Changeset 278 for trunk/system/generators/firewall_nat.php

Timestamp:

Feb 28, 2010, 8:42:11 AM (15 years ago)

Author:

george

Message:

• Upraveno: Při generování pravidel pro NAT router použij samostatný řetězec pravidel.

File:

• trunk/system/generators/firewall_nat.php (modified) (5 diffs)

trunk/system/generators/firewall_nat.php

@@ -15 +15 @@
 
 $Items = array();
+// Chain for inet interface
+$Items[] = array('chain' => 'srcnat', 'out-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-out', 'comment' => 'inet-out');
+$Items[] = array('chain' => 'dstnat', 'in-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-in', 'comment' => 'inet-in');
+
+// Skip local subnet
+//$Items[] = array('chain' => 'inet-out', 'dst-address' => '172.16.1.1/30', 'action' => 'accept', 'comment' => 'Local_subnet');     
+//$Items[] = array('chain' => 'inet-in', 'dst-address' => '172.16.1.1/30', 'action' => 'accept', 'comment' => 'Local_subnet');
+
 $DbResult = $Database->query('SELECT Member.*, Subject.Name FROM Member JOIN Subject ON Member.Subject = Subject.Id');
 while($Member = $DbResult->fetch_assoc())
@@ -27 +35 @@
     $Name = RouterOSIdent($Name);
     echo($Name.'('.$Interface['LocalIP'].'), ');
-    $Items[] = array('chain' => 'srcnat', 'src-address' => $Interface['LocalIP'], 'out-interface' => $InetInterface, 'action' => 'src-nat',  'to-addresses' => $Interface['ExternalIP'], 'comment' => $Name.'-out');
-    $Items[] = array('chain' => 'dstnat', 'dst-address' => $Interface['ExternalIP'], 'in-interface' => $InetInterface, 'action' => 'dst-nat', 'to-addresses' => $Interface['LocalIP'], 'comment' => $Name.'-in');
+    $Items[] = array('chain' => 'inet-out', 'src-address' => $Interface['LocalIP'], 'action' => 'src-nat',  'to-addresses' => $Interface['ExternalIP'], 'comment' => $Name.'-out');
+    $Items[] = array('chain' => 'inet-in', 'dst-address' => $Interface['ExternalIP'], 'action' => 'dst-nat', 'to-addresses' => $Interface['LocalIP'], 'comment' => $Name.'-in');
   }
 
@@ -45 +53 @@
     if($Subnet['Mask'] == 32) $Src = $Subnet['AddressRange'];
       else $Src = $Subnet['AddressRange'].'/'.$Subnet['Mask'];
-    $Items[] = array('chain' => 'srcnat', 'src-address' => $Src, 'out-interface' => $InetInterface, 'action' => 'src-nat', 'to-addresses' => $Range, 'comment' => $Subnet['Name'].'-out');
+    $Items[] = array('chain' => 'inet-out', 'src-address' => $Src, 'action' => 'src-nat', 'to-addresses' => $Range, 'comment' => $Subnet['Name'].'-out');
     
     $NewAddress = new NetworkAddressIPv4();
@@ -55 +63 @@
     if($Subnet['ExtMask'] == 32) $Dest = $Subnet['ExtAddressRange'];
       else $Dest = $Subnet['ExtAddressRange'].'/'.$Subnet['ExtMask'];
-    $Items[] = array('chain' => 'dstnat', 'dst-address' => $Dest, 'in-interface' => $InetInterface, 'action' => 'dst-nat',  'to-addresses' => $Range, 'comment' => $Subnet['Name'].'-in');
+    $Items[] = array('chain' => 'inet-in', 'dst-address' => $Dest, 'action' => 'dst-nat', 'to-addresses' => $Range, 'comment' => $Subnet['Name'].'-in');
   }
   echo("\n");
@@ -61 +69 @@
 
 // Masquerade hosts without public ip
-$Items[] = array('chain' => 'srcnat', 'out-interface' => $InetInterface, 'action' => 'masquerade', 'comment' => 'Default_NAT');     
+$Items[] = array('chain' => 'inet-out', 'action' => 'masquerade', 'comment' => 'Default_NAT');     
 // Redirect DNS port
-$Items[] = array('chain' => 'dstnat', 'dst-address' => '212.111.4.174', 'protocol' => 'tcp', 'dst-port' => 53, 'in-interface' => $InetInterface, 'action' => 'dst-nat', 'to-addresses' => '10.145.64.8', 'to-ports' => 53, 'comment' => 'DNS_redirection_UDP');
-$Items[] = array('chain' => 'dstnat', 'dst-address' => '212.111.4.174', 'protocol' => 'udp', 'dst-port' => 53, 'in-interface' => $InetInterface, 'action' => 'dst-nat', 'to-addresses' => '10.145.64.8', 'to-ports' => 53, 'comment' => 'DNS_redirection_UDP');
+//$Items[] = array('chain' => 'dstnat', 'dst-address' => '212.111.4.174', 'protocol' => 'tcp', 'dst-port' => 53, 'in-interface' => $InetInterface, 'action' => 'dst-nat', 'to-addresses' => '10.145.64.8', 'to-ports' => 53, 'comment' => 'DNS_redirection_UDP');
+//$Items[] = array('chain' => 'dstnat', 'dst-address' => '212.111.4.174', 'protocol' => 'udp', 'dst-port' => 53, 'in-interface' => $InetInterface, 'action' => 'dst-nat', 'to-addresses' => '10.145.64.8', 'to-ports' => 53, 'comment' => 'DNS_redirection_UDP');
 
 //print_r($Items);
-$Routerboard->ListUpdate($Path, array('chain', 'dst-address', 'in-interface', 'src-address', 'out-interface', 'to-ports', 'dst-port', 'protocol', 'action', 'to-addresses', 'comment'), $Items);
+$Routerboard->ListUpdate($Path, array('chain', 'dst-address', 'in-interface', 'src-address', 'out-interface', 'to-ports', 'dst-port', 'protocol', 'action', 'to-addresses', 'comment', 'jump-target'), $Items);
 
 ?>