+up() {
+ start=true
+ stop=false
+ iptables_op=-A
+ ip_op=add
+ timeout_secs=20
+ if [[ ! $tun_dev ]]; then
+ # delays because I was running this outside of openvpn before
+ found=false
+ for ((i=1; i<=timeout_secs; i++)); do
+ tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
+ if [[ $tun_dev == tun* ]]; then
+ found=true
+ break
+ fi
+ sleep 1
+ done
+ if ! $found; then
+ echo "$0: error: timeout after $timeout_secs waiting for valid tun_dev, currently:$tun_dev"
+ exit 1
+ fi
+ fi
+ e() { echo "$0: $*"; "$@"; }
+ _errcatch_cleanup=stop
+ modify
+ # we leave it as is even when stopping, because we would like it to be default, but the only way
+ # to change the default is for every device, and I want to avoid that, even though I wouldn't mind, others users of this script might.
+ val=$(sysctl -n net.ipv4.conf.$tun_dev.rp_filter)
+ if [[ $val != 2 ]]; then
+ echo "net.ipv4.conf.$tun_dev.rp_filter = $val"
+ e sysctl net.ipv4.conf.$tun_dev.rp_filter=2
+ fi
+
+}
+down() {
+ start=false
+ stop=true
+ iptables_op=-D
+ ip_op=del
+ # note, this is not going to work if the interface has been deleted.
+ # we could also check for an iptable rule that on some tun interface like the one
+ # we use, but meh, the way I'm using the script now, tun_dev is supplied by openvpn
+ if [[ ! tun_dev ]]; then
+ tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
+ fi
+ e() { echo "$0: $*"; "$@" || printf "maybe ok failure: %s\n" "$*"; }
+ modify
+}
+
+show() {
+ e() { printf "${0##*/}: %s\n" "$*"; "$@"; }
+ e iptables -t mangle -S
+ e iptables -t nat -S
+ e ip rule
+ e ip route show table 1
+
+ tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
+ if [[ $tun_dev == tun* ]]; then
+ e sysctl net.ipv4.conf.$tun_dev.rp_filter
+ else
+ echo "$0: note, no tun device found"
+ fi
+ exit 0
+}
+
+runtest() {
+ # debugging:
+ #echo start=$start stop=$stop exists=$exists
+ { $start && ! $exists; } || { $stop && $exists; }
+}
+
+iptmod() { #iptables modify
+ local check cmd="$*" exists=true
+ ${cmd/-[AD]/-C} &>/dev/null || exists=false
+ if runtest; then e $cmd; fi
+}