Added reflection redirect rule and rearranged some related code that goes with it.

1 files changed, 49 insertions, 57 deletions

diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index a54ff46..200852e 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -791,45 +791,15 @@ function filter_get_reflection_interfaces($natif = "") {
 	return $nat_if_list;
 }
 
-function filter_generate_reflection_nat($rule, $rdr_ifs, $protocol, $srcaddr, $dstaddr_port, $target) {
+function filter_generate_reflection_nat($rule, $nat_ifs, $protocol, $srcaddr, $dstaddr, $target) {
 	global $FilterIflist, $config;
 
 	// Initialize natrules holder string
 	$natrules = "";
 
-	if(!empty($rdr_ifs)) {
+	if(!empty($nat_ifs)) {
 		update_filter_reload_status("Creating reflection NAT rule for {$rule['descr']}...");
 
-		$rdr_if_list = implode(" ", $rdr_ifs);
-		if(count($rdr_ifs) > 1)
-			$rdr_if_list = "{ {$rdr_if_list} }";
-
-		$natrules .= "\n# Reflection redirects\n";
-
-		$dstaddr = explode(" ", $dstaddr_port);
-		if($dstaddr[2])
-			$rflctintrange = $dstaddr[2];
-		else
-			$rflctintrange = "";
-		$dstaddr = $dstaddr[0];
-
-		if(isset($rule['destination']['any'])) {
-			if(!$rule['interface'])
-				$natif = "wan";
-			else
-				$natif = $rule['interface'];
-
-			if(!isset($FilterIflist[$natif]))
-				return "";
-			if(is_ipaddr($FilterIflist[$natif]['ip']))
-				$dstaddr = $FilterIflist[$natif]['ip'];
-			else
-				return "";
-
-			if(!empty($FilterIflist[$natif]['sn']))
-				$dstaddr = gen_subnet($dstaddr, $FilterIflist[$natif]['sn']) . '/' . $FilterIflist[$natif]['sn'];
-		}
-
 		if(is_alias($rule['target']))
 			$target_translated = filter_expand_alias($rule['target']);
 		else if(is_ipaddr($rule['target']))
@@ -1137,20 +1107,6 @@ function filter_nat_rules_generate() {
 				$localport = " port {$localport}";
 			}
 
-			switch(strtolower($rule['protocol'])) {
-			case "tcp/udp":
-				$protocol = "{ tcp udp }";
-				break;
-			case "tcp":
-			case "udp":
-				$protocol = strtolower($rule['protocol']);
-				break;
-			default:
-				$protocol = strtolower($rule['protocol']);
-				$localport = "";
-				break;
-			}
-
 			$target = alias_expand($rule['target']);
 			if(!$target && !isset($rule['nordr'])) {
 				$natrules .= "# Unresolvable alias {$rule['target']}\n";
@@ -1161,6 +1117,13 @@ function filter_nat_rules_generate() {
 				$rdrpass = "pass ";
 			else
 				$rdrpass = "";
+
+			if (isset($rule['nordr'])) {
+				$nordr = "no ";
+				$rdrpass = "";
+			} else
+				$nordr = "";
+
 			if(!$rule['interface'])
 				$natif = "wan";
 			else
@@ -1171,17 +1134,42 @@ function filter_nat_rules_generate() {
 
 			$srcaddr = filter_generate_address($rule, 'source', true);
 			$dstaddr = filter_generate_address($rule, 'destination', true);
+			$srcaddr = trim($srcaddr);
+			$dstaddr = trim($dstaddr);
 
 			if(!$dstaddr)
 				$dstaddr = $FilterIflist[$natif]['ip'];
 
+			$dstaddr_port = explode(" ", $dstaddr);
+			$dstaddr_reflect = $dstaddr;
+			if(isset($rule['destination']['any'])) {
+				$dstaddr_reflect = $FilterIflist[$natif]['ip'];
+				if(!empty($FilterIflist[$natif]['sn']))
+					$dstaddr_reflect = gen_subnet($dstaddr_reflect, $FilterIflist[$natif]['sn']) . '/' . $FilterIflist[$natif]['sn'];
+
+				if($dstaddr_port[2])
+					$dstaddr_reflect .= " port " . $dstaddr_port[2];
+			}
+
 			$natif = $FilterIflist[$natif]['if'];
 
-			if (isset($rule['nordr'])) {
-				$nordr = "no ";
-				$rdrpass = "";
-			} else
-				$nordr = "";
+			switch(strtolower($rule['protocol'])) {
+			case "tcp/udp":
+				$protocol = "{ tcp udp }";
+				break;
+			case "tcp":
+			case "udp":
+				$protocol = strtolower($rule['protocol']);
+				break;
+			default:
+				$protocol = strtolower($rule['protocol']);
+				$localport = "";
+				break;
+			}
+
+			$localport_nat = $localport;
+			if(empty($localport_nat) && $dstaddr_port[2])
+				$localport_nat = " port " . $dstaddr_port[2];
 
 			if(!isset($config['system']['disablenatreflection'])) {
 				$nat_if_list = filter_get_reflection_interfaces($natif);
@@ -1190,23 +1178,27 @@ function filter_nat_rules_generate() {
 			}
 
 			if($srcaddr <> "" && $dstaddr <> "" && $natif) {
-				$srcaddr = trim($srcaddr);
-				$dstaddr = trim($dstaddr);
+				$natrules .= "{$nordr}rdr {$rdrpass}on {$natif} proto {$protocol} from {$srcaddr} to {$dstaddr}" . ($nordr == "" ? " -> {$target}{$localport}\n" : "\n");
 
-				$natrules .= "{$nordr}rdr {$rdrpass}on {$natif} proto {$protocol} from {$srcaddr} to {$dstaddr}" . ($nordr == "" ? " -> {$target}{$localport}" : "");
+				if(!empty($nat_if_list)) {
+					$rdr_if_list = implode(" ", $nat_if_list);
+					if(count($nat_if_list) > 1)
+						$rdr_if_list = "{ {$rdr_if_list} }";
+
+					$natrules .= "{$nordr}rdr on {$rdr_if_list} proto {$protocol} from {$srcaddr} to {$dstaddr_reflect}" . ($nordr == "" ? " -> {$target}{$localport}\n" : "\n");
+				}
 
 				/* Does this rule redirect back to a internal host? */
 				if(isset($rule['destination']['any']) && !interface_has_gateway($rule['interface']) && !isset($rule['nordr'])) {
 					$rule_interface_ip = find_interface_ip($natif);
 					$rule_interface_subnet = find_interface_subnet($natif);
 					$rule_subnet = gen_subnet($rule_interface_ip, $rule_interface_subnet);
-					$natrules .= "\n";
 					$natrules .= "no nat on {$natif} proto tcp from ({$natif}) to {$rule_subnet}/{$rule_interface_subnet}\n";
 					$natrules .= "nat on {$natif} proto tcp from {$rule_subnet}/{$rule_interface_subnet} to {$target} port {$dstport[0]} -> ({$natif})\n";
 				}
+				$nat_if_list[] = $natif;
 				if(!isset($rule['nordr']))
-					$natrules .= filter_generate_reflection_nat($rule, $nat_if_list, $protocol, $srcaddr, $dstaddr, "{$target}{$localport}");
-				$natrules .= "\n";
+					$natrules .= filter_generate_reflection_nat($rule, $nat_if_list, $protocol, $srcaddr, $dstaddr_reflect, "{$target}{$localport_nat}");
 			}
 		}
 	}