frodovdr/raspap-webgui
1
0
Fork 0
mirror of https://github.com/billz/raspap-webgui.git synced 2023-10-10 13:37:24 +02:00
Code Issues Releases Wiki Activity

Add VPN server IPs to Firewall GUI

Browse Source
This commit is contained in:
Christian Zeitnitz 2021-07-21 16:02:21 +02:00
parent e049dd6d45
commit 393292f872
2 changed files with 69 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
includes/firewall.php
View File

@ -39,7 +39,7 @@ function createRuleStr(&$sect, &$conf) {
$repl=$val=""; $repl=$val="";
switch ( $dep["type"] ) { switch ( $dep["type"] ) {
case "list": case "list":
if ( isset($dep["var"]) && !empty($conf[$dep["var"]]) ) $val = explode(',', $conf[$dep["var"]]); if ( isset($dep["var"]) && !empty($conf[$dep["var"]]) ) $val = explode(' ', $conf[$dep["var"]]);
if ( !empty($val) && isset($dep["replace"]) ) $repl=$dep["replace"]; if ( !empty($val) && isset($dep["replace"]) ) $repl=$dep["replace"];
break; break;
case "string": case "string":
@ -115,10 +115,6 @@ function ReadFirewallConf() {
} else { } else {
$conf = array(); $conf = array();
$conf["firewall-enable"] = false; $conf["firewall-enable"] = false;
$conf["openvpn-enable"] = false;
$conf["openvpn-serverip"] = "";
$conf["wireguard-enable"] = false;
$conf["wireguard-serverip"] = "";
$conf["ssh-enable"] = false; $conf["ssh-enable"] = false;
$conf["http-enable"] = false; $conf["http-enable"] = false;
$conf["excl-devices"] = ""; $conf["excl-devices"] = "";
@ -127,26 +123,32 @@ function ReadFirewallConf() {
$conf["client-device"] = ""; $conf["client-device"] = "";
$conf["restricted-ips"] = ""; $conf["restricted-ips"] = "";
} }
# get openvpn server IP (if existing)
if ( RASPI_OPENVPN_ENABLED && file_exists(RASPI_OPENVPN_CLIENT_CONFIG) ) {
exec('cat '.RASPI_OPENVPN_CLIENT_CONFIG.' | sed -rn "s/^remote\s*([a-z0-9\.\-\_]*)\s*([0-9]*).*$/\1/ip" ', $ret);
if ( !empty($ret) ) {
$ip = $ret[0];
$ip = ( filter_var($ip, FILTER_VALIDATE_IP) !== false ) ? $ip : gethostbyname($ip);
if ( !empty($ip) ) {
$conf["openvpn-serverip"] = "$ip";
$conf["openvpn-enable"] = true;
}
}
}
# get wireguard server IP (if existing)
if ( RASPI_WIREGUARD_ENABLED && file_exists(RASPI_WIREGUARD_CONFIG) ) {
# search for endpoint
}
return $conf; return $conf;
} }
function getVPN_IPs() {
$ips = "";
# get openvpn server IPs for UDP (if existing)
if ( RASPI_OPENVPN_ENABLED && ($fconf = glob(RASPI_OPENVPN_CLIENT_PATH ."/*.conf")) !== false && !empty($fconf) ) {
foreach ( $fconf as $f ) {
exec('cat '.$f.' | sed -rn "s/^remote\s*([a-z0-9\.\-\_]*)\s*([0-9]*).*$/\1/ip" ', $result);
$ip = (isset($result[0])) ? $result[0] : "";
unset($result);
exec('cat '.$f.' | sed -rn "s/^proto\s*([a-z]*).*$/\1/ip" ', $result);
$proto = (isset($result[0])) ? $result[0] : "";
if ( !empty($ip) && trim(strtolower($proto)) === "udp" ) {
