revert to 267 + zachovana oprava #include <stdio.h> v utils.h
[svn/Prometheus-QoS/.git] / optional-tools / make-iptables-restore
CommitLineData
86d37066 1#!/bin/bash
4deb2d6f 2# $Id: make-iptables-restore 172 2012-05-13 16:10:52Z aquarius $
86d37066 3iptables="/sbin/iptables"
4iptablesrestore="/sbin/iptables-restore"
f2893be6 5ifconfig="/sbin/ifconfig"
6grep="/bin/grep"
7cut="/usr/bin/cut"
1fcbc04f 8ipcalc="/usr/bin/ipcalc"
86d37066 9
10#pimp files must be generated by optional-tools/make-pimp utility
3a4fe273 11pimp_2way_nat="/dev/shm/pimp-2way-nat.tmp"
12pimp_snat="/dev/shm/pimp-snat.tmp"
86d37066 13etchosts="/mnt/mtdblock0/hosts"
3a4fe273 14restoretmp="/dev/shm/iptables-restore.tmp"
86d37066 15restoredata="/mnt/mtdblock0/iptables-restore.in"
16wan1="vlan770"
17wan2="vlan771"
18wan3="vlan772"
3a4fe273 19wan4="vlan774"
20czffirstbitmask="19"
21czfsecondbitmask="22"
22czfthirdbitmask="25"
23czffourthbitmask="28"
24pubfirstbitmask="26"
25pubsecondbitmask="29"
1fcbc04f 26chaintrack="_"
f1bba845 27
3a4fe273 28echo "*nat" > $restoretmp
29echo ":PREROUTING ACCEPT [0:0]" >> $restoretmp
30echo ":POSTROUTING ACCEPT [0:0]" >> $restoretmp
31echo ":OUTPUT ACCEPT [0:0]" >> $restoretmp
86d37066 32
33# ===============================================================
34# Symetrical SNAT-DNAT using indexed iptables
35# ===============================================================
f2893be6 36echo -n "Generating new iptables-restore data - two way SNAT/DNAT "
f1bba845 37
f2893be6 38for czfip in `$grep -v ^# $pimp_2way_nat|$cut -f 1 -d " "`
39do
40 pubip=`$grep "$czfip " $pimp_2way_nat|$cut -f 2 -d " "`
1fcbc04f 41 czffirstindex=priv_`$ipcalc -n $czfip/$czffirstbitmask|$grep Network|$cut -f 4 -d \ |tr [./] _`
42 czfsecondindex=priv_`$ipcalc -n $czfip/$czfsecondbitmask|$grep Network|$cut -f 4 -d \ |tr [./] _`
43 czfthirdindex=priv_`$ipcalc -n $czfip/$czfthirdbitmask|$grep Network|$cut -f 4 -d \ |tr [./] _`
44 czffourthindex=priv_`$ipcalc -n $czfip/$czffourthbitmask|$grep Network|$cut -f 4 -d \ |tr [./] _`
45 pubfirstindex=pub_`$ipcalc -n $pubip/$pubfirstbitmask|$grep Network|$cut -f 4 -d \ |tr [./] _`
46 pubsecondindex=pub_`$ipcalc -n $pubip/$pubsecondbitmask|$grep Network|$cut -f 4 -d \ |tr [./] _`
47
48 if ! [[ "$chaintrack" == *"$czffirstindex"* ]]
86d37066 49 then
3a4fe273 50 echo :$czffirstindex "- [0:0]" >> $restoretmp
1fcbc04f 51 s=`$ipcalc -n $czfip/$czffirstbitmask|$grep Network|$cut -f 4 -d \ `
52 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan1 -j $czffirstindex >> $restoretmp
53 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan2 -j $czffirstindex >> $restoretmp
54 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan3 -j $czffirstindex >> $restoretmp
55 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan4 -j $czffirstindex >> $restoretmp
56 chaintrack=\ ${czffirstindex}\ ${chaintrack}
86d37066 57 fi
58
1fcbc04f 59 if ! [[ "$chaintrack" == *"$czfsecondindex"* ]]
86d37066 60 then
3a4fe273 61 echo :$czfsecondindex "- [0:0]" >> $restoretmp
1fcbc04f 62 s=`$ipcalc -n $czfip/$czfsecondbitmask|$grep Network|$cut -f 4 -d \ `
63 echo -A $czffirstindex -s $s -o $wan1 -j $czfsecondindex >> $restoretmp
64 echo -A $czffirstindex -s $s -o $wan2 -j $czfsecondindex >> $restoretmp
65 echo -A $czffirstindex -s $s -o $wan3 -j $czfsecondindex >> $restoretmp
