From patchwork Mon Mar 31 15:17:43 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tremer X-Patchwork-Id: 8586 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature RSA-PSS (4096 bits)) (Client CN "mail01.haj.ipfire.org", Issuer "R10" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4ZRFBF5fSmz3xNv for ; Mon, 31 Mar 2025 15:17:57 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) client-signature ECDSA (secp384r1)) (Client CN "mail02.haj.ipfire.org", Issuer "E5" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4ZRFBC48ZVz5Fy for ; Mon, 31 Mar 2025 15:17:55 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4ZRFBC3Mfsz3362 for ; Mon, 31 Mar 2025 15:17:55 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature RSA-PSS (4096 bits)) (Client CN "mail01.haj.ipfire.org", Issuer "R10" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4ZRFB83gr2z335c for ; Mon, 31 Mar 2025 15:17:52 +0000 (UTC) Received: from michael.haj.ipfire.org (michael.haj.ipfire.org [172.28.1.242]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "michael.haj.ipfire.org", Issuer "E5" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4ZRFB76PxzzD2; Mon, 31 Mar 2025 15:17:51 +0000 (UTC) Received: by michael.haj.ipfire.org (Postfix, from userid 0) id 4ZRFB75HpbzTgmZ; Mon, 31 Mar 2025 15:17:51 +0000 (UTC) From: Michael Tremer To: development@lists.ipfire.org Cc: Michael Tremer Subject: [PATCH 1/3] firewall: Collect all networks that should not be NATed in an array Date: Mon, 31 Mar 2025 15:17:43 +0000 Message-Id: <20250331151745.3067362-1-michael.tremer@ipfire.org> X-Mailer: git-send-email 2.39.5 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 No functional changes. Signed-off-by: Michael Tremer --- src/initscripts/system/firewall | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 139d94aa0..6d9c00282 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -481,22 +481,22 @@ iptables_red_up() { iptables -t nat -A REDNAT -i "${GREEN_DEV}" -o "${IFACE}" -j RETURN fi - local NO_MASQ_NETWORKS + local NO_MASQ_NETWORKS=() if [ "${MASQUERADE_GREEN}" = "off" ]; then - NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${GREEN_NETADDRESS}/${GREEN_NETMASK}" + NO_MASQ_NETWORKS+=( "${GREEN_NETADDRESS}/${GREEN_NETMASK}" ) fi if [ "${MASQUERADE_BLUE}" = "off" ]; then - NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${BLUE_NETADDRESS}/${BLUE_NETMASK}" + NO_MASQ_NETWORKS+=( "${BLUE_NETADDRESS}/${BLUE_NETMASK}" ) fi if [ "${MASQUERADE_ORANGE}" = "off" ]; then - NO_MASQ_NETWORKS="${NO_MASQ_NETWORKS} ${ORANGE_NETADDRESS}/${ORANGE_NETMASK}" + NO_MASQ_NETWORKS+=( "${ORANGE_NETADDRESS}/${ORANGE_NETMASK}" ) fi local network - for network in ${NO_MASQ_NETWORKS}; do + for network in ${NO_MASQ_NETWORKS[@]}; do iptables -t nat -A REDNAT -s "${network}" -o "${IFACE}" -j RETURN done From patchwork Mon Mar 31 15:17:44 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tremer X-Patchwork-Id: 8585 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R10" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4ZRFBF5G6sz3xGq for ; Mon, 31 Mar 2025 15:17:57 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) client-signature ECDSA (secp384r1)) (Client CN "mail02.haj.ipfire.org", Issuer "E5" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4ZRFBC3gmQz4mX for ; Mon, 31 Mar 2025 15:17:55 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4ZRFBC2xrvz336C for ; Mon, 31 Mar 2025 15:17:55 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R10" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4ZRFB83M29z2xS5 for ; Mon, 31 Mar 2025 15:17:52 +0000 (UTC) Received: from michael.haj.ipfire.org (michael.haj.ipfire.org [172.28.1.242]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) client-signature ECDSA (secp384r1)) (Client CN "michael.haj.ipfire.org", Issuer "E5" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4ZRFB76pXvzNV; Mon, 31 Mar 2025 15:17:51 +0000 (UTC) Received: by michael.haj.ipfire.org (Postfix, from userid 0) id 4ZRFB75Nt2zTgc4; Mon, 31 Mar 2025 15:17:51 +0000 (UTC) From: Michael Tremer To: development@lists.ipfire.org Cc: Michael Tremer Subject: [PATCH 2/3] firewall: Explicitely don't NAT any aliases Date: Mon, 31 Mar 2025 15:17:44 +0000 Message-Id: <20250331151745.3067362-2-michael.tremer@ipfire.