if (( $# != 1 )); then
usage 1
fi
+
+start() {
+ iptables_op=-A
+ ip_op=add
+ # systemd around stretch release time, would wait until openvpn actually connected,
+ # so this was unnecessary, but now it returns immediately.
+ found=false
+ for ((i=1; i<=30; i++)); do
+ tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
+ if [[ $tun_dev == tun* ]]; then
+ found=true
+ break
+ fi
+ sleep 1
+ done
+ if ! $found; then
+ echo "$0: error: timeout waiting for valid tun_dev, currently:$tun_dev"
+ exit 1
+ fi
+ e() { "$@"; }
+ _errcatch_cleanup=stop
+ modify
+}
+stop() {
+ iptables_op=-D
+ ip_op=del
+ tun_dev=$(iptables -t nat -S | sed -rn "s/^-A POSTROUTING -o (tun[[:digit:]]+) -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4$/\1/p"|head -n1) || printf "failed to find tun device.\n"
+ e() { "$@" || printf "maybe ok failure: %s\n" "$*"; }
+ modify
+}
+
+show() {
+ e() { printf "${0##*/}: %s\n" "$*"; "$@"; }
+ e iptables -t mangle -S
+ e iptables -t nat -S
+ e ip rule
+ e ip route show table 1
+
+ tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
+ if [[ $tun_dev == tun* ]]; then
+ e sysctl net.ipv4.conf.$tun_dev.rp_filter
+ else
+ echo "$0: note, no tun device found"
+ fi
+ exit 0
+}
+
+
+# code common to start and stop.
+modify() {
+ # match source or dest port. note, when we send to a port, it picks a random high port as
+ # the source.
+ for port in 25 143; do # smtp and imap.
+ e iptables -t mangle $iptables_op \
+ OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark 0x1
+ e iptables -t mangle $iptables_op \
+ OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark 0x0 \
+ -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+ # note, we could have used a custom chain and returned instead of setting the mark again.
+ # in case anyone was ever curious, the inverse of private ips is: #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
+
+ done
+ e iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
+ e ip rule $ip_op fwmark 1 table 1
+ # note, this rule does not persist when the tun interface is deleted
+ e ip route $ip_op default via 10.8.0.1 table 1
+
+ # on debian this is 0 (no filter), on ubuntu it\'s 1, which is no good. 0 or 2 both work fine.
+ # 2 drops it if the packet is not routable, martian address, or my default route is screwed up,
+ # so, eh, might as well. some rhel docs recommend using it.
+ e sysctl net.ipv4.conf.$tun_dev.rp_filter=2
+
+ exit 0
+}
+
case $1 in
- start)
- iptables_op=-A
- ip_op=add
- # systemd around stretch release time, would wait until openvpn actually connected,
- # so this was unnecessary, but now it returns immediately.
- while true; do
- tun_dev=$(ip a show to 10.8.0.4/24 | sed -rn '1s/^\S+\s+([^:]+).*/\1/p')
- if [[ $tun_dev == tun* ]]; then
- break
- fi
- echo "$0: waiting for tun_dev, found: $tun_dev"
- sleep 4
- done
- e() { "$@"; }
- ;;
- stop)
- iptables_op=-D
- ip_op=del
- tun_dev=$(iptables -t nat -S | sed -rn "s/^-A POSTROUTING -o (tun[[:digit:]]+) -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4$/\1/p"|head -n1) || printf "failed to find tun device.\n"
- e() { "$@" || printf "maybe ok failure: %s\n" "$*"; }
- ;;
- show)
- e() { printf "${0##*/}: %s\n" "$*"; "$@"; }
- e iptables -t mangle -S
- e iptables -t nat -S
- e ip rule
- e ip route show table 1
- exit 0
- ;;
- *)
- usage 1
- ;;
+ start|stop|show) $1 ;;
+ *) usage 1 ;;
esac
-# note, something like this does not work for packets which
+# background: something like this does not work for packets which
# exim is replying to. I don't know why.
#iptables -t mangle -A OUTPUT -m owner --uid-owner Debian-exim -j MARK --set-mark 0x1
-
-# match source or dest port. when we send to 25, it picks a random high port as
-# the source.
-
-for port in 25 143; do # smtp and imap.
- e iptables -t mangle $iptables_op \
- OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark 0x1
- e iptables -t mangle $iptables_op \
- OUTPUT -m tcp -p tcp -m multiport --ports $port -j MARK --set-mark 0x0 \
- -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
- # note, we could have used a custom chain and returned instead of setting the mark again.
- # in case anyone was ever curious, the inverse of private ips is: #0.0.0.0/5,8.0.0.0/7,11.0.0.0/8,12.0.0.0/6,16.0.0.0/4,32.0.0.0/3,64.0.0.0/2,128.0.0.0/3,160.0.0.0/5,168.0.0.0/6,172.0.0.0/12,172.32.0.0/11,172.64.0.0/10,172.128.0.0/9,173.0.0.0/8,174.0.0.0/7,176.0.0.0/4,192.0.0.0/9,192.128.0.0/11,192.160.0.0/13,192.169.0.0/16,192.170.0.0/15,192.172.0.0/14,192.176.0.0/12,192.192.0.0/10,193.0.0.0/8,194.0.0.0/7,196.0.0.0/6,200.0.0.0/5,208.0.0.0/4,224.0.0.0/3
-
-done
-e iptables -t nat $iptables_op POSTROUTING -o $tun_dev -m mark --mark 0x1 -j SNAT --to-source 10.8.0.4
-e ip rule $ip_op fwmark 1 table 1
-# note, this rule does not persist when the tun interface is deleted
-e ip route $ip_op default via 10.8.0.1 table 1
-
-exit 0
iankelling.org / git / distro-setup / blobdiff