mirror of
https://gitlab.com/shorewall/code.git
synced 2025-06-23 11:11:32 +02:00
Add an ORIGINAL DEST column to /etc/shorewall/masq
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
parent
b195884b1f
commit
5c176c64b7
@ -58,8 +58,8 @@ sub initialize() {
|
|||||||
#
|
#
|
||||||
sub process_one_masq( )
|
sub process_one_masq( )
|
||||||
{
|
{
|
||||||
my ($interfacelist, $networks, $addresses, $proto, $ports, $ipsec, $mark, $user, $condition ) =
|
my ($interfacelist, $networks, $addresses, $proto, $ports, $ipsec, $mark, $user, $condition, $origdest ) =
|
||||||
split_line1 'masq file', { interface => 0, source => 1, address => 2, proto => 3, port => 4, ipsec => 5, mark => 6, user => 7, switch => 8 };
|
split_line1 'masq file', { interface => 0, source => 1, address => 2, proto => 3, port => 4, ipsec => 5, mark => 6, user => 7, switch => 8, origdest => 9 };
|
||||||
|
|
||||||
if ( $interfacelist eq 'COMMENT' ) {
|
if ( $interfacelist eq 'COMMENT' ) {
|
||||||
process_comment;
|
process_comment;
|
||||||
@ -237,7 +237,7 @@ sub process_one_masq( )
|
|||||||
$baserule . $rule ,
|
$baserule . $rule ,
|
||||||
$networks ,
|
$networks ,
|
||||||
$destnets ,
|
$destnets ,
|
||||||
'' ,
|
$origdest ,
|
||||||
$target ,
|
$target ,
|
||||||
'' ,
|
'' ,
|
||||||
'' ,
|
'' ,
|
||||||
|
@ -10,8 +10,9 @@
|
|||||||
# See the file README.txt for further details.
|
# See the file README.txt for further details.
|
||||||
#------------------------------------------------------------------------------
|
#------------------------------------------------------------------------------
|
||||||
# For information about entries in this file, type "man shorewall-masq"
|
# For information about entries in this file, type "man shorewall-masq"
|
||||||
##############################################################################
|
################################################################################################################
|
||||||
#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK
|
#INTERFACE:DEST SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/ SWITCH ORIGINAL
|
||||||
|
# GROUP DEST
|
||||||
eth0 10.0.0.0/8,\
|
eth0 10.0.0.0/8,\
|
||||||
169.254.0.0/16,\
|
169.254.0.0/16,\
|
||||||
172.16.0.0/12,\
|
172.16.0.0/12,\
|
||||||
|
@ -10,8 +10,9 @@
|
|||||||
# See the file README.txt for further details.
|
# See the file README.txt for further details.
|
||||||
#------------------------------------------------------------------------------
|
#------------------------------------------------------------------------------
|
||||||
# For information about entries in this file, type "man shorewall-masq"
|
# For information about entries in this file, type "man shorewall-masq"
|
||||||
###############################################################################
|
################################################################################################################
|
||||||
#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK
|
#INTERFACE:DEST SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/ SWITCH ORIGINAL
|
||||||
|
# GROUP DEST
|
||||||
eth0 10.0.0.0/8,\
|
eth0 10.0.0.0/8,\
|
||||||
169.254.0.0/16,\
|
169.254.0.0/16,\
|
||||||
172.16.0.0/12,\
|
172.16.0.0/12,\
|
||||||
|
@ -6,6 +6,6 @@
|
|||||||
# The manpage is also online at
|
# The manpage is also online at
|
||||||
# http://www.shorewall.net/manpages/shorewall-masq.html
|
# http://www.shorewall.net/manpages/shorewall-masq.html
|
||||||
#
|
#
|
||||||
######################################################################################################
|
################################################################################################################
|
||||||
#INTERFACE:DEST SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/ SWITCH
|
#INTERFACE:DEST SOURCE ADDRESS PROTO PORT(S) IPSEC MARK USER/ SWITCH ORIGINAL
|
||||||
# GROUP
|
# GROUP DEST
|
||||||
|
@ -509,6 +509,22 @@
|
|||||||
restart</command>.</para>
|
restart</command>.</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
</varlistentry>
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term><emphasis role="bold">ORIGINAL DEST</emphasis> (origdest) -
|
||||||
|
[<emphasis
|
||||||
|
role="bold">-</emphasis>|<emphasis>address</emphasis>[,<emphasis>address</emphasis>]...[<emphasis>exclusion</emphasis>]|<emphasis>exclusion</emphasis>]</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>(Optional) Added in Shorewall 4.5.6. This column may be
|
||||||
|
included and may contain one or more addresses (host or network)
|
||||||
|
separated by commas. Address ranges are not allowed. When this
|
||||||
|
column is supplied, rules are generated that require that the
|
||||||
|
original destination address matches one of the listed addresses. It
|
||||||
|
is useful for specifying that SNAT should occur only for connections
|
||||||
|
that were acted on by a DNAT when they entered the firewall.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
</variablelist>
|
</variablelist>
|
||||||
</refsect1>
|
</refsect1>
|
||||||
|
|
||||||
|
Loading…
x
Reference in New Issue
Block a user