#!/bin/sh
#------------------------------------------------------------------------------
# /etc/rc.d/rc370.dmz - configure dmz
#
# Creation:         jw5
# Last Update:      $Id: rc370.dmz 10421 2005-11-23 14:08:02Z jw5 $
#------------------------------------------------------------------------------

case $OPT_DMZ in
yes)
    begin_script DMZ "setting up dmz ..."

    if [ -z "$I" ]
    then
        # get helper functions
        . /etc/rc.d/fwrules-helper
    fi
    case "$DMZ_DO_DEBUG" in
        yes)  FWRULES_DO_DEBUG=yes ;;
    esac

    # green  - internal networks
    # orange - dmz networks
    # red    - inet interface

    red_dev=$DMZ_RED_DEV
    green=
    orange=

    for i in `seq 1 $IP_NET_N`
    do
        net=IP_NET_$i
        eval type=\$IP_NET_${i}_TYPE
        case $type in
             green)  green="$green $net" ;;
             orange) orange=$net; orange_dev=IP_NET_${i}_DEV ;;
        esac
    done

    get_count FORWARD
    forward_def=$res
    get_count INPUT
    input_def=$res
    add_chain dmz-fwd
    add_chain dmz-inp
    ins_rule filter FORWARD "if:$orange_dev:any dmz-fwd BIDIRECTIONAL" $forward_def
    ins_rule filter INPUT   "if:$orange_dev:any dmz-inp"               $input_def

    # allow access from green to orange and snat connections
    case "x$green" in
        x) ;;
        *)
             for i in $green
             do
                 add_rule filter dmz-fwd  "$i $orange ACCEPT"
                 ins_rule nat POSTROUTING "$i $orange SNAT:${orange}_IPADDR"
	    done
	    ;;
    esac

    # allow orange to access selected ports on red
    [ 0"$DMZ_ORANGE_RED_N" -eq 0 ] || for i in `seq 1 $DMZ_ORANGE_RED_N`
    do
        eval rule=\$DMZ_ORANGE_RED_$i
        add_rule filter dmz-fwd "if:any:$red_dev $rule"
    done

    case $DMZ_NAT in
	no) ;;
	*)
	    case $red_dev in
		IP_NET_*_DEV)
		    add_rule nat POSTROUTING "if:any:$red_dev $orange any SNAT:`echo $red_dev | sed -e 's/_DEV/_IPADDR/'`"
		;;
		*)
		    add_rule nat POSTROUTING "if:any:$red_dev $orange any MASQUERADE"
		;;
	    esac
	    ;;
    esac

    # allow orange to access selected ports on the router
    [ 0"$DMZ_ORANGE_ROUTER_N" -eq 0 ] || for i in `seq 1 $DMZ_ORANGE_ROUTER_N`
    do
        eval rule=\$DMZ_ORANGE_ROUTER_$i
        add_rule filter dmz-inp "$rule"
    done

    # close dmz-chains and reject everything
    eval orange=\$$orange
    case "$DMZ_LOG" in
        yes)
             add_rule filter dmz-fwd "$orange any     LOG:dmz-fwd-out"
             add_rule filter dmz-fwd "any     $orange LOG:dmz-fwd-in"
             add_rule filter dmz-inp "                LOG:dmz-input"
             ;;
    esac
    add_rule filter dmz-fwd     "REJECT NOLOG"
    add_rule filter dmz-inp     "REJECT NOLOG"

    end_script
;;
esac
