2 # Copyright (C) 2016 Ian Kelling
4 # Licensed under the Apache License, Version 2.0 (the "License");
5 # you may not use this file except in compliance with the License.
6 # You may obtain a copy of the License at
8 # http://www.apache.org/licenses/LICENSE-2.0
10 # Unless required by applicable law or agreed to in writing, software
11 # distributed under the License is distributed on an "AS IS" BASIS,
12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 # See the License for the specific language governing permissions and
14 # limitations under the License.
16 [[ $EUID == 0 ]] ||
exec sudo
"$BASH_SOURCE" "$@"
18 source /a
/bin
/errhandle
/errcatch-function
19 source /a
/bin
/errhandle
/errallow-function
20 source /a
/bin
/errhandle
/bash-trace-function
25 Usage: mail-route start|stop|show
27 Marks tcp packets on port 25 and 143 to be routed through
33 if (( $# != 1 )); then
40 # systemd around stretch release time, would wait until openvpn actually connected,
41 # so this was unnecessary, but now it returns immediately.
43 for ((i
=1; i
<=30; i
++)); do
44 tun_dev
=$
(ip a show to
10.8.0.4/24 |
sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
45 if [[ $tun_dev == tun
* ]]; then
52 echo "$0: error: timeout waiting for valid tun_dev, currently:$tun_dev"
56 _errcatch_cleanup
=stop
62 tun_dev
=$
(iptables
-t nat
-S |
sed -rn "s/^-A POSTROUTING -o (tun[[:digit:]]+) -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4$/\1/p"|
head -n1) ||
printf "failed to find tun device.\n"
63 e
() { "$@" ||
printf "maybe ok failure: %s\n" "$*"; }
68 e
() { printf "${0##*/}: %s\n" "$*"; "$@"; }
69 e iptables
-t mangle
-S
72 e ip route show table
1
74 tun_dev
=$
(ip a show to
10.8.0.4/24 |
sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
75 if [[ $tun_dev == tun
* ]]; then
76 e sysctl net.ipv4.conf.
$tun_dev.rp_filter
78 echo "$0: note, no tun device found"
84 # code common to start and stop.
86 # match source or dest port. note, when we send to a port, it picks a random high port as
88 for port
in 25 143; do # smtp and imap.
89 e iptables
-t mangle
$iptables_op \
90 OUTPUT
-m tcp
-p tcp
-m multiport
--ports $port -j MARK
--set-mark 0x1
91 e iptables
-t mangle
$iptables_op \
92 OUTPUT
-m tcp
-p tcp
-m multiport
--ports $port -j MARK
--set-mark 0x0 \
93 -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
94 # note, we could have used a custom chain and returned instead of setting the mark again.
95 # in case anyone was ever curious, the inverse of private ips is: #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
98 e iptables
-t nat
$iptables_op POSTROUTING
-o $tun_dev -m mark
--mark 0x1 -j SNAT
--to-source 10.8.0.4
99 e ip rule
$ip_op fwmark
1 table
1
100 # note, this rule does not persist when the tun interface is deleted
101 e ip route
$ip_op default via
10.8.0.1 table
1
103 # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
104 # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
105 # so, eh, might as well. some rhel docs recommend using it.
106 e sysctl net.ipv4.conf.
$tun_dev.rp_filter
=2
112 start|stop|show
) $1 ;;
117 # background: something like this does not work for packets which
118 # exim is replying to. I don't know why.
119 #iptables -t mangle -A OUTPUT -m owner --uid-owner Debian-exim -j MARK --set-mark 0x1