From 7481a54f89d9fe13bc450bb8035082448b8b2acf Mon Sep 17 00:00:00 2001
From: Kaarle Ritvanen <kaarle.ritvanen@datakunkku.fi>
Date: Fri, 20 Jul 2012 10:15:27 +0000
Subject: disallow dnat option with actions other than accept

---
 awall/modules/filter.lua | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'awall')

diff --git a/awall/modules/filter.lua b/awall/modules/filter.lua
index 5da8f91..07d5df9 100644
--- a/awall/modules/filter.lua
+++ b/awall/modules/filter.lua
@@ -36,6 +36,9 @@ function Filter:trules()
    local res = {}
 
    if self.dnat then
+      if self.action ~= 'accept' then
+	 self:error('dnat option not allowed with '..self.action..' action')
+      end
       if not self.dest then
 	 self:error('Destination address must be specified with DNAT')
       end
-- 
cgit v1.2.3