[svn/Prometheus-QoS/.git] / optional-tools / make-iptables-restore

#!/bin/bash
iptables="/sbin/iptables"
iptablesrestore="/sbin/iptables-restore"
ifconfig="/sbin/ifconfig"

#pimp files must be generated by optional-tools/make-pimp utility
pimp_2way_nat="/mnt/mtdblock0/pimp-2way-nat.tmp"
pimp_snat="/mnt/mtdblock0/pimp-snat.tmp"
etchosts="/mnt/mtdblock0/hosts"
restoredata="/mnt/mtdblock0/iptables-restore.in"
wan1="vlan770"
wan2="vlan771"
wan3="vlan772"

echo "*nat" > $restoredata
echo ":PREROUTING ACCEPT [0:0]" >> $restoredata
echo ":POSTROUTING ACCEPT [0:0]" >> $restoredata
echo ":OUTPUT ACCEPT [0:0]" >> $restoredata

# ===============================================================
#  Symetrical SNAT-DNAT using indexed iptables
# ===============================================================

echo -n "Generating new iptables-restore data - two way SNAT/DNAT "

for czfip in `grep -v ^# $pimp_2way_nat|cut -f 1 -d " "`
do
 pubip=`grep "$czfip " $pimp_2way_nat|cut -f 2 -d " "`
 czffirstindex=priv_`ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ |tr [./] _`
 czfsecondindex=priv_`ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ |tr [./] _`
 czfthirdindex=priv_`ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ |tr [./] _`
 pubfirstindex=pub_`ipcalc -n $pubip/27|grep Network|cut -f 4 -d \ |tr [./] _`
 pubsecondindex=pub_`ipcalc -n $pubip/29|grep Network|cut -f 4 -d \ |tr [./] _`

 if ! grep $czffirstindex $restoredata > /dev/null
 then
  echo :$czffirstindex "- [0:0]" >> $restoredata
  echo -A POSTROUTING -d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o $wan1 -j $czffirstindex >> $restoredata
  echo -A POSTROUTING -d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o $wan2 -j $czffirstindex >> $restoredata
  echo -A POSTROUTING -d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o $wan3 -j $czffirstindex >> $restoredata
 fi

 if ! grep $czfsecondindex $restoredata > /dev/null
 then
  echo :$czfsecondindex "- [0:0]" >> $restoredata
  echo -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o $wan1 -j $czfsecondindex >> $restoredata
  echo -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o $wan2 -j $czfsecondindex >> $restoredata
  echo -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o $wan3 -j $czfsecondindex >> $restoredata
 fi

 if ! grep $czfthirdindex $restoredata > /dev/null
 then
  echo :$czfthirdindex "- [0:0]" >> $restoredata
  echo -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o $wan1 -j $czfthirdindex >> $restoredata
  echo -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o $wan2 -j $czfthirdindex >> $restoredata
  echo -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o $wan3 -j $czfthirdindex >> $restoredata
 fi

 if ! grep $pubfirstindex $restoredata > /dev/null
 then
  echo :$pubfirstindex "- [0:0]" >> $restoredata
  echo -A PREROUTING -i $wan1 -d `ipcalc -n $pubip/27|grep Network|cut -f 4 -d \ ` -j $pubfirstindex >> $restoredata
  echo -A PREROUTING -i $wan2 -d `ipcalc -n $pubip/27|grep Network|cut -f 4 -d \ ` -j $pubfirstindex >> $restoredata
  echo -A PREROUTING -i $wan3 -d `ipcalc -n $pubip/27|grep Network|cut -f 4 -d \ ` -j $pubfirstindex >> $restoredata
 fi

