Changeset 298

Timestamp:

Oct 3, 2010, 12:29:03 PM (14 years ago)

Author:

george

Message:

• Přidáno: Skript pro generování pravidel filter hlavního routeru.
• Přidáno: Generování NAT pravidel pro překlad a směrování místních veřejný adres zpět do sítě.

Location:

trunk

Files:

• config.sample.php (modified) (1 diff)
• system/generators/firewall_filter.php (added)
• system/generators/firewall_nat.php (modified) (2 diffs)

trunk/config.sample.php

@@ -48 +48 @@
    'UserName' => 'admin',
    'Password' => '',
-   'InetInterface' => 'ether0',
+   'InetInterface' => 'ether1',
+   'LocalInterface' => 'ether2',
    'ConnectTimeout' => 5,
    'MangleRuleSubgroupMinPrefix' => 28,

trunk/system/generators/firewall_nat.php

@@ -13 +13 @@
 
 $InetInterface = $Config['MainRouter']['InetInterface'];
+$LocalInterface = $Config['MainRouter']['InetInterface'];
 $IPCentrala = '10.145.64.8';
 
@@ -96 +97 @@
 // Masquerade hosts without public ip
 $Items[] = array('chain' => 'inet-out', 'action' => 'src-nat', 'to-addresses' => '77.92.221.106', 'comment' => 'Default_NAT');
+
 // Redirect DNS port
 $Items[] = array('chain' => 'dstnat', 'dst-address' => '212.111.4.174', 'protocol' => 'tcp', 'dst-port' => 53, 'in-interface' => $InetInterface, 'action' => 'dst-nat', 'to-addresses' => '10.145.64.8', 'to-ports' => 53, 'comment' => 'DNS_redirection_TCP');
 $Items[] = array('chain' => 'dstnat', 'dst-address' => '212.111.4.174', 'protocol' => 'udp', 'dst-port' => 53, 'in-interface' => $InetInterface, 'action' => 'dst-nat', 'to-addresses' => '10.145.64.8', 'to-ports' => 53, 'comment' => 'DNS_redirection_UDP');
+
+
+// Chain for local interface
+$Items[] = array('chain' => 'srcnat', 'out-interface' => $LocalInterface, 'action' => 'jump', 'jump-target' => 'local-out', 'comment' => 'local-out');
+$Items[] = array('chain' => 'dstnat', 'in-interface' => $LocalInterface, 'action' => 'jump', 'jump-target' => 'local-in', 'comment' => 'local-in');
+
+// Route public addresses localy
+$DbResult = $Database->query('SELECT Member.*, Subject.Name FROM Member JOIN Subject ON Member.Subject = Subject.Id');
+while($Member = $DbResult->fetch_assoc())
+{
+  echo($Member['Name'].': ');
+  // Hosts
+  $DbResult2 = $Database->query('SELECT NetworkInterface.*, NetworkDevice.Name AS DeviceName FROM NetworkInterface LEFT JOIN NetworkDevice ON NetworkDevice.Id = NetworkInterface.Device WHERE (NetworkInterface.ExternalIP <> "") AND (NetworkDevice.Member = '.$Member['Id'].') AND (NetworkInterface.LocalIP != NetworkInterface.ExternalIP) ORDER BY id DESC');
+  while($Interface = $DbResult2->fetch_assoc())
+  {
+    $Name = $Interface['DeviceName'];
+    if($Interface['Name'] != '') $Name .= '-'.$Interface['Name'];
+    $Name = RouterOSIdent($Name);
+    echo($Name.'('.$Interface['LocalIP'].'), ');
+    $Items[] = array('chain' => 'local-in', 'dst-address' => $Interface['ExternalIP'], 'action' => 'dst-nat', 'to-addresses' => $Interface['LocalIP'], 'comment' => $Name.'-in-local');
+  }
+  echo("\n");
+}
+
+// Map returned local traffic to virtual subnet
+$Items[] = array('chain' => 'local-out', 'src-address' => '10.145.64.0/16', 'action' => 'netmap',  'to-addresses' => '10.45.64.0/16', 'comment' => 'map-local');
+
 
 //print_r($Items);