66 echo -A $czffirstindex -s $s -o $wan4 -j $czfsecondindex >> $restoretmp
67 chaintrack=\ ${czfsecondindex}\ ${chaintrack}
86d37066 68 fi
69
1fcbc04f 70 if ! [[ "$chaintrack" == *"$czfthirdindex"* ]]
86d37066 71 then
3a4fe273 72 echo :$czfthirdindex "- [0:0]" >> $restoretmp
1fcbc04f 73 s=`$ipcalc -n $czfip/$czfthirdbitmask|$grep Network|$cut -f 4 -d \ `
74 echo -A $czfsecondindex -s $s -o $wan1 -j $czfthirdindex >> $restoretmp
75 echo -A $czfsecondindex -s $s -o $wan2 -j $czfthirdindex >> $restoretmp
76 echo -A $czfsecondindex -s $s -o $wan3 -j $czfthirdindex >> $restoretmp
77 echo -A $czfsecondindex -s $s -o $wan4 -j $czfthirdindex >> $restoretmp
78 chaintrack=\ ${czfthirdindex}\ ${chaintrack}
86d37066 79 fi
80
1fcbc04f 81 if ! [[ "$chaintrack" == *"$czffourthindex"* ]]
86d37066 82 then
3a4fe273 83 echo :$czffourthindex "- [0:0]" >> $restoretmp
1fcbc04f 84 s=`$ipcalc -n $czfip/$czffourthbitmask|$grep Network|$cut -f 4 -d \ `
85 echo -A $czfthirdindex -s $s -o $wan1 -j $czffourthindex >> $restoretmp
86 echo -A $czfthirdindex -s $s -o $wan2 -j $czffourthindex >> $restoretmp
87 echo -A $czfthirdindex -s $s -o $wan3 -j $czffourthindex >> $restoretmp
88 echo -A $czfthirdindex -s $s -o $wan4 -j $czffourthindex >> $restoretmp
89 chaintrack=\ ${czffourthindex}\ ${chaintrack}
86d37066 90 fi
91
1fcbc04f 92 if ! [[ "$chaintrack" == *"$pubfirstindex"* ]]
86d37066 93 then
3a4fe273 94 echo :$pubfirstindex "- [0:0]" >> $restoretmp
1fcbc04f 95 s=`$ipcalc -n $pubip/$pubfirstbitmask|$grep Network|$cut -f 4 -d \ `
96 echo -A PREROUTING -i $wan1 -d $s -j $pubfirstindex >> $restoretmp
97 echo -A PREROUTING -i $wan2 -d $s -j $pubfirstindex >> $restoretmp
98 echo -A PREROUTING -i $wan3 -d $s -j $pubfirstindex >> $restoretmp
99 echo -A PREROUTING -i $wan4 -d $s -j $pubfirstindex >> $restoretmp
100 chaintrack=\ ${pubfirstindex}\ ${chaintrack}
86d37066 101 fi
102
1fcbc04f 103 if ! [[ "$chaintrack" == *"$pubsecondindex"* ]]
3a4fe273 104 then
105 echo :$pubsecondindex "- [0:0]" >> $restoretmp
1fcbc04f 106 s=`$ipcalc -n $pubip/$pubsecondbitmask|$grep Network|$cut -f 4 -d \ `
107 echo -A $pubfirstindex -i $wan1 -d $s -j $pubsecondindex >> $restoretmp
108 echo -A $pubfirstindex -i $wan2 -d $s -j $pubsecondindex >> $restoretmp
109 echo -A $pubfirstindex -i $wan3 -d $s -j $pubsecondindex >> $restoretmp
110 echo -A $pubfirstindex -i $wan4 -d $s -j $pubsecondindex >> $restoretmp
111 chaintrack=\ ${pubsecondindex}\ ${chaintrack}
3a4fe273 112 fi
86d37066 113
3a4fe273 114 echo -A $pubsecondindex -i $wan1 -d $pubip/32 -j DNAT --to-destination $czfip >> $restoretmp
115 echo -A $pubsecondindex -i $wan2 -d $pubip/32 -j DNAT --to-destination $czfip >> $restoretmp
116 echo -A $pubsecondindex -i $wan3 -d $pubip/32 -j DNAT --to-destination $czfip >> $restoretmp
117 echo -A $pubsecondindex -i $wan4 -d $pubip/32 -j DNAT --to-destination $czfip >> $restoretmp
86d37066 118
3a4fe273 119 echo -A $czffourthindex -s $czfip/32 -o $wan1 -j SNAT --to-source $pubip >> $restoretmp
120 echo -A $czffourthindex -s $czfip/32 -o $wan2 -j SNAT --to-source $pubip >> $restoretmp
121 echo -A $czffourthindex -s $czfip/32 -o $wan3 -j SNAT --to-source $pubip >> $restoretmp
122 echo -A $czffourthindex -s $czfip/32 -o $wan4 -j SNAT --to-source $pubip >> $restoretmp
86d37066 123
124 echo -n .
1fcbc04f 125
f2893be6 126done
86d37066 127echo " done."
