#!/usr/bin/perl -U

### Firewall control perl script drived by opengatesrv.cgi ###
###   (In default this script is disabled. See opengatesrv.conf.)
###   (Consider setting by ipfw rule or opengatesrv.conf before use this)

($ipfwpath,$rulenumber,$clientaddr,$userid,$macaddr,$userproperty,$ipfwtagnumber,$interface)=@ARGV;
close STDOUT; close STDERR; close STDIN;


## add ipfw rules
system "$ipfwpath","-q","add","$rulenumber",
    "count","tag","$ipfwtagnumber","ip","from","any","to","any",
    "MAC", "any", "$macaddr", "via", "$interface", "keep-state";

system "$ipfwpath","-q","add","$rulenumber",
    "count","tag","$ipfwtagnumber","ip","from","any","to","any",
    "MAC", "$macaddr", "any", "via", "$interface", "keep-state";

exit 0;

__END__

########### Above line is the end of interpreting#############

                  PARAMETERS

 $ipfwpath  = path to ipfw command
 $rulenumber= ipfw rule number. one number for one client
 $clientaddr= client machine's IP address
 $userid    = user's ID.  Auth server ID is attached(usr@svr), if entered.
 $macaddr   = MAC address for the client machine
 $interface = Network interface card name

                   CAUTIONS

*Be care to execute quickly and without delay. 
 This script runs in EXCLUSIVE mode. 

*Be care to add least rule set. 
 The rules are added PER each client. 

*Be care to eliminate bug and security hole.
 At modification, debug it perfectly in stand along mode.

*If possible, the rule should be written in rc.firewall.
 Following can be written in rc.firewall
  Deny some protocol though authentication passed.
  Allow to access some server without authentication.

*Following might be written in this script.
  Deny guest users to access internal network.
  Deny a client having specific MAC address.
  Forward some service to proxy server after authentication.
  (Last one might be written in rc.firewall as the rule of other 
   side interface which is not used by opengate)

                SIMPLE SCRIPT

If you are confused, return to the following default script.
=====================================================
#!/usr/bin/perl

($ipfwpath,$rulenumber,$clientaddr,$userid,$macaddr,$userproperty,$ipfwtagnumber,$interface)=@ARGV;
close STDOUT; close STDERR; close STDIN;


## add ipfw rules
system "$ipfwpath","-q","add","$rulenumber",
    "count","tag","$ipfwtagnumber","ip","from","any","to","any",
    "MAC", "any", "$macaddr", "via", "$interface", "keep-state";

system "$ipfwpath","-q","add","$rulenumber",
    "count","tag","$ipfwtagnumber","ip","from","any","to","any",
    "MAC", "$macaddr", "any", "via", "$interface", "keep-state";

exit 0;
======================================================