 if ! grep $pubsecondindex $restoredata > /dev/null
 then
  echo :$pubsecondindex "- [0:0]" >> $restoredata
  echo -A $pubfirstindex -i $wan1 -d `ipcalc -n $pubip/29|grep Network|cut -f 4 -d \ ` -j $pubsecondindex >> $restoredata
  echo -A $pubfirstindex -i $wan2 -d `ipcalc -n $pubip/29|grep Network|cut -f 4 -d \ ` -j $pubsecondindex >> $restoredata
  echo -A $pubfirstindex -i $wan3 -d `ipcalc -n $pubip/29|grep Network|cut -f 4 -d \ ` -j $pubsecondindex >> $restoredata
 fi

 echo -A $pubsecondindex -i $wan1 -d $pubip/32 -j DNAT --to-destination $czfip >> $restoredata
 echo -A $pubsecondindex -i $wan2 -d $pubip/32 -j DNAT --to-destination $czfip >> $restoredata
 echo -A $pubsecondindex -i $wan3 -d $pubip/32 -j DNAT --to-destination $czfip >> $restoredata
 echo -A $pubsecondindex -i $wan1 -d $pubip/32 -j ACCEPT >> $restoredata
 echo -A $pubsecondindex -i $wan2 -d $pubip/32 -j ACCEPT >> $restoredata
 echo -A $pubsecondindex -i $wan3 -d $pubip/32 -j ACCEPT >> $restoredata


 echo -A $czfthirdindex -s $czfip/32 -o $wan1 -j SNAT --to-source $pubip >> $restoredata
 echo -A $czfthirdindex -s $czfip/32 -o $wan2 -j SNAT --to-source $pubip >> $restoredata
 echo -A $czfthirdindex -s $czfip/32 -o $wan3 -j SNAT --to-source $pubip >> $restoredata
 echo -A $czfthirdindex -s $czfip/32 -o $wan1 -j ACCEPT >> $restoredata
 echo -A $czfthirdindex -s $czfip/32 -o $wan2 -j ACCEPT >> $restoredata
 echo -A $czfthirdindex -s $czfip/32 -o $wan3 -j ACCEPT >> $restoredata

 echo -n .
done
echo " done."

echo -n "Generating new iptables-restore data - one way SNAT "

# ===============================================================
#  SNAT only using indexed iptables (should be rather function, hmm)
# ===============================================================

for czfip in `grep -v ^# $pimp_snat|cut -f 1 -d " "`
do
 pubip=`grep "$czfip " $pimp_snat|cut -f 2 -d " "`
 czffirstindex=priv_`ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ |tr [./] _`
 czfsecondindex=priv_`ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ |tr [./] _`
 czfthirdindex=priv_`ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ |tr [./] _`

 if ! grep $czffirstindex $restoredata > /dev/null
 then
  echo :$czffirstindex "- [0:0]" >> $restoredata
  echo -A POSTROUTING -d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o $wan1 -j $czffirstindex >> $restoredata
  echo -A POSTROUTING -d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o $wan2 -j $czffirstindex >> $restoredata
  echo -A POSTROUTING -d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o $wan3 -j $czffirstindex >> $restoredata
 fi

 if ! grep $czfsecondindex $restoredata > /dev/null
 then
  echo :$czfsecondindex "- [0:0]" >> $restoredata
  echo -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o $wan1 -j $czfsecondindex >> $restoredata
  echo -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o $wan2 -j $czfsecondindex >> $restoredata
  echo -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o $wan3 -j $czfsecondindex >> $restoredata
 fi

 if ! grep $czfthirdindex $restoredata > /dev/null
 then
  echo :$czfthirdindex "- [0:0]" >> $restoredata
  echo -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o $wan1 -j $czfthirdindex >> $restoredata
  echo -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o $wan2 -j $czfthirdindex >> $restoredata
  echo -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o $wan3 -j $czfthirdindex >> $restoredata
 fi

 echo -A $czfthirdindex -s $czfip/32 -o $wan1 -j SNAT --to-source $pubip >> $restoredata
 echo -A $czfthirdindex -s $czfip/32 -o $wan2 -j SNAT --to-source $pubip >> $restoredata
 echo -A $czfthirdindex -s $czfip/32 -o $wan3 -j SNAT --to-source $pubip >> $restoredata
 echo -A $czfthirdindex -s $czfip/32 -o $wan1 -j ACCEPT >> $restoredata
 echo -A $czfthirdindex -s $czfip/32 -o $wan2 -j ACCEPT >> $restoredata
 echo -A $czfthirdindex -s $czfip/32 -o $wan3 -j ACCEPT >> $restoredata

 echo -n .
done
echo " done."

