|---|
| 134 | $Name = $Interface['DeviceName'];
|
|---|
| 135 | if ($Interface['Name'] != '') $Name .= '-'.$Interface['Name'];
|
|---|
| 136 | $Name = RouterOSIdent($Name);
|
|---|
| 137 | $Items[] = array('chain' => 'local-in', 'dst-address' => $Interface['ExternalIP'], 'action' => 'dst-nat', 'to-addresses' => $Interface['LocalIP'], 'comment' => $Name.'-ext');
|
|---|
| 138 | }
|
|---|
| 139 |
|
|---|
| 140 | /*
|
|---|
| 141 | // Map returned local traffic to virtual subnet
|
|---|
| 142 | $Items[] = array('chain' => 'local-out', 'src-address' => '10.145.0.0/16', 'dst-address' => '10.145.0.0/16', 'action' => 'netmap', 'to-addresses' => '10.45.0.0-10.45.255.255', 'comment' => 'map-local');
|
|---|
| 143 | */
|
|---|
| 144 |
|
|---|
| 145 | $Routerboard->ListUpdate($Path, array('chain', 'dst-address', 'in-interface', 'src-address', 'out-interface', 'to-ports', 'dst-port', 'protocol', 'action', 'to-addresses', 'comment', 'jump-target', 'src-port'), $Items);
|
|---|
| 146 | }
|
|---|
| 147 | }
|
|---|
