Major rework of make-iptables-restore - uses internal ipcalc (works in redhat too...
[svn/Prometheus-QoS/.git] / optional-tools / make-iptables-restore
1 #!/bin/bash
2 # $Id$
3 iptables="/sbin/iptables"
4 iptablesrestore="/sbin/iptables-restore"
5
6 #pimp files must be generated by optional-tools/make-pimp utility
7 pimp_2way_nat="/dev/shm/pimp-2way-nat.tmp"
8 pimp_snat="/dev/shm/pimp-snat.tmp"
9 etchosts="/mnt/mtdblock0/hosts"
10 restoretmp="/dev/shm/iptables-restore.tmp"
11 restoredata="/mnt/mtdblock0/iptables-restore.in"
12 wan1="vlan770"
13 wan2="vlan771"
14 wan3="vlan772"
15 wan4="vlan774"
16 czffirstbitmask="19"
17 czfsecondbitmask="22"
18 czfthirdbitmask="25"
19 czffourthbitmask="28"
20 pubfirstbitmask="26"
21 pubsecondbitmask="29"
22 chaintrack="_"
23
24 # ===============================================================
25 # ipcalc rewrite
26 # ===============================================================
27
28 gen_ipt_string() {
29 eval `echo $1 | awk -F\/ '{printf "IP=%s; CIDRMASK=%s; \n", $1, $2}'`
30
31 MASK_FULL_OCTETS=$(($CIDRMASK/8))
32 MASK_PART_OCTETS=$(($CIDRMASK%8))
33 for i in `seq 0 3`; do
34 if [ "$i" -lt "$MASK_FULL_OCTETS" ]; then
35 MASK+="255"
36 elif [ "$i" -eq "$MASK_FULL_OCTETS" ]; then
37 MASK+=$((256 - 2**(8-$MASK_PART_OCTETS)))
38 else
39 MASK+="0"
40 fi
41 [ "$i" -lt "3" ] && MASK+="."
42 done
43
44 eval `echo $IP | awk -F\. '{printf "IPBYTE1=%s; IPBYTE2=%s; IPBYTE3=%s; IPBYTE4=%s; \n", $1, $2, $3, $4}'`
45 eval `echo $MASK | awk -F\. '{printf "MASKBYTE1=%s; MASKBYTE2=%s; MASKBYTE3=%s; MASKBYTE4=%s; \n", $1, $2, $3, $4}'`
46
47 IPT_STRING="$(($IPBYTE1 & $MASKBYTE1))_$(($IPBYTE2 & $MASKBYTE2))_$(($IPBYTE3 & $MASKBYTE3))_$(($IPBYTE4 & $MASKBYTE4))_$CIDRMASK"
48 echo $IPT_STRING
49 }
50
51 echo "*nat" > $restoretmp
52 echo ":PREROUTING ACCEPT [0:0]" >> $restoretmp
53 echo ":POSTROUTING ACCEPT [0:0]" >> $restoretmp
54 echo ":OUTPUT ACCEPT [0:0]" >> $restoretmp
55
56 # ===============================================================
57 # Symetrical SNAT-DNAT using indexed iptables
58 # ===============================================================
59 echo -n "Generating new iptables-restore data - two way SNAT/DNAT "
60
61
62 while read LINE; do
63 eval `echo -e $LINE | awk '{printf "czfip=%s; pubip=%s\n", $1, $2}'`
64 czffirstindex=priv_`gen_ipt_string $czfip/$czffirstbitmask`
65 czfsecondindex=priv_`gen_ipt_string $czfip/$czfsecondbitmask`
66 czfthirdindex=priv_`gen_ipt_string $czfip/$czfthirdbitmask`
67 czffourthindex=priv_`gen_ipt_string $czfip/$czffourthbitmask`
68 pubfirstindex=pub_`gen_ipt_string $pubip/$pubfirstbitmask`
69 pubsecondindex=pub_`gen_ipt_string $pubip/$pubsecondbitmask`
70
71 if ! [[ "$chaintrack" == *"$czffirstindex"* ]]
72 then
73 echo :$czffirstindex "- [0:0]" >> $restoretmp
74 s=`gen_ipt_string $czfip/$czffirstbitmask| sed 's/_[0-9]*//4; s/_/./g'`
75 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan1 -j $czffirstindex >> $restoretmp
76 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan2 -j $czffirstindex >> $restoretmp
77 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan3 -j $czffirstindex >> $restoretmp
78 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan4 -j $czffirstindex >> $restoretmp
79 chaintrack=\ ${czffirstindex}\ ${chaintrack}
80 fi
81
82 if ! [[ "$chaintrack" == *"$czfsecondindex"* ]]
83 then
84 echo :$czfsecondindex "- [0:0]" >> $restoretmp
85 s=`gen_ipt_string $czfip/$czfsecondbitmask| sed 's/_[0-9]*//4; s/_/./g'`
86 echo -A $czffirstindex -s $s -o $wan1 -j $czfsecondindex >> $restoretmp
87 echo -A $czffirstindex -s $s -o $wan2 -j $czfsecondindex >> $restoretmp
88 echo -A $czffirstindex -s $s -o $wan3 -j $czfsecondindex >> $restoretmp
89 echo -A $czffirstindex -s $s -o $wan4 -j $czfsecondindex >> $restoretmp
90 chaintrack=\ ${czfsecondindex}\ ${chaintrack}
91 fi
92
93 if ! [[ "$chaintrack" == *"$czfthirdindex"* ]]
94 then
95 echo :$czfthirdindex "- [0:0]" >> $restoretmp
96 s=`gen_ipt_string $czfip/$czfthirdbitmask| sed 's/_[0-9]*//4; s/_/./g'`
97 echo -A $czfsecondindex -s $s -o $wan1 -j $czfthirdindex >> $restoretmp
98 echo -A $czfsecondindex -s $s -o $wan2 -j $czfthirdindex >> $restoretmp
99 echo -A $czfsecondindex -s $s -o $wan3 -j $czfthirdindex >> $restoretmp
100 echo -A $czfsecondindex -s $s -o $wan4 -j $czfthirdindex >> $restoretmp
101 chaintrack=\ ${czfthirdindex}\ ${chaintrack}
102 fi
103
104 if ! [[ "$chaintrack" == *"$czffourthindex"* ]]
105 then
106 echo :$czffourthindex "- [0:0]" >> $restoretmp
107 s=`gen_ipt_string $czfip/$czffourthbitmask| sed 's/_[0-9]*//4; s/_/./g'`
108 echo -A $czfthirdindex -s $s -o $wan1 -j $czffourthindex >> $restoretmp
109 echo -A $czfthirdindex -s $s -o $wan2 -j $czffourthindex >> $restoretmp
110 echo -A $czfthirdindex -s $s -o $wan3 -j $czffourthindex >> $restoretmp
111 echo -A $czfthirdindex -s $s -o $wan4 -j $czffourthindex >> $restoretmp
112 chaintrack=\ ${czffourthindex}\ ${chaintrack}
113 fi
114
115 if ! [[ "$chaintrack" == *"$pubfirstindex"* ]]
116 then
117 echo :$pubfirstindex "- [0:0]" >> $restoretmp
118 s=`gen_ipt_string $pubip/$pubfirstbitmask| sed 's/_[0-9]*//4; s/_/./g'`
119 echo -A PREROUTING -i $wan1 -d $s -j $pubfirstindex >> $restoretmp
120 echo -A PREROUTING -i $wan2 -d $s -j $pubfirstindex >> $restoretmp
121 echo -A PREROUTING -i $wan3 -d $s -j $pubfirstindex >> $restoretmp
122 echo -A PREROUTING -i $wan4 -d $s -j $pubfirstindex >> $restoretmp
123 chaintrack=\ ${pubfirstindex}\ ${chaintrack}
124 fi
125
126 if ! [[ "$chaintrack" == *"$pubsecondindex"* ]]
127 then
128 echo :$pubsecondindex "- [0:0]" >> $restoretmp
129 s=`gen_ipt_string $pubip/$pubsecondbitmask| sed 's/_[0-9]*//4; s/_/./g'`
130 echo -A $pubfirstindex -i $wan1 -d $s -j $pubsecondindex >> $restoretmp
131 echo -A $pubfirstindex -i $wan2 -d $s -j $pubsecondindex >> $restoretmp
132 echo -A $pubfirstindex -i $wan3 -d $s -j $pubsecondindex >> $restoretmp
133 echo -A $pubfirstindex -i $wan4 -d $s -j $pubsecondindex >> $restoretmp
134 chaintrack=\ ${pubsecondindex}\ ${chaintrack}
135 fi
136
137 echo -A $pubsecondindex -i $wan1 -d $pubip/32 -j DNAT --to-destination $czfip >> $restoretmp
138 echo -A $pubsecondindex -i $wan2 -d $pubip/32 -j DNAT --to-destination $czfip >> $restoretmp
139 echo -A $pubsecondindex -i $wan3 -d $pubip/32 -j DNAT --to-destination $czfip >> $restoretmp
140 echo -A $pubsecondindex -i $wan4 -d $pubip/32 -j DNAT --to-destination $czfip >> $restoretmp
141
142 echo -A $czffourthindex -s $czfip/32 -o $wan1 -j SNAT --to-source $pubip >> $restoretmp
143 echo -A $czffourthindex -s $czfip/32 -o $wan2 -j SNAT --to-source $pubip >> $restoretmp
144 echo -A $czffourthindex -s $czfip/32 -o $wan3 -j SNAT --to-source $pubip >> $restoretmp
145 echo -A $czffourthindex -s $czfip/32 -o $wan4 -j SNAT --to-source $pubip >> $restoretmp
146
147 echo -n .
