- # match source or dest port. note, when we send to a port, it picks a random high port as
- # the source.
- for port in 25 143; do # smtp and imap.
- e iptables -t mangle $iptables_op \
- OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark 0x1
- e iptables -t mangle $iptables_op \
- OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark 0x0 \
- -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
- # note, we could have used a custom chain and returned instead of setting the mark again.
- # in case anyone was ever curious, the inverse of private ips is: #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
+ # match source or dest port. note, when we send to a port, it picks a random high port as
+ # the source.
+
+ iptcommon="OUTPUT -m tcp -p tcp -m multiport --ports 25,143,587 -j MARK --set-mark"
+ iptmod iptables -t mangle $iptables_op $iptcommon 0x1
+ iptmod iptables -t mangle $iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8
+ # note, we could have used a custom chain and returned instead of setting the mark again.
+ # in case anyone was ever curious, the inverse of private ips is: #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
+ iptmod ip6tables -t mangle $iptables_op $iptcommon 0x1 -d 2000::/3
+
+ if [[ $tun_dev ]]; then
+ # when $tun_dev goes away, so does this rule.
+ iptmod iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
+ iptmod ip6tables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 2600:3c00:e000:280::2
+
+ fi
+
+
+ iprulecmd="fwmark 1 table 1"
+ for v in -4 -6; do
+ exists=true; ip $v rule show $iprulecmd | grep . &>/dev/null || exists=false
+ if runtest; then e ip $v rule $ip_op $iprulecmd; fi
+ done
+
+ iproutecmd="default via 10.8.0.1 table 1"
+ exists=true; ip route show $iproutecmd | grep . &>/dev/null || exists=false
+ if runtest; then e ip route $ip_op $iproutecmd; fi
+ if [[ $tun_dev ]]; then
+ # when $tun_dev goes away, so does this route.
+ iproutecmd="default dev $tun_dev table 1"
+ exists=true; ip -6 route show $iproutecmd | grep . &>/dev/null || exists=false
+ if runtest; then e ip -6 route $ip_op $iproutecmd; fi
+
+ # We could only do this if we dont have a default route with [[ ! $(ip -6 r show default) ]] but
+ # metric seems to be perfectly good. 6000 because on my home comp,
+ # its about 6 times slower to ping google, than the default 1024 metric.
+ iproutecmd="default dev $tun_dev"
+ exists=true; ip -6 route show $iproutecmd | grep . &>/dev/null || exists=false
+ if runtest; then e ip -6 route $ip_op $iproutecmd metric 6000; fi
+ fi
+ # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
+ # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
+ # so, eh, might as well. some rhel docs recommend using it.