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250331151745.3067362-1-michael.tremer@ipfire.org> References: <20250331151745.3067362-1-michael.tremer@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 It seems that there is a problem with local connections that have preselected an outgoing interface. That will work just fine, but ultimately the packet will be NATed back to the primary RED IP address. To prevent this, we are adding some extra rules that skip the MASQUERADE target. Signed-off-by: Michael Tremer --- src/initscripts/system/firewall | 5 +++++ src/initscripts/system/functions | 15 +++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 6d9c00282..6befa9fc3 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -495,6 +495,11 @@ iptables_red_up() { NO_MASQ_NETWORKS+=( "${ORANGE_NETADDRESS}/${ORANGE_NETMASK}" ) fi + local alias + for alias in $(get_aliases); do + NO_MASQ_NETWORKS+=( "${alias}" ) + done + local network for network in ${NO_MASQ_NETWORKS[@]}; do iptables -t nat -A REDNAT -s "${network}" -o "${IFACE}" -j RETURN diff --git a/src/initscripts/system/functions b/src/initscripts/system/functions index e486cc085..94c9236d3 100644 --- a/src/initscripts/system/functions +++ b/src/initscripts/system/functions @@ -935,3 +935,18 @@ readhash() { printf -v "${array}[${key}]" "%s" "${val}" done < "${file}" } + +# Returns all enabled aliases +get_aliases() { + local address + local enabled + local rest + + local IFS=, + + while read -r address enabled rest; do + if [ "${enabled}" = "on" ]; then + echo "${address}" + fi + done < /var/ipfire/ethernet/aliases +} From patchwork Mon Mar 31 15:17:45 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tremer X-Patchwork-Id: 8587 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature RSA-PSS (4096 bits)) (Client CN "mail01.haj.ipfire.org", Issuer "R10" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4ZRFBF5jDNz3xPk for ; Mon, 31 Mar 2025 15:17:57 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) client-signature ECDSA (secp384r1)) (Client CN "mail02.haj.ipfire.org", Issuer "E5" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4ZRFBC4KZ7z5G1 for ; Mon, 31 Mar 2025 15:17:55 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4ZRFBC3dGHz3367 for ; Mon, 31 Mar 2025 15:17:55 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature RSA-PSS (4096 bits)) (Client CN "mail01.haj.ipfire.org", Issuer "R10" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4ZRFB83lWpz335j for ; Mon, 31 Mar 2025 15:17:52 +0000 (UTC) Received: from michael.haj.ipfire.org (michael.haj.ipfire.org [172.28.1.242]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) client-signature ECDSA (secp384r1)) (Client CN "michael.haj.ipfire.org", Issuer "E5" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4ZRFB80GP3zjj; Mon, 31 Mar 2025 15:17:52 +0000 (UTC) Received: by michael.haj.ipfire.org (Postfix, from userid 0) id 4ZRFB75XLfzTgsX; Mon, 31 Mar 2025 15:17:51 +0000 (UTC) From: Michael Tremer To: development@lists.ipfire.org Cc: Michael Tremer Subject: [PATCH 3/3] aliases.cgi: Reload firewall after updating aliases Date: Mon, 31 Mar 2025 15:17:45 +0000 Message-Id: <20250331151745.3067362-3-michael.tremer@ipfire.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250331151745.3067362-1-michael.tremer@ipfire.org> References: <20250331151745.3067362-1-michael.tremer@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 This is requried to update any REDNAT rules. Signed-off-by: Michael Tremer --- html/cgi-bin/aliases.cgi | 3 +++ 1 file changed, 3 insertions(+) diff --git a/html/cgi-bin/aliases.cgi b/html/cgi-bin/aliases.cgi index def03ff9b..aa1ea4cb6 100644 --- a/html/cgi-bin/aliases.cgi +++ b/html/cgi-bin/aliases.cgi @@ -615,6 +615,9 @@ sub SortDataFile sub BuildConfiguration { # Restart service associated with this &General::system('/usr/local/bin/setaliases'); + + # Reload the firewall for REDNAT rules + &General::firewall_reload(); } #