#!/bin/bash # Copyright (C) 2016 Ian Kelling # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # http://www.apache.org/licenses/LICENSE-2.0 # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. [[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@" #set -x #exec &> >(logger) source /a/bin/errhandle/err usage() { cat <<'EOF' Usage: mail-route up|down|show Marks tcp packets on port 25, 143 and 587 to be routed through a vpn ip. If called from --up/--down in openvpn, (we have multiple args) $1 is the tun_dev, and action is from $script_type env variable, openvpn sets this. It is idempotent. I'm not using this script currently: The problem with this approach is that if we dont have a non-vpn global ipv6 address and route, we need to send all ipv6 traffic through the vpn. Using a network namespace for the vpn fixes that, so I've switched over to that. We could still use this script inside the network namespace, and I have tested it, but it is just unneeded complexity. Simpler to just have a default route to the vpn. This script does separate out lan ip ranges for ipv4, but we could also do that with a simple route. EOF exit $1 } if (( $# < 1 )); then usage 1 fi up() { start=true stop=false iptables_op=-A ip_op=add timeout_secs=20 if [[ ! $tun_dev ]]; then # delays because I was running this outside of openvpn before found=false for ((i=1; i<=timeout_secs; i++)); do tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p') if [[ $tun_dev == tun* ]]; then found=true break fi sleep 1 done if ! $found; then echo "$0: error: timeout after $timeout_secs waiting for valid tun_dev, currently:$tun_dev" exit 1 fi fi e() { echo "$0: $*"; "$@"; } err-cleanup() { stop; } modify # we leave it as is even when stopping, because we would like it to be default, but the only way # to change the default is for every device, and I want to avoid that, even though I wouldn't mind, others users of this script might. val=$(sysctl -n net.ipv4.conf.$tun_dev.rp_filter) if [[ $val != 2 ]]; then echo "net.ipv4.conf.$tun_dev.rp_filter = $val" e sysctl net.ipv4.conf.$tun_dev.rp_filter=2 fi } down() { start=false stop=true iptables_op=-D ip_op=del # note, this is not going to work if the interface has been deleted. # we could also check for an iptable rule that on some tun interface like the one # we use, but meh, the way I'm using the script now, tun_dev is supplied by openvpn if [[ ! $tun_dev ]]; then tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p') fi e() { echo "$0: $*"; "$@" || printf "maybe ok failure: %s\n" "$*"; } modify } show() { e() { printf "=================================\n# %s\n\n" "$*"; "$@"; } e iptables -t mangle -S e ip6tables -t mangle -S e iptables -t nat -S e ip rule e ip -6 rule e ip route show table 1 e ip -6 route show table 1 e ip -6 route show default tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p') if [[ $tun_dev == tun* ]]; then e sysctl net.ipv4.conf.$tun_dev.rp_filter else echo "$0: note, no tun device found" fi exit 0 } runtest() { # debugging: #echo start=$start stop=$stop exists=$exists { $start && ! $exists; } || { $stop && $exists; } } iptmod() { #iptables modify local cmd="$*" local exists=true ${cmd/-[AD]/-C} &>/dev/null || exists=false if runtest; then e $cmd; fi } # code common to start and stop. modify() { # match source or dest port. note, when we send to a port, it picks a random high port as # the source. if [[ $HOSTNAME == bk ]]; then ports=25 ipsuf=5 else ports=25,143,587 ipsuf=4 fi iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports $ports -j MARK --set-mark" iptmod iptables -t mangle $iptables_op $iptcommon 0x1 iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8 # note, we could have used a custom chain and returned instead of setting the mark again. # in case anyone was ever curious, the inverse of private ips is: #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3 iptmod ip6tables -t mangle $iptables_op $iptcommon 0x1 -d 2000::/3 if [[ $tun_dev ]]; then # when $tun_dev goes away, so does this rule. iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.$ipsuf iptmod ip6tables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 2600:3c00:e002:3800::$ipsuf fi iprulecmd="fwmark 1 table 1" for v in -4 -6; do exists=true; ip $v rule show $iprulecmd | grep . &>/dev/null || exists=false if runtest; then e ip $v rule $ip_op $iprulecmd; fi done iproutecmd="default via 10.8.0.1 table 1" exists=true; ip route show $iproutecmd 2>/dev/null | grep . &>/dev/null || exists=false if runtest; then e ip route $ip_op $iproutecmd; fi if [[ $tun_dev ]]; then # when $tun_dev goes away, so does this route. iproutecmd="default dev $tun_dev table 1" exists=true; ip -6 route show $iproutecmd | grep . &>/dev/null || exists=false if runtest; then e ip -6 route $ip_op $iproutecmd; fi # We have to ensure we have a normal default ipv6 route, or else linux will # refuse to do send ipv6 packets at all. When running in a network namespace, # having the table 1 route is totally redundant since I dont setup a # normal default ipv6 route. But maybe I will someday. # # We could only do this if we dont have a default route with [[ ! $(ip -6 r show default) ]] but # metric seems to be perfectly good. 6000 because on my home comp, # its about 6 times slower to ping google than the default 1024 metric. # See commit 572dd5847440e58481ee2d7b9080 for using an ipv6 test. iproutecmd="default dev $tun_dev" exists=true; ip -6 route show $iproutecmd | grep . &>/dev/null || exists=false if runtest; then e ip -6 route $ip_op $iproutecmd metric 6000; fi fi # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine. # 2 drops it if the packet is not routable, martian address, or my default route is screwed up, # so, eh, might as well. some rhel docs recommend using it. } if (( $# > 1 )); then tun_dev=$1 # environment var from openvpn # shellcheck disable=SC2154 $script_type else case $1 in up|down|show) $1 ;; *) usage 1 ;; esac fi exit 0 # background: something like this does not work for packets which # exim is replying to. I don't know why. #iptables -t mangle -A OUTPUT -m owner --uid-owner Debian-exim -j MARK --set-mark 0x1 # # note: exim will misreport the I= interface for remote hosts that would # not use the default route. It still goes through the vpn, you can # verify with tcpdump.