echo COMMIT >> $restoredata
Commit	Line	Data
86d37066	1	#!/bin/bash
	2	iptables="/sbin/iptables"
	3	iptablesrestore="/sbin/iptables-restore"
	4	ifconfig="/sbin/ifconfig"
	5
	6	#pimp files must be generated by optional-tools/make-pimp utility
	7	pimp_2way_nat="/mnt/mtdblock0/pimp-2way-nat.tmp"
	8	pimp_snat="/mnt/mtdblock0/pimp-snat.tmp"
	9	etchosts="/mnt/mtdblock0/hosts"
	10	restoredata="/mnt/mtdblock0/iptables-restore.in"
	11	wan1="vlan770"
	12	wan2="vlan771"
	13	wan3="vlan772"
	14
	15	echo "*nat" > $restoredata
	16	echo ":PREROUTING ACCEPT [0:0]" >> $restoredata
	17	echo ":POSTROUTING ACCEPT [0:0]" >> $restoredata
	18	echo ":OUTPUT ACCEPT [0:0]" >> $restoredata
	19
	20	# ===============================================================
	21	# Symetrical SNAT-DNAT using indexed iptables
	22	# ===============================================================
	23
	24	echo -n "Generating new iptables-restore data - two way SNAT/DNAT "
	25
	26	for czfip in `grep -v ^# $pimp_2way_nat\|cut -f 1 -d " "`
	27	do
	28	pubip=`grep "$czfip " $pimp_2way_nat\|cut -f 2 -d " "`
	29	czffirstindex=priv_`ipcalc -n $czfip/20\|grep Network\|cut -f 4 -d \ \|tr [./] _`
	30	czfsecondindex=priv_`ipcalc -n $czfip/23\|grep Network\|cut -f 4 -d \ \|tr [./] _`
	31	czfthirdindex=priv_`ipcalc -n $czfip/26\|grep Network\|cut -f 4 -d \ \|tr [./] _`
	32	pubfirstindex=pub_`ipcalc -n $pubip/27\|grep Network\|cut -f 4 -d \ \|tr [./] _`
	33	pubsecondindex=pub_`ipcalc -n $pubip/29\|grep Network\|cut -f 4 -d \ \|tr [./] _`
	34
	35	if ! grep $czffirstindex $restoredata > /dev/null
	36	then
	37	echo :$czffirstindex "- [0:0]" >> $restoredata
	38	echo -A POSTROUTING -d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20\|grep Network\|cut -f 4 -d \ ` -o $wan1 -j $czffirstindex >> $restoredata
	39	echo -A POSTROUTING -d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20\|grep Network\|cut -f 4 -d \ ` -o $wan2 -j $czffirstindex >> $restoredata
	40	echo -A POSTROUTING -d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20\|grep Network\|cut -f 4 -d \ ` -o $wan3 -j $czffirstindex >> $restoredata
	41	fi
	42
	43	if ! grep $czfsecondindex $restoredata > /dev/null
	44	then
	45	echo :$czfsecondindex "- [0:0]" >> $restoredata
	46	echo -A $czffirstindex -s `ipcalc -n $czfip/23\|grep Network\|cut -f 4 -d \ ` -o $wan1 -j $czfsecondindex >> $restoredata
	47	echo -A $czffirstindex -s `ipcalc -n $czfip/23\|grep Network\|cut -f 4 -d \ ` -o $wan2 -j $czfsecondindex >> $restoredata
	48	echo -A $czffirstindex -s `ipcalc -n $czfip/23\|grep Network\|cut -f 4 -d \ ` -o $wan3 -j $czfsecondindex >> $restoredata
	49	fi
	50
	51	if ! grep $czfthirdindex $restoredata > /dev/null
