optional hosts-based snat-dnat tools modified to generate iptables restore config

[svn/Prometheus-QoS/.git] / optional-tools / make-snat-dnat

diff --git a/optional-tools/make-snat-dnat b/optional-tools/make-snat-dnat
deleted file mode 100755 (executable)
index 3785557..0000000
--- a/optional-tools/make-snat-dnat
+++ /dev/null
@@ -1,162 +0,0 @@
-#!/bin/bash
-
-iptables="/sbin/iptables"
-ifconfig="/sbin/ifconfig"
-
-#pimp files must be generated by optional-tools/make-pimp utility
-pimp_2way_nat="/rw/var/run/pimp-2way-nat.tmp"
-pimp_snat="/rw/var/run/pimp-snat.tmp"
-etchosts="/rw/etc/hosts"
-script="/rw/etc/network/snat-dnat"
-
-echo "#!/bin/bash" > $script
-echo $iptables -t nat -F >> $script
-echo $iptables -t nat -X >> $script
-echo "echo -n \"Setting firewall rules \"" >> $script
-
-# ===============================================================
-#  Symetrical SNAT-DNAT using indexed iptables
-# ===============================================================
-
-echo -n "Generating new iptables rules "
-
-for czfip in `grep -v ^# $pimp_2way_nat|cut -f 1 -d " "`
-do
- pubip=`grep "$czfip " $pimp_2way_nat|cut -f 2 -d " "`
- czffirstindex=priv_`ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ |tr [./] _`
- czfsecondindex=priv_`ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ |tr [./] _`
- czfthirdindex=priv_`ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ |tr [./] _`
- pubfirstindex=pub_`ipcalc -n $pubip/27|grep Network|cut -f 4 -d \ |tr [./] _`
- pubsecondindex=pub_`ipcalc -n $pubip/29|grep Network|cut -f 4 -d \ |tr [./] _`
-
- if ! grep $czffirstindex $script > /dev/null
- then
-  echo $iptables -t nat -N $czffirstindex >> $script
-  echo $iptables -t nat -F $czffirstindex >> $script
-  echo $iptables -t nat -A POSTROUTING -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o eth1 -j $czffirstindex >> $script
- fi
-
- if ! grep $czfsecondindex $script > /dev/null
- then
-  echo $iptables -t nat -N $czfsecondindex >> $script
-  echo $iptables -t nat -F $czfsecondindex >> $script
-  echo $iptables -t nat -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o eth1 -j $czfsecondindex >> $script
- fi
-
- if ! grep $czfthirdindex $script > /dev/null
- then
-  echo $iptables -t nat -N $czfthirdindex >> $script
-  echo $iptables -t nat -F $czfthirdindex >> $script
-  echo $iptables -t nat -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o eth1 -j $czfthirdindex >> $script
- fi
-
- if ! grep $pubfirstindex $script > /dev/null
- then
-  echo $iptables -t nat -N $pubfirstindex >> $script
-  echo $iptables -t nat -F $pubfirstindex >> $script
-  echo $iptables -t nat -A PREROUTING -i eth1 -d `ipcalc -n $pubip/27|grep Network|cut -f 4 -d \ ` -j $pubfirstindex >> $script
- fi
-
- if ! grep $pubsecondindex $script > /dev/null
- then
-  echo $iptables -t nat -N $pubsecondindex >> $script
-  echo $iptables -t nat -F $pubsecondindex >> $script
-  echo $iptables -t nat -A $pubfirstindex -i eth1 -d `ipcalc -n $pubip/29|grep Network|cut -f 4 -d \ ` -j $pubsecondindex >> $script
- fi
-
- echo $iptables -t nat -A $pubsecondindex -i eth1 -d $pubip/32 -j DNAT --to-destination $czfip >> $script
- echo $iptables -t nat -A $pubsecondindex -i eth1 -d $pubip/32 -j ACCEPT >> $script
-
- echo $iptables -t nat -A $czfthirdindex -s $czfip/32 -o eth1 -j SNAT --to-source $pubip >> $script
- echo $iptables -t nat -A $czfthirdindex -s $czfip/32 -o eth1 -j ACCEPT >> $script
-
- echo -n .
