iankelling.org Git - distro-setup/blob - mail-route

   1 #!/bin/bash
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 [[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@"
  17
  18 source /a/bin/errhandle/errcatch-function
  19 source /a/bin/errhandle/errallow-function
  20 source /a/bin/errhandle/bash-trace-function
  21 errcatch
  22
  23 usage() {
  24     cat <<'EOF'
  25 Usage: mail-route start|stop|show
  26 EOF
  27     exit $1
  28 }
  29
  30 if (( $# != 1 )); then
  31     usage 1
  32 fi
  33 case $1 in
  34     start)
  35         iptables_op=-A
  36         ip_op=add
  37         e() { "$@"; }
  38         ;;
  39     stop)
  40         iptables_op=-D
  41         ip_op=del
  42         e() { "$@" || printf "maybe ok failure: %s\n" "$*"; }
  43         ;;
  44     show)
  45         e() { printf "${0##*/}: %s\n" "$*"; "$@"; }
  46         e iptables -t mangle -S
  47         e iptables -t nat -S
  48         e ip rule
  49         e ip route show table 1
  50         exit 0
  51         ;;
  52     *)
  53         usage 1
  54         ;;
  55 esac
  56
  57
  58 # note, something like this does not work for packets which
  59 # exim is replying to. I don't know why.
  60 #iptables -t mangle -A OUTPUT -m owner --uid-owner Debian-exim -j MARK --set-mark 0x1
  61
  62
  63 e iptables -t mangle $iptables_op OUTPUT -m tcp -p tcp -m multiport --sports 25 -j MARK --set-mark 0x1
  64 e iptables -t nat $iptables_op POSTROUTING -o tun0 -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
  65 e ip rule $ip_op fwmark 1 table 1
  66 # note, this rule does not persist when the tun interface is deleted
  67 e ip route $ip_op default via 10.8.0.1 table 1
  68 e ip route $ip_op 192.168.1.0/24 via 192.168.1.1 dev br0 table 1
  69
  70 exit 0