$ip = gethostbyname($ip);
if ( filter_var($ip,FILTER_VALIDATE_IP) && strpos($ips, $ip) === false ) $ips .= " $ip";
}
}
}
# get wireguard server IPs for UDP (if existing)
if ( RASPI_WIREGUARD_ENABLED && ($fconf = glob(RASPI_WIREGUARD_PATH ."/*.conf")) !== false && !empty($fconf) ) {
}
return trim($ips);
}
function DisplayFirewallConfig() function DisplayFirewallConfig()
{ {
@ -154,7 +156,6 @@ function DisplayFirewallConfig()
$json = file_get_contents(RASPAP_IPTABLES_CONF); $json = file_get_contents(RASPAP_IPTABLES_CONF);
$ipt_rules = json_decode($json, true); $ipt_rules = json_decode($json, true);
getWifiInterface(); getWifiInterface();
$ap_device = $_SESSION['ap_interface']; $ap_device = $_SESSION['ap_interface'];
$clients = getClients(); $clients = getClients();
@ -179,20 +180,41 @@ function DisplayFirewallConfig()
if ( isset($_POST['save-firewall']) ) $status->addMessage(_('Firewall settings saved. Firewall is still disabled.'), 'success'); if ( isset($_POST['save-firewall']) ) $status->addMessage(_('Firewall settings saved. Firewall is still disabled.'), 'success');
if ( isset($_POST['excl-devices']) ) { if ( isset($_POST['excl-devices']) ) {
$excl = filter_var($_POST['excl-devices'], FILTER_SANITIZE_STRING); $excl = filter_var($_POST['excl-devices'], FILTER_SANITIZE_STRING);
$excl = str_replace(' ', '', $excl); $excl = str_replace(',', ' ', $excl);
if ( !empty($excl) && $fw_conf["excl-devices"] != $excl ) { $excl = trim(preg_replace('/\s+/', ' ', $excl));
if ( $fw_conf["excl-devices"] != $excl ) {
$status->addMessage(_('Exclude devices '. $excl), 'success'); $status->addMessage(_('Exclude devices '. $excl), 'success');
$fw_conf["excl-devices"] = $excl; $fw_conf["excl-devices"] = $excl;
} }
} }
if ( isset($_POST['excluded-ips']) ) {
$excl = filter_var($_POST['excluded-ips'], FILTER_SANITIZE_STRING);
$excl = str_replace(',', ' ', $excl);
$excl = trim(preg_replace('/\s+/', ' ', $excl));
if ( !empty($excl) ) {
$excl = explode(' ',$excl);
$str_excl = "";
foreach ( $excl as $ip ) {
if ( filter_var($ip,FILTER_VALIDATE_IP) ) $str_excl .= "$ip ";
else $status->addMessage(_('Exclude IP address '. $ip . ' failed - not a valid IP address'), 'warning');
}
}
$str_excl = trim($str_excl);
if ( $fw_conf["excluded-ips"] != $str_excl ) {
$status->addMessage(_('Exclude IP address(es) '. $str_excl ), 'success');
$fw_conf["excluded-ips"] = $str_excl;
}
}
WriteFirewallConf($fw_conf); WriteFirewallConf($fw_conf);
configureFirewall(); configureFirewall();
} }
$vpn_ips = getVPN_IPs();
echo renderTemplate("firewall", compact( echo renderTemplate("firewall", compact(
"status", "status",
"ap_device", "ap_device",
"str_clients", "str_clients",
"fw_conf", "fw_conf",
"ipt_rules") "ipt_rules",
"vpn_ips")
); );
} }

25
templates/firewall.php
View File

@ -18,34 +18,45 @@
<?php endif ?> <?php endif ?>
<div class="row"> <div class="row">
<div class="col-md-6"> <div class="col-md-6">
<p class="mr-2"><small><?php echo _("The default firewall will allow only outgoing and already established traffic. No UDP traffic is allowed. There are no restrictions for the access point.") ?></small></p> <p class="mr-2"><small><?php echo _("The default firewall will only allow outgoing and already established traffic.<br> No incoming UDP traffic is allowed.<br>There are no restrictions for the access point <code>$ap_device</code>.") ?></small></p>
</div> </div>
</div> </div>
<form id="frm-firewall" action="firewall_conf" method="POST" > <form id="frm-firewall" action="firewall_conf" method="POST" >
<?php echo CSRFTokenFieldTag(); ?> <?php echo CSRFTokenFieldTag(); ?>
<h5><?php echo _("Exceptions for Services"); ?></h4> <h5><?php echo _("Exception: Service"); ?></h4>
<div class="row"> <div class="row">
<div class="form-group col-md-6"> <div class="form-group col-md-6">
<div class="custom-control custom-switch"> <div class="custom-control custom-switch">
<input class="custom-control-input" id="ssh-enable" type="checkbox" name="ssh-enable" value="1" aria-describedby="exceptions-description" <?php if ($fw_conf["ssh-enable"]) echo "checked"; ?> > <input class="custom-control-input" id="ssh-enable" type="checkbox" name="ssh-enable" value="1" aria-describedby="exception-description" <?php if ($fw_conf["ssh-enable"]) echo "checked"; ?> >
<label class="custom-control-label" for="ssh-enable"><?php echo _("allow SSH access on port 22") ?></label> <label class="custom-control-label" for="ssh-enable"><?php echo _("allow SSH access on port 22") ?></label>
</div> </div>
<div class="custom-control custom-switch"> <div class="custom-control custom-switch">
<input class="custom-control-input" id="http-enable" type="checkbox" name="http-enable" value="1" aria-describedby="exceptions-description" <?php if ($fw_conf["http-enable"]) echo "checked"; ?> > <input class="custom-control-input" id="http-enable" type="checkbox" name="http-enable" value="1" aria-describedby="exceptions-description" <?php if ($fw_conf["http-enable"]) echo "checked"; ?> >
<label class="custom-control-label" for="http-enable"><?php echo _("allow access to the RaspAP GUI") ?></label> <label class="custom-control-label" for="http-enable"><?php echo _("allow access to the RaspAP GUI on port 80 or 443") ?></label>
</div> </div>
<p class="mb-0" id="exceptions-description"> <p class="mb-0" id="exceptions-description">
<small><?php echo _("Allow access for some services from the client side.") ?></small> <small><?php echo _("Allow incoming connections for some services from the internet side.") ?></small>
</p> </p>
</div> </div>
</div> </div>
<h5><?php echo _("Exclusions from the firewall"); ?></h4> <h5><?php echo _("Exception: network device"); ?></h4>
<div class="row"> <div class="row">
<div class="form-group col-md-6"> <div class="form-group col-md-6">
<label for="excl-device"><?php echo _("Exclude device(s)") ?></label> <label for="excl-device"><?php echo _("Exclude device(s)") ?></label>
<input class="form-control" id="excl-devices" type="text" name="excl-devices" value="<?php echo $fw_conf["excl-devices"] ?>" aria-describedby="exclusion-description" > <input class="form-control" id="excl-devices" type="text" name="excl-devices" value="<?php echo $fw_conf["excl-devices"] ?>" aria-describedby="exclusion-description" >
<p class="mb-0" id="exclusion-description"> <p class="mb-0" id="exclusion-description">
<small><?php echo _("Exclude the given network device(s) (separated by a comma) from firewall rules.<br>Current client devices: <code>$str_clients</code><br>The access point <code>". $ap_device ."</code> is per default excluded.") ?></small> <small><?php echo _("Exclude the given network device(s) (separated by a blank or comma) from firewall rules.<br>Current client devices: <code>$str_clients</code><br>The access point <code>". $ap_device ."</code> is per default excluded.") ?></small>
</p>
</div>
</div>
<h5><?php echo _("Exception: IP-Address"); ?></h4>
<div class="row">
<div class="form-group col-md-6">
<label for="excluded-ips"><?php echo _("Allow incoming connections from") ?></label>
<input class="form-control" id="excluded-ips" type="text" name="excluded-ips" value="<?php echo $fw_conf["excluded-ips"] ?>" aria-describedby="excl-ips-description" >
<p class="mb-0" id="excl-ips-description">
<small><?php echo _("For the given IP-addresses (separated by a blank or comma) the incoming connection (via TCP and UDP) is accepted.<br>This is required for an OpenVPN via UDP or Wireguard connection.") ?></small>
<small><?php if ( !empty($vpn_ips) ) echo _("<br>The list of configured VPN server IP addresses: <code>". $vpn_ips. "</code>") ?></small>
</p> </p>
</div> </div>
</div> </div>