128
86d37066 129# ===============================================================
130# SNAT only using indexed iptables (should be rather function, hmm)
131# ===============================================================
1fcbc04f 132echo -n "Generating new iptables-restore data - one way SNAT "
86d37066 133
f2893be6 134for czfip in `$grep -v ^# $pimp_snat|$cut -f 1 -d " "`
135do
136 pubip=`$grep "$czfip " $pimp_snat|$cut -f 2 -d " "`
1fcbc04f 137 czffirstindex=priv_`$ipcalc -n $czfip/$czffirstbitmask|$grep Network|$cut -f 4 -d \ |tr [./] _`
138 czfsecondindex=priv_`$ipcalc -n $czfip/$czfsecondbitmask|$grep Network|$cut -f 4 -d \ |tr [./] _`
139 czfthirdindex=priv_`$ipcalc -n $czfip/$czfthirdbitmask|$grep Network|$cut -f 4 -d \ |tr [./] _`
140 czffourthindex=priv_`$ipcalc -n $czfip/$czffourthbitmask|$grep Network|$cut -f 4 -d \ |tr [./] _`
3a4fe273 141
1fcbc04f 142 if ! [[ "$chaintrack" == *"$czffirstindex"* ]]
3a4fe273 143 then
144 echo :$czffirstindex "- [0:0]" >> $restoretmp
1fcbc04f 145 s=`$ipcalc -n $czfip/$czffirstbitmask|$grep Network|$cut -f 4 -d \ `
146 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan1 -j $czffirstindex >> $restoretmp
147 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan2 -j $czffirstindex >> $restoretmp
148 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan3 -j $czffirstindex >> $restoretmp
149 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan4 -j $czffirstindex >> $restoretmp
150 chaintrack=\ ${czffirstindex}\ ${chaintrack}
3a4fe273 151 fi
86d37066 152
1fcbc04f 153 if ! [[ "$chaintrack" == *"$czfsecondindex"* ]]
86d37066 154 then
3a4fe273 155 echo :$czfsecondindex "- [0:0]" >> $restoretmp
1fcbc04f 156 s=`$ipcalc -n $czfip/$czfsecondbitmask|$grep Network|$cut -f 4 -d \ `
157 echo -A $czffirstindex -s $s -o $wan1 -j $czfsecondindex >> $restoretmp
158 echo -A $czffirstindex -s $s -o $wan2 -j $czfsecondindex >> $restoretmp
159 echo -A $czffirstindex -s $s -o $wan3 -j $czfsecondindex >> $restoretmp
160 echo -A $czffirstindex -s $s -o $wan4 -j $czfsecondindex >> $restoretmp
161 chaintrack=\ ${czfsecondindex}\ ${chaintrack}
86d37066 162 fi
163
1fcbc04f 164 if ! [[ "$chaintrack" == *"$czfthirdindex"* ]]
86d37066 165 then
3a4fe273 166 echo :$czfthirdindex "- [0:0]" >> $restoretmp
1fcbc04f 167 s=`$ipcalc -n $czfip/$czfthirdbitmask|$grep Network|$cut -f 4 -d \ `
168 echo -A $czfsecondindex -s $s -o $wan1 -j $czfthirdindex >> $restoretmp
169 echo -A $czfsecondindex -s $s -o $wan2 -j $czfthirdindex >> $restoretmp
170 echo -A $czfsecondindex -s $s -o $wan3 -j $czfthirdindex >> $restoretmp
171 echo -A $czfsecondindex -s $s -o $wan4 -j $czfthirdindex >> $restoretmp
172 chaintrack=\ ${czfthirdindex}\ ${chaintrack}
86d37066 173 fi
174
1fcbc04f 175 if ! [[ "$chaintrack" == *"$czffourthindex"* ]]
86d37066 176 then
3a4fe273 177 echo :$czffourthindex "- [0:0]" >> $restoretmp
1fcbc04f 178 s=`$ipcalc -n $czfip/$czffourthbitmask|$grep Network|$cut -f 4 -d \ `
179 echo -A $czfthirdindex -s $s -o $wan1 -j $czffourthindex >> $restoretmp
180 echo -A $czfthirdindex -s $s -o $wan2 -j $czffourthindex >> $restoretmp
181 echo -A $czfthirdindex -s $s -o $wan3 -j $czffourthindex >> $restoretmp
182 echo -A $czfthirdindex -s $s -o $wan4 -j $czffourthindex >> $restoretmp
183 chaintrack=\ ${czffourthindex}\ ${chaintrack}
86d37066 184 fi
185
3a4fe273 186 echo -A $czffourthindex -s $czfip/32 -o $wan1 -j SNAT --to-source $pubip >> $restoretmp
187 echo -A $czffourthindex -s $czfip/32 -o $wan2 -j SNAT --to-source $pubip >> $restoretmp
188 echo -A $czffourthindex -s $czfip/32 -o $wan3 -j SNAT --to-source $pubip >> $restoretmp
189 echo -A $czffourthindex -s $czfip/32 -o $wan4 -j SNAT --to-source $pubip >> $restoretmp
86d37066 190
191 echo -n .
f2893be6 192done
86d37066 193echo " done."
194
3a4fe273 195echo COMMIT >> $restoretmp
1fcbc04f 196echo -n "Writing $restoredata"
143c9a45 197mv $restoretmp $restoredata
This page took 0.655441 seconds and 4 git commands to generate.