luci/applications/luci-fw/root/etc/init.d/luci_fw

#!/bin/sh /etc/rc.common
START=46

apply_portfw() {
	local cfg="$1"
	config_get proto "$cfg" proto
	config_get dport "$cfg" dport
	config_get iface "$cfg" iface
	config_get to    "$cfg" to
	
	config_get ifname "$iface" ifname
	
	[ -n "$proto" ] || return 0
	[ -n "$dport" ] || return 0
	[ -n "$ifname" ] || return 0
	[ -n "$to" ] || return 0

	ports=$(echo $to | cut -sd: -f2)
	if [ -n "$ports" ]; then
		ports="--dport $(echo $ports | sed -e 's/-/:/')"
	else
		ports="--dport $dport"
	fi

	ip=$(echo $to | cut -d: -f1)
	
	if ([ "$proto" == "tcpudp" ] || [ "$proto" == "tcp" ]); then
		iptables -t nat -A luci_fw_prerouting -i "$ifname" -p tcp --dport "$dport" -j DNAT --to "$to"
		iptables -A luci_fw_forward -i "$ifname" -p tcp -d "$ip" $ports -j ACCEPT
	fi

	if ([ "$proto" == "tcpudp" ] || [ "$proto" == "udp" ]); then
		iptables -t nat -A luci_fw_prerouting -i "$ifname" -p udp --dport "$dport" -j DNAT --to "$to"
		iptables -A luci_fw_forward -i "$ifname" -p udp -d "$ip" $ports -j ACCEPT
	fi
}

apply_routing() {
	local cfg="$1"
	config_get iface "$cfg" iface
	config_get oface "$cfg" oface
	config_get_bool fwd "$cfg" fwd
	config_get_bool nat "$cfg" nat
	config_get_bool bidi "$cfg" bidi
	
	config_get ifname "$iface" ifname
	config_get ofname "$oface" ifname
	
	[ -n "$ifname" ] || return 0
	[ -n "$ofname" ] || return 0
	
	[ "$fwd" -gt 0 ] && {
		iptables -A luci_fw_forward -i "$ifname" -o "$ofname" -j ACCEPT
		[ "$bidi" -gt 0 ] && iptables -A luci_fw_forward -i "$ofname" -o "$ifname" -j ACCEPT
	}
	
	[ "$nat" -gt 0 ] && {
		config_get ifip "$iface" ipaddr
		config_get ifmask "$iface" netmask
		eval "$(ipcalc.sh $ifip $ifmask)"
		
		iptables -t nat -A luci_fw_postrouting -s "$NETWORK/$PREFIX" -o "$ofname" -j MASQUERADE
		
		[ "$bidi" -gt 0 ] && {
			config_get ofip "$oface" ipaddr
			config_get ofmask "$oface" netmask
			eval "$(ipcalc.sh $ofip $ofmask)"
			
			iptables -t nat -A luci_fw_postrouting -s "$NETWORK/$PREFIX" -o "$ifname" -j MASQUERADE		
		}
	}
}

apply_rule() {
	local cfg="$1"
	local cmd=""

	config_get chain "$cfg" chain
	[ -n "$chain" ] || return 0
	[ "$chain" == "forward" ] && cmd="$cmd -A luci_fw_forward"
	[ "$chain" == "input" ] && cmd="$cmd -A luci_fw_input"
	[ "$chain" == "output" ] && cmd="$cmd -A luci_fw_output"
	[ "$chain" == "prerouting" ] && cmd="$cmd -t nat -A luci_fw_prerouting"
	[ "$chain" == "postrouting" ] && cmd="$cmd -t nat -A luci_fw_postrouting"
	
	config_get iface "$cfg" iface
	config_get ifname "$iface" ifname
	[ -n "$ifname" ] && cmd="$cmd -i $ifname"	

	config_get oface "$cfg" oface
	config_get ofname "$oface" ifname
	[ -n "$ofname" ] && cmd="$cmd -o $ofname"	

	config_get proto "$cfg" proto
	[ -n "$proto" ] && cmd="$cmd -p $proto"	

	config_get source "$cfg" source
	[ -n "$source" ] && cmd="$cmd -s $source"	

	config_get destination "$cfg" destination
	[ -n "$destination" ] && cmd="$cmd -d $destination"	

	config_get sport "$cfg" sport
	[ -n "$sport" ] && cmd="$cmd --sport $sport"	

	config_get dport "$cfg" dport
	[ -n "$dport" ] && cmd="$cmd --dport $dport"	
	
	config_get todest "$cfg" todest
	[ -n "$todest" ] && cmd="$cmd --to-destination $todest"	

	config_get tosrc "$cfg" tosrc
	[ -n "$tosrc" ] && cmd="$cmd --to-source $tosrc"	
	
	config_get mac "$cfg" mac
	[ -n "$mac" ] && cmd="$cmd -m mac --mac-source $mac"

	config_get jump "$cfg" jump
	[ -n "$jump" ] && cmd="$cmd -j $jump"	

	config_get command "$cfg" command
	[ -n "$command" ] && cmd="$cmd $command"	

	iptables $cmd
}

start() {
	### Create subchains
	iptables -N luci_fw_input
	iptables -N luci_fw_output
	iptables -N luci_fw_forward
	iptables -t nat -N luci_fw_prerouting
	iptables -t nat -N luci_fw_postrouting
	
	### Hook in the chains
	iptables -A input_rule -j luci_fw_input
	iptables -A output_rule -j luci_fw_output
	iptables -A forwarding_rule -j luci_fw_forward
	iptables -t nat -A prerouting_rule -j luci_fw_prerouting
	iptables -t nat -A postrouting_rule -j luci_fw_postrouting
	
	### Scan network interfaces
	include /lib/network
	scan_interfaces
	
	### Read chains from config
	config_load luci_fw
	config_foreach apply_rule rule
	config_foreach apply_portfw portfw
	config_foreach apply_routing routing
}

stop() {
	### Hook out the chains
	iptables -D input_rule -j luci_fw_input
	iptables -D output_rule -j luci_fw_output
	iptables -D forwarding_rule -j luci_fw_forward
	iptables -t nat -D prerouting_rule -j luci_fw_prerouting
	iptables -t nat -D postrouting_rule -j luci_fw_postrouting	
	
	### Clear subchains
	iptables -F luci_fw_input
	iptables -F luci_fw_output
	iptables -F luci_fw_forward
	iptables -t nat -F luci_fw_prerouting
	iptables -t nat -F luci_fw_postrouting
	
	### Delete subchains
	iptables -X luci_fw_input
	iptables -X luci_fw_output
	iptables -X luci_fw_forward
	iptables -t nat -X luci_fw_prerouting
	iptables -t nat -X luci_fw_postrouting
}