2 # miniupnpd integration for firewall3
4 IP6TABLES=/usr/sbin/ip6tables
6 iptables -t filter -N MINIUPNPD 2>/dev/null
7 iptables -t nat -N MINIUPNPD 2>/dev/null
9 [ -x $IP6TABLES ] && $IP6TABLES -t filter -N MINIUPNPD 2>/dev/null
11 . /lib/functions/network.sh
18 [ -z "$ext_zone" ] && return
20 # IPv4 - due to NAT, need to add both to nat and filter table
21 iptables -t filter -I zone_${ext_zone}_forward -j MINIUPNPD
22 iptables -t nat -I zone_${ext_zone}_prerouting -j MINIUPNPD
24 # IPv6 if available - filter only
25 [ -x $IP6TABLES ] && {
26 $IP6TABLES -t filter -I zone_${ext_zone}_forward -j MINIUPNPD
31 # By default, user configuration is king.
33 for ext_iface in $(uci -q get upnpd.config.external_iface); do
34 add_extzone_rules $(fw3 -q network "$ext_iface")
37 add_extzone_rules $(uci -q get upnpd.config.external_zone)
39 [ ! $ADDED = 0 ] && exit 0
42 # If really nothing is available, resort to network_find_wan{,6} and
43 # assume external interfaces all have same firewall zone.
45 # (This heuristic may fail horribly, in case of e.g. multihoming, so
46 # please set external_zone in that case!)
48 network_find_wan wan_iface
49 network_find_wan6 wan6_iface
51 for ext_iface in $wan_iface $wan6_iface; do
52 # fw3 -q network fails on sub-interfaces => map to device first
53 network_get_device ext_device $ext_iface
54 add_extzone_rules $(fw3 -q device "$ext_device")