optional-tools/make-snat-dnat

   1 #!/bin/bash
   2
   3 iptables="/sbin/iptables"
   4 ifconfig="/sbin/ifconfig"
   5
   6 #pimp files must be generated by optional-tools/make-pimp utility
   7 pimp_2way_nat="/rw/var/run/pimp-2way-nat.tmp"
   8 pimp_snat="/rw/var/run/pimp-snat.tmp"
   9 etchosts="/rw/etc/hosts"
  10 script="/rw/etc/network/snat-dnat"
  11
  12 echo "#!/bin/bash" > $script
  13 echo $iptables -t nat -F >> $script
  14 echo $iptables -t nat -X >> $script
  15 echo "echo -n \"Setting firewall rules \"" >> $script
  16
  17 # ===============================================================
  18 #  Symetrical SNAT-DNAT using indexed iptables
  19 # ===============================================================
  20
  21 echo -n "Generating new iptables rules "
  22
  23 for czfip in `grep -v ^# $pimp_2way_nat|cut -f 1 -d " "`
  24 do
  25  pubip=`grep "$czfip " $pimp_2way_nat|cut -f 2 -d " "`
  26  czffirstindex=priv_`ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ |tr [./] _`
  27  czfsecondindex=priv_`ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ |tr [./] _`
  28  czfthirdindex=priv_`ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ |tr [./] _`
  29  pubfirstindex=pub_`ipcalc -n $pubip/27|grep Network|cut -f 4 -d \ |tr [./] _`
  30  pubsecondindex=pub_`ipcalc -n $pubip/29|grep Network|cut -f 4 -d \ |tr [./] _`
  31
  32  if ! grep $czffirstindex $script > /dev/null
  33  then
  34   echo $iptables -t nat -N $czffirstindex >> $script
  35   echo $iptables -t nat -F $czffirstindex >> $script
  36   echo $iptables -t nat -A POSTROUTING -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o eth1 -j $czffirstindex >> $script
  37  fi
  38
  39  if ! grep $czfsecondindex $script > /dev/null
  40  then
  41   echo $iptables -t nat -N $czfsecondindex >> $script
  42   echo $iptables -t nat -F $czfsecondindex >> $script
  43   echo $iptables -t nat -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o eth1 -j $czfsecondindex >> $script
  44  fi
  45
  46  if ! grep $czfthirdindex $script > /dev/null
  47  then
  48   echo $iptables -t nat -N $czfthirdindex >> $script
  49   echo $iptables -t nat -F $czfthirdindex >> $script
  50   echo $iptables -t nat -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o eth1 -j $czfthirdindex >> $script
  51  fi
  52
  53  if ! grep $pubfirstindex $script > /dev/null
  54  then
  55   echo $iptables -t nat -N $pubfirstindex >> $script
  56   echo $iptables -t nat -F $pubfirstindex >> $script
  57   echo $iptables -t nat -A PREROUTING -i eth1 -d `ipcalc -n $pubip/27|grep Network|cut -f 4 -d \ ` -j $pubfirstindex >> $script
  58  fi
  59
  60  if ! grep $pubsecondindex $script > /dev/null
  61  then
  62   echo $iptables -t nat -N $pubsecondindex >> $script
  63   echo $iptables -t nat -F $pubsecondindex >> $script
  64   echo $iptables -t nat -A $pubfirstindex -i eth1 -d `ipcalc -n $pubip/29|grep Network|cut -f 4 -d \ ` -j $pubsecondindex >> $script
  65  fi
  66
  67  echo $iptables -t nat -A $pubsecondindex -i eth1 -d $pubip/32 -j DNAT --to-destination $czfip >> $script
  68  echo $iptables -t nat -A $pubsecondindex -i eth1 -d $pubip/32 -j ACCEPT >> $script
  69
  70  echo $iptables -t nat -A $czfthirdindex -s $czfip/32 -o eth1 -j SNAT --to-source $pubip >> $script
  71  echo $iptables -t nat -A $czfthirdindex -s $czfip/32 -o eth1 -j ACCEPT >> $script
  72
  73  echo -n .
  74  echo "echo -n ." >>$script
  75 done
  76 echo " done."
  77
  78 # ===============================================================
  79 #  SNAT only using indexed iptables (should be rather function, hmm)
  80 # ===============================================================
  81
  82 for czfip in `grep -v ^# $pimp_snat|cut -f 1 -d " "`
  83 do
  84  pubip=`grep "$czfip " $pimp_snat|cut -f 2 -d " "`
  85  czffirstindex=priv_`ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ |tr [./] _`
  86  czfsecondindex=priv_`ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ |tr [./] _`
  87  czfthirdindex=priv_`ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ |tr [./] _`
  88
  89  if ! grep $czffirstindex $script > /dev/null
  90  then
  91   echo $iptables -t nat -N $czffirstindex >> $script
  92   echo $iptables -t nat -F $czffirstindex >> $script
  93   echo $iptables -t nat -A POSTROUTING -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -o eth1 -j $czffirstindex >> $script
  94  fi
  95
  96  if ! grep $czfsecondindex $script > /dev/null
  97  then
  98   echo $iptables -t nat -N $czfsecondindex >> $script
  99   echo $iptables -t nat -F $czfsecondindex >> $script
 100   echo $iptables -t nat -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -o eth1 -j $czfsecondindex >> $script
 101  fi
 102
 103  if ! grep $czfthirdindex $script > /dev/null
 104  then
 105   echo $iptables -t nat -N $czfthirdindex >> $script
 106   echo $iptables -t nat -F $czfthirdindex >> $script
 107   echo $iptables -t nat -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -o eth1 -j $czfthirdindex >> $script
 108  fi
 109
 110  echo $iptables -t nat -A $czfthirdindex -s $czfