2 iptables
="/sbin/iptables"
3 iptablesrestore
="/sbin/iptables-restore"
4 ifconfig
="/sbin/ifconfig"
6 #pimp files must be generated by optional-tools/make-pimp utility
7 pimp_2way_nat
="/mnt/mtdblock0/pimp-2way-nat.tmp"
8 pimp_snat
="/mnt/mtdblock0/pimp-snat.tmp"
9 etchosts
="/mnt/mtdblock0/hosts"
10 restoredata
="/mnt/mtdblock0/iptables-restore.in"
13 #just comment-out all lines mentioning wan3 on two-interface gateways
16 echo "*nat" > $restoredata
17 echo ":PREROUTING ACCEPT [0:0]" >> $restoredata
18 echo ":POSTROUTING ACCEPT [0:0]" >> $restoredata
19 echo ":OUTPUT ACCEPT [0:0]" >> $restoredata
21 # ===============================================================
22 # Symetrical SNAT-DNAT using indexed iptables
23 # ===============================================================
25 echo -n "Generating new iptables-restore data - two way SNAT/DNAT "
27 for czfip
in `grep -v ^# $pimp_2way_nat|cut -f 1 -d " "`
29 pubip
=`grep "$czfip " $pimp_2way_nat|cut -f 2 -d " "`
30 czffirstindex
=priv_
`ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ |tr [./] _`
31 czfsecondindex
=priv_
`ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ |tr [./] _`
32 czfthirdindex
=priv_
`ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ |tr [./] _`
33 pubfirstindex
=pub_
`ipcalc -n $pubip/27|grep Network|cut -f 4 -d \ |tr [./] _`
34 pubsecondindex
=pub_
`ipcalc -n $pubip/29|grep Network|cut -f 4 -d \ |tr [./] _`
36 if ! grep $czffirstindex $restoredata > /dev
/null
38 echo :$czffirstindex "- [0:0]" >> $restoredata
39 echo -A POSTROUTING
-d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o $wan1 -j $czffirstindex >> $restoredata
40 echo -A POSTROUTING
-d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o $wan2 -j $czffirstindex >> $restoredata
41 echo -A POSTROUTING
-d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o $wan3 -j $czffirstindex >> $restoredata
44 if ! grep $czfsecondindex $restoredata > /dev
/null
46 echo :$czfsecondindex "- [0:0]" >> $restoredata
47 echo -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o $wan1 -j $czfsecondindex >> $restoredata
48 echo -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o $wan2 -j $czfsecondindex >> $restoredata
49 echo -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o $wan3 -j $czfsecondindex >> $restoredata
52 if ! grep $czfthirdindex $restoredata > /dev
/null
54 echo :$czfthirdindex "- [0:0]" >> $restoredata
55 echo -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o $wan1 -j $czfthirdindex >> $restoredata
56 echo -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o $wan2 -j $czfthirdindex >> $restoredata
57 echo -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o $wan3 -j $czfthirdindex >> $restoredata
60 if ! grep $pubfirstindex $restoredata > /dev
/null
62 echo :$pubfirstindex "- [0:0]" >> $restoredata
63 echo -A PREROUTING
-i $wan1 -d `ipcalc -n $pubip/27|grep Network|cut -f 4 -d \ ` -j $pubfirstindex >> $restoredata
64 echo -A PREROUTING
-i $wan2 -d `ipcalc -n $pubip/27|grep Network|cut -f 4 -d \ ` -j $pubfirstindex >> $restoredata
65 echo -A PREROUTING
-i $wan3 -d `ipcalc -n $pubip/27|grep Network|cut -f 4 -d \ ` -j $pubfirstindex >> $restoredata
68 if ! grep $pubsecondindex $restoredata > /dev
/null
70 echo :$pubsecondindex "- [0:0]" >> $restoredata
71 echo -A $pubfirstindex -i $wan1 -d `ipcalc -n $pubip/29|grep Network|cut -f 4 -d \ ` -j $pubsecondindex >> $restoredata
72 echo -A $pubfirstindex -i $wan2 -d `ipcalc -n $pubip/29|grep Network|cut -f 4 -d \ ` -j $pubsecondindex >> $restoredata
73 echo -A $pubfirstindex -i $wan3 -d `ipcalc -n $pubip/29|grep Network|cut -f 4 -d \ ` -j $pubsecondindex >> $restoredata
76 echo -A $pubsecondindex -i $wan1 -d $pubip/32 -j DNAT
--to-destination $czfip >> $restoredata
77 echo -A $pubsecondindex -i $wan2 -d $pubip/32 -j DNAT
--to-destination $czfip >> $restoredata
78 echo -A $pubsecondindex -i $wan3 -d $pubip/32 -j DNAT
--to-destination $czfip >> $restoredata
79 echo -A $pubsecondindex -i $wan1 -d $pubip/32 -j ACCEPT
>> $restoredata
80 echo -A $pubsecondindex -i $wan2 -d $pubip/32 -j ACCEPT
>> $restoredata
81 echo -A $pubsecondindex -i $wan3 -d $pubip/32 -j ACCEPT
>> $restoredata
84 echo -A $czfthirdindex -s $czfip/32 -o $wan1 -j SNAT
--to-source $pubip >> $restoredata
85 echo -A $czfthirdindex -s $czfip/32 -o $wan2 -j SNAT
--to-source $pubip >> $restoredata
86 echo -A $czfthirdindex -s $czfip/32 -o $wan3 -j SNAT
--to-source $pubip >> $restoredata
87 echo -A $czfthirdindex -s $czfip/32 -o $wan1 -j ACCEPT
>> $restoredata
88 echo -A $czfthirdindex -s $czfip/32 -o $wan2 -j ACCEPT
>> $restoredata
89 echo -A $czfthirdindex -s $czfip/32 -o $wan3 -j ACCEPT
>> $restoredata
95 echo -n "Generating new iptables-restore data - one way SNAT "
97 # ===============================================================
98 # SNAT only using indexed iptables (should be rather function, hmm)
99 # ===============================================================
101 for czfip
in `grep -v ^# $pimp_snat|cut -f 1 -d " "`
103 pubip
=`grep "$czfip " $pimp_snat|cut -f 2 -d " "`
104 czffirstindex
=priv_
`ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ |tr [./] _`
105 czfsecondindex
=priv_
`ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ |tr [./] _`
106 czfthirdindex
=priv_
`ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ |tr [./] _`
108 if ! grep $czffirstindex $restoredata > /dev
/null
110 echo :$czffirstindex "- [0:0]" >> $restoredata
111 echo -A POSTROUTING
-d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o $wan1 -j $czffirstindex >> $restoredata
112 echo -A POSTROUTING
-d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o $wan2 -j $czffirstindex >> $restoredata
113 echo -A POSTROUTING
-d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o $wan3 -j $czffirstindex >> $restoredata
116 if ! grep $czfsecondindex $restoredata > /dev
/null
118 echo :$czfsecondindex "- [0:0]" >> $restoredata
119 echo -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o $wan1 -j $czfsecondindex >> $restoredata
120 echo -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o $wan2 -j $czfsecondindex >> $restoredata
121 echo -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o $wan3 -j $czfsecondindex >> $restoredata
124 if ! grep $czfthirdindex $restoredata > /dev
/null
126 echo :$czfthirdindex "- [0:0]" >> $restoredata
127 echo -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o $wan1 -j $czfthirdindex >> $restoredata
128 echo -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o $wan2 -j $czfthirdindex >> $restoredata
129 echo -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o $wan3 -j $czfthirdindex >> $restoredata
132 echo -A $czfthirdindex -s $czfip/32 -o $wan1 -j SNAT
--to-source $pubip >> $restoredata
133 echo -A $czfthirdindex -s $czfip/32 -o $wan2 -j SNAT
--to-source $pubip >> $restoredata
134 echo -A $czfthirdindex -s $czfip/32 -o $wan3 -j SNAT
--to-source $pubip >> $restoredata
135 echo -A $czfthirdindex -s $czfip/32 -o $wan1 -j ACCEPT
>> $restoredata
136 echo -A $czfthirdindex -s $czfip/32 -o $wan2 -j ACCEPT
>> $restoredata
137 echo -A $czfthirdindex -s $czfip/32 -o $wan3 -j ACCEPT
>> $restoredata
143 echo COMMIT
>> $restoredata
This page took 0.382498 seconds and 4 git commands to generate.