	52	then
	53	echo :$czfthirdindex "- [0:0]" >> $restoredata
	54	echo -A $czfsecondindex -s `ipcalc -n $czfip/26\|grep Network\|cut -f 4 -d \ ` -o $wan1 -j $czfthirdindex >> $restoredata
	55	echo -A $czfsecondindex -s `ipcalc -n $czfip/26\|grep Network\|cut -f 4 -d \ ` -o $wan2 -j $czfthirdindex >> $restoredata
	56	echo -A $czfsecondindex -s `ipcalc -n $czfip/26\|grep Network\|cut -f 4 -d \ ` -o $wan3 -j $czfthirdindex >> $restoredata
	57	fi
	58
	59	if ! grep $pubfirstindex $restoredata > /dev/null
	60	then
	61	echo :$pubfirstindex "- [0:0]" >> $restoredata
	62	echo -A PREROUTING -i $wan1 -d `ipcalc -n $pubip/27\|grep Network\|cut -f 4 -d \ ` -j $pubfirstindex >> $restoredata
	63	echo -A PREROUTING -i $wan2 -d `ipcalc -n $pubip/27\|grep Network\|cut -f 4 -d \ ` -j $pubfirstindex >> $restoredata
	64	echo -A PREROUTING -i $wan3 -d `ipcalc -n $pubip/27\|grep Network\|cut -f 4 -d \ ` -j $pubfirstindex >> $restoredata
65	fi
66
67	if ! grep $pubsecondindex $restoredata > /dev/null
68	then
69	echo :$pubsecondindex "- [0:0]" >> $restoredata
70	echo -A $pubfirstindex -i $wan1 -d `ipcalc -n $pubip/29\|grep Network\|cut -f 4 -d \ ` -j $pubsecondindex >> $restoredata
71	echo -A $pubfirstindex -i $wan2 -d `ipcalc -n $pubip/29\|grep Network\|cut -f 4 -d \ ` -j $pubsecondindex >> $restoredata
72	echo -A $pubfirstindex -i $wan3 -d `ipcalc -n $pubip/29\|grep Network\|cut -f 4 -d \ ` -j $pubsecondindex >> $restoredata
73	fi
74
75	echo -A $pubsecondindex -i $wan1 -d $pubip/32 -j DNAT --to-destination $czfip >> $restoredata
76	echo -A $pubsecondindex -i $wan2 -d $pubip/32 -j DNAT --to-destination $czfip >> $restoredata
77	echo -A $pubsecondindex -i $wan3 -d $pubip/32 -j DNAT --to-destination $czfip >> $restoredata
78	echo -A $pubsecondindex -i $wan1 -d $pubip/32 -j ACCEPT >> $restoredata
79	echo -A $pubsecondindex -i $wan2 -d $pubip/32 -j ACCEPT >> $restoredata
80	echo -A $pubsecondindex -i $wan3 -d $pubip/32 -j ACCEPT >> $restoredata
81
82
83	echo -A $czfthirdindex -s $czfip/32 -o $wan1 -j SNAT --to-source $pubip >> $restoredata
84	echo -A $czfthirdindex -s $czfip/32 -o $wan2 -j SNAT --to-source $pubip >> $restoredata
85	echo -A $czfthirdindex -s $czfip/32 -o $wan3 -j SNAT --to-source $pubip >> $restoredata
86	echo -A $czfthirdindex -s $czfip/32 -o $wan1 -j ACCEPT >> $restoredata
87	echo -A $czfthirdindex -s $czfip/32 -o $wan2 -j ACCEPT >> $restoredata
88	echo -A $czfthirdindex -s $czfip/32 -o $wan3 -j ACCEPT >> $restoredata
89
90	echo -n .
91	done
92	echo " done."
93
94	echo -n "Generating new iptables-restore data - one way SNAT "
95
96	# ===============================================================
97	# SNAT only using indexed iptables (should be rather function, hmm)
98	# ===============================================================
99
100	for czfip in `grep -v ^# $pimp_snat\|cut -f 1 -d " "`
101	do
102	pubip=`grep "$czfip " $pimp_snat\|cut -f 2 -d " "`
103	czffirstindex=priv_`ipcalc -n $czfip/20\|grep Network\|cut -f 4 -d \ \|tr [./] _`
104	czfsecondindex=priv_`ipcalc -n $czfip/23\|grep Network\|cut -f 4 -d \ \|tr [./] _`
105	czfthirdindex=priv_`ipcalc -n $czfip/26\|grep Network\|cut -f 4 -d \ \|tr [./] _`
106
107	if ! grep $czffirstindex $restoredata > /dev/null
108	then
109	echo :$czffirstindex "- [0:0]" >> $restoredata
110	echo -A POSTROUTING -d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20\|grep Network\|cut -f 4 -d \ ` -o $wan1 -j $czffirstindex >> $restoredata
111	echo -A POSTROUTING -d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20\|grep Network\|cut -f 4 -d \ ` -o $wan2 -j $czffirstindex >> $restoredata
112	echo -A POSTROUTING -d ! 10.0.0.0/8 -s `ipcalc -n $czfip/20\|grep Network\|cut -f 4 -d \ ` -o $wan3 -j $czffirstindex >> $restoredata
113	fi
114
115	if ! grep $czfsecondindex $restoredata > /dev/null
116	then
117	echo :$czfsecondindex "- [0:0]" >> $restoredata
118	echo -A $czffirstindex -s `ipcalc -n $czfip/23\|grep Network\|cut -f 4 -d \ ` -o $wan1 -j $czfsecondindex >> $restoredata
119	echo -A $czffirstindex -s `ipcalc -n $czfip/23\|grep Network\|cut -f 4 -d \ ` -o $wan2 -j $czfsecondindex >> $restoredata
120	echo -A $czffirstindex -s `ipcalc -n $czfip/23\|grep Network\|cut -f 4 -d \ ` -o $wan3 -j $czfsecondindex >> $restoredata
121	fi
122
123	if ! grep $czfthirdindex $restoredata > /dev/null
124	then
125	echo :$czfthirdindex "- [0:0]" >> $restoredata
126	echo -A $czfsecondindex -s `ipcalc -n $czfip/26\|grep Network\|cut -f 4 -d \ ` -o $wan1 -j $czfthirdindex >> $restoredata
127	echo -A $czfsecondindex -s `ipcalc -n $czfip/26\|grep Network\|cut -f 4 -d \ ` -o $wan2 -j $czfthirdindex >> $restoredata
128	echo -A $czfsecondindex -s `ipcalc -n $czfip/26\|grep Network\|cut -f 4 -d \ ` -o $wan3 -j $czfthirdindex >> $restoredata
129	fi
130
131	echo -A $czfthirdindex -s $czfip/32 -o $wan1 -j SNAT --to-source $pubip >> $restoredata
132	echo -A $czfthirdindex -s $czfip/32 -o $wan2 -j SNAT --to-source $pubip >> $restoredata
133	echo -A $czfthirdindex -s $czfip/32 -o $wan3 -j SNAT --to-source $pubip >> $restoredata
134	echo -A $czfthirdindex -s $czfip/32 -o $wan1 -j ACCEPT >> $restoredata
135	echo -A $czfthirdindex -s $czfip/32 -o $wan2 -j ACCEPT >> $restoredata
136	echo -A $czfthirdindex -s $czfip/32 -o $wan3 -j ACCEPT >> $restoredata
137
138	echo -n .
139	done
140	echo " done."
141
142	echo COMMIT >> $restoredata