eduvpn /
vpn-server-node
| @@ 137-157 (lines=21) @@ | ||
| 134 | $udpPorts = $firewallConfig->getSection('inputChain')->getSection('udp')->toArray(); |
|
| 135 | $tcpPorts = $firewallConfig->getSection('inputChain')->getSection('tcp')->toArray(); |
|
| 136 | ||
| 137 | foreach ($udpPorts as $udpPort) { |
|
| 138 | if (!is_array($udpPort)) { |
|
| 139 | $inputChain[] = sprintf( |
|
| 140 | '-A INPUT -m state --state NEW -m udp -p udp --dport %s -j ACCEPT', |
|
| 141 | $udpPort |
|
| 142 | ); |
|
| 143 | ||
| 144 | continue; |
|
| 145 | } |
|
| 146 | ||
| 147 | foreach ($udpPort['src'] as $src) { |
|
| 148 | $ipSource = new IP($src); |
|
| 149 | if ($inetFamily === $ipSource->getFamily()) { |
|
| 150 | $inputChain[] = sprintf( |
|
| 151 | '-A INPUT -m state --state NEW -m udp -p udp --source %s --dport %s -j ACCEPT', |
|
| 152 | $src, |
|
| 153 | $udpPort['port'] |
|
| 154 | ); |
|
| 155 | } |
|
| 156 | } |
|
| 157 | } |
|
| 158 | ||
| 159 | foreach ($tcpPorts as $tcpPort) { |
|
| 160 | if (!is_array($tcpPort)) { |
|
| @@ 159-179 (lines=21) @@ | ||
| 156 | } |
|
| 157 | } |
|
| 158 | ||
| 159 | foreach ($tcpPorts as $tcpPort) { |
|
| 160 | if (!is_array($tcpPort)) { |
|
| 161 | $inputChain[] = sprintf( |
|
| 162 | '-A INPUT -m state --state NEW -m tcp -p tcp --dport %s -j ACCEPT', |
|
| 163 | $tcpPort |
|
| 164 | ); |
|
| 165 | ||
| 166 | continue; |
|
| 167 | } |
|
| 168 | ||
| 169 | foreach ($tcpPort['src'] as $src) { |
|
| 170 | $ipSource = new IP($src); |
|
| 171 | if ($inetFamily === $ipSource->getFamily()) { |
|
| 172 | $inputChain[] = sprintf( |
|
| 173 | '-A INPUT -m state --state NEW -m tcp -p tcp --source %s --dport %s -j ACCEPT', |
|
| 174 | $src, |
|
| 175 | $tcpPort['port'] |
|
| 176 | ); |
|
| 177 | } |
|
| 178 | } |
|
| 179 | } |
|
| 180 | ||
| 181 | $inputChain[] = sprintf('-A INPUT -j REJECT --reject-with %s', 4 === $inetFamily ? 'icmp-host-prohibited' : 'icmp6-adm-prohibited'); |
|
| 182 | ||
