2 # Copyright (C) 2016 Ian Kelling
3 # Licensed under the Apache License, Version 2.0 (the "License");
4 # you may not use this file except in compliance with the License.
5 # You may obtain a copy of the License at
7 # http://www.apache.org/licenses/LICENSE-2.0
11 # Unless required by applicable law or agreed to in writing, software
12 # distributed under the License is distributed on an "AS IS" BASIS,
13 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 # See the License for the specific language governing permissions and
15 # limitations under the License.
17 [[ $EUID == 0 ]] ||
exec sudo
-E "${BASH_SOURCE[0]}" "$@"
19 source /a
/bin
/errhandle
/err
23 Usage: mail-route up|down|show
25 Marks tcp packets on port 25, 143 and 587 to be routed through
26 a vpn ip. If called from --up/--down in openvpn, (we have multiple args) $1 is the
27 tun_dev, and action is from $script_type.
32 todo: Need to give mail.iankelling.org an ipv6 dns address.
48 if [[ ! $tun_dev ]]; then
49 # delays because I was running this outside of openvpn before
51 for ((i
=1; i
<=timeout_secs
; i
++)); do
52 tun_dev
=$
(ip a show to
10.8.0.4/24 |
sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
53 if [[ $tun_dev == tun
* ]]; then
60 echo "$0: error: timeout after $timeout_secs waiting for valid tun_dev, currently:$tun_dev"
64 e
() { echo "$0: $*"; "$@"; }
65 err-cleanup
() { stop
; }
67 # we leave it as is even when stopping, because we would like it to be default, but the only way
68 # to change the default is for every device, and I want to avoid that, even though I wouldn't mind, others users of this script might.
69 val
=$
(sysctl
-n net.ipv4.conf.
$tun_dev.rp_filter
)
70 if [[ $val != 2 ]]; then
71 echo "net.ipv4.conf.$tun_dev.rp_filter = $val"
72 e sysctl net.ipv4.conf.
$tun_dev.rp_filter
=2
81 # note, this is not going to work if the interface has been deleted.
82 # we could also check for an iptable rule that on some tun interface like the one
83 # we use, but meh, the way I'm using the script now, tun_dev is supplied by openvpn
84 if [[ ! $tun_dev ]]; then
85 tun_dev
=$
(ip a show to
10.8.0.4/24 |
sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
87 e
() { echo "$0: $*"; "$@" ||
printf "maybe ok failure: %s\n" "$*"; }
92 printf "$(tput setaf 5)█$(tput sgr0)%.0s" $
(seq ${COLUMNS:-60});
94 e
() { printf "=================================\n# %s\n\n" "$*"; "$@"; }
95 e iptables
-t mangle
-S
96 e ip6tables
-t mangle
-S
100 e ip route show table
1
101 e ip
-6 route show table
1
102 e ip
-6 route show default
104 tun_dev
=$
(ip a show to
10.8.0.4/24 |
sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
105 if [[ $tun_dev == tun
* ]]; then
106 e sysctl net.ipv4.conf.
$tun_dev.rp_filter
108 echo "$0: note, no tun device found"
115 #echo start=$start stop=$stop exists=$exists
116 { $start && ! $exists; } ||
{ $stop && $exists; }
119 iptmod
() { #iptables modify
122 ${cmd/-[AD]/-C} &>/dev
/null || exists
=false
123 if runtest
; then e
$cmd; fi
126 # code common to start and stop.
128 # match source or dest port. note, when we send to a port, it picks a random high port as
131 iptcommon
="OUTPUT -m tcp -p tcp -m multiport --ports 25,143,587 -j MARK --set-mark"
132 iptmod iptables
-t mangle
$iptables_op $iptcommon 0x1
133 iptmod iptables
-t mangle
$iptables_op $iptcommon 0x0 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.0/8
134 # note, we could have used a custom chain and returned instead of setting the mark again.
135 # in case anyone was ever curious, the inverse of private ips is: #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
136 iptmod ip6tables
-t mangle
$iptables_op $iptcommon 0x1 -d 2000::/3
138 if [[ $tun_dev ]]; then
139 # when $tun_dev goes away, so does this rule.
140 iptmod iptables
-t nat
$iptables_op POSTROUTING
-o $tun_dev -m mark
--mark 0x1 -j SNAT
--to-source 10.8.0.4
141 iptmod ip6tables
-t nat
$iptables_op POSTROUTING
-o $tun_dev -m mark
--mark 0x1 -j SNAT
--to-source 2600:3c00
:e000
:280::2
146 iprulecmd
="fwmark 1 table 1"
148 exists
=true
; ip
$v rule show
$iprulecmd |
grep .
&>/dev
/null || exists
=false
149 if runtest
; then e ip
$v rule
$ip_op $iprulecmd; fi
152 iproutecmd
="default via 10.8.0.1 table 1"
153 exists
=true
; ip route show
$iproutecmd |
grep .
&>/dev
/null || exists
=false
154 if runtest
; then e ip route
$ip_op $iproutecmd; fi
155 if [[ $tun_dev ]]; then
156 # when $tun_dev goes away, so does this route.
157 iproutecmd
="default dev $tun_dev table 1"
158 exists
=true
; ip
-6 route show
$iproutecmd |
grep .
&>/dev
/null || exists
=false
159 if runtest
; then e ip
-6 route
$ip_op $iproutecmd; fi
161 # We could only do this if we dont have a default route with [[ ! $(ip -6 r show default) ]] but
162 # metric seems to be perfectly good. 6000 because on my home comp,
163 # its about 6 times slower to ping google, than the default 1024 metric.
164 iproutecmd
="default dev $tun_dev"
165 exists
=true
; ip
-6 route show
$iproutecmd |
grep .
&>/dev
/null || exists
=false
166 if runtest
; then e ip
-6 route
$ip_op $iproutecmd metric
6000; fi
168 # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
169 # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
170 # so, eh, might as well. some rhel docs recommend using it.
175 if (( $# > 1 )); then
188 # background: something like this does not work for packets which
189 # exim is replying to. I don't know why.
190 #iptables -t mangle -A OUTPUT -m owner --uid-owner Debian-exim -j MARK --set-mark 0x1
192 # note: exim will misreport the I= interface for remote hosts that would
193 # not use the default route. It still goes through the vpn, you can
194 # verify with tcpdump.