148
149 done < $pimp_2way_nat
150 echo " done."
151
152 # ===============================================================
153 # SNAT only using indexed iptables (should be rather function, hmm)
154 # ===============================================================
155 echo -n "Generating new iptables-restore data - one way SNAT "
156
157 while read LINE; do
158 eval `echo -e $LINE | awk '{printf "czfip=%s; pubip=%s\n", $1, $2}'`
159 czffirstindex=priv_`gen_ipt_string $czfip/$czffirstbitmask`
160 czfsecondindex=priv_`gen_ipt_string $czfip/$czfsecondbitmask`
161 czfthirdindex=priv_`gen_ipt_string $czfip/$czfthirdbitmask`
162 czffourthindex=priv_`gen_ipt_string $czfip/$czffourthbitmask`
163
164 if ! [[ "$chaintrack" == *"$czffirstindex"* ]]
165 then
166 echo :$czffirstindex "- [0:0]" >> $restoretmp
167 s=`gen_ipt_string $czfip/$czffirstbitmask| sed 's/_[0-9]*//4; s/_/./g'`
168 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan1 -j $czffirstindex >> $restoretmp
169 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan2 -j $czffirstindex >> $restoretmp
170 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan3 -j $czffirstindex >> $restoretmp
171 echo -A POSTROUTING -d ! 10.0.0.0/8 -s $s -o $wan4 -j $czffirstindex >> $restoretmp
172 chaintrack=\ ${czffirstindex}\ ${chaintrack}
173 fi
174
175 if ! [[ "$chaintrack" == *"$czfsecondindex"* ]]
176 then
177 echo :$czfsecondindex "- [0:0]" >> $restoretmp
178 s=`gen_ipt_string $czfip/$czfsecondbitmask| sed 's/_[0-9]*//4; s/_/./g'`
179 echo -A $czffirstindex -s $s -o $wan1 -j $czfsecondindex >> $restoretmp
180 echo -A $czffirstindex -s $s -o $wan2 -j $czfsecondindex >> $restoretmp
181 echo -A $czffirstindex -s $s -o $wan3 -j $czfsecondindex >> $restoretmp
182 echo -A $czffirstindex -s $s -o $wan4 -j $czfsecondindex >> $restoretmp
183 chaintrack=\ ${czfsecondindex}\ ${chaintrack}
184 fi
185
186 if ! [[ "$chaintrack" == *"$czfthirdindex"* ]]
187 then
188 echo :$czfthirdindex "- [0:0]" >> $restoretmp
189 s=`gen_ipt_string $czfip/$czfthirdbitmask| sed 's/_[0-9]*//4; s/_/./g'`
190 echo -A $czfsecondindex -s $s -o $wan1 -j $czfthirdindex >> $restoretmp
191 echo -A $czfsecondindex -s $s -o $wan2 -j $czfthirdindex >> $restoretmp
192 echo -A $czfsecondindex -s $s -o $wan3 -j $czfthirdindex >> $restoretmp
193 echo -A $czfsecondindex -s $s -o $wan4 -j $czfthirdindex >> $restoretmp
194 chaintrack=\ ${czfthirdindex}\ ${chaintrack}
195 fi
196
197 if ! [[ "$chaintrack" == *"$czffourthindex"* ]]
198 then
199 echo :$czffourthindex "- [0:0]" >> $restoretmp
200 s=`gen_ipt_string $czfip/$czffourthbitmask| sed 's/_[0-9]*//4; s/_/./g'`
201 echo -A $czfthirdindex -s $s -o $wan1 -j $czffourthindex >> $restoretmp
202 echo -A $czfthirdindex -s $s -o $wan2 -j $czffourthindex >> $restoretmp
203 echo -A $czfthirdindex -s $s -o $wan3 -j $czffourthindex >> $restoretmp
204 echo -A $czfthirdindex -s $s -o $wan4 -j $czffourthindex >> $restoretmp
205 chaintrack=\ ${czffourthindex}\ ${chaintrack}
206 fi
207
208 echo -A $czffourthindex -s $czfip/32 -o $wan1 -j SNAT --to-source $pubip >> $restoretmp
209 echo -A $czffourthindex -s $czfip/32 -o $wan2 -j SNAT --to-source $pubip >> $restoretmp
210 echo -A $czffourthindex -s $czfip/32 -o $wan3 -j SNAT --to-source $pubip >> $restoretmp
211 echo -A $czffourthindex -s $czfip/32 -o $wan4 -j SNAT --to-source $pubip >> $restoretmp
212
213 echo -n .
214 done < $pimp_snat
215 echo " done."
216
217 echo COMMIT >> $restoretmp
218 echo -n "Writing $restoredata"
219 mv $restoretmp $restoredata
This page took 0.395434 seconds and 4 git commands to generate.