- echo "echo -n ." >>$script
-done
-echo " done."
-
-# ===============================================================
-#  SNAT only using indexed iptables (should be rather function, hmm)
-# ===============================================================
-
-for czfip in `grep -v ^# $pimp_snat|cut -f 1 -d " "`
-do
- pubip=`grep "$czfip " $pimp_snat|cut -f 2 -d " "`
- czffirstindex=priv_`ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ |tr [./] _`
- czfsecondindex=priv_`ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ |tr [./] _`
- czfthirdindex=priv_`ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ |tr [./] _`
-
- if ! grep $czffirstindex $script > /dev/null
- then
-  echo $iptables -t nat -N $czffirstindex >> $script
-  echo $iptables -t nat -F $czffirstindex >> $script
-  echo $iptables -t nat -A POSTROUTING -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o eth1 -j $czffirstindex >> $script
- fi
-
- if ! grep $czfsecondindex $script > /dev/null
- then
-  echo $iptables -t nat -N $czfsecondindex >> $script
-  echo $iptables -t nat -F $czfsecondindex >> $script
-  echo $iptables -t nat -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o eth1 -j $czfsecondindex >> $script
- fi
-
- if ! grep $czfthirdindex $script > /dev/null
- then
-  echo $iptables -t nat -N $czfthirdindex >> $script
-  echo $iptables -t nat -F $czfthirdindex >> $script
-  echo $iptables -t nat -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o eth1 -j $czfthirdindex >> $script
- fi
-
- echo $iptables -t nat -A $czfthirdindex -s $czfip/32 -o eth1 -j SNAT --to-source $pubip >> $script
- echo $iptables -t nat -A $czfthirdindex -s $czfip/32 -o eth1 -j ACCEPT >> $script
-
- echo -n .
- echo "echo -n ." >>$script
-done
-echo " done."
-
-# ===============================================================
-#  Dashboard rules
-# ===============================================================
-
-echo -n "Generating dashboard index rules "
-
-for czfip in `grep ^10[.] $etchosts|grep dashboard-|cut -f 1`
-do
- czffirstindex=dash_`ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ |tr [./] _`
- czfsecondindex=dash_`ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ |tr [./] _`
- czfthirdindex=dash_`ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ |tr [./] _`
-
- if ! grep $czffirstindex $script > /dev/null
- then
-  echo $iptables -t nat -N $czffirstindex >> $script
-  echo $iptables -t nat -F $czffirstindex >> $script
-  echo $iptables -t nat -A PREROUTING -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -i eth0 -j $czffirstindex >> $script
- fi
-
- if ! grep $czfsecondindex $script > /dev/null
- then
-  echo $iptables -t nat -N $czfsecondindex >> $script
-  echo $iptables -t nat -F $czfsecondindex >> $script
-  echo $iptables -t nat -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -i eth0 -j $czfsecondindex >> $script
- fi
-
- if ! grep $czfthirdindex $script > /dev/null
- then
-  echo $iptables -t nat -N $czfthirdindex >> $script
-  echo $iptables -t nat -F $czfthirdindex >> $script
-  echo $iptables -t nat -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -i eth0 -j $czfthirdindex >> $script
- fi
-
- echo $iptables -t nat -A $czfthirdindex -s $czfip -d ! 10.0.0.0/8 -p tcp --dport 80 -j REDIRECT --to 8080 >> $script
- echo $iptables -t nat -A $czfthirdindex -s $czfip -d ! 10.0.0.0/8 -p tcp --dport 3128 -j REDIRECT --to 8080  >> $script
- echo $iptables -t nat -A $czfthirdindex -s $czfip -d ! 10.0.0.0/8 -p tcp --dport 8080 -j ACCEPT >> $script
- echo $iptables -t nat -A $czfthirdindex -s $czfip -d ! 10.0.0.0/8 -j DROP  >> $script
-
- echo -n .
- echo "echo -n ." >>$script
-
-done
-echo " done."
-
-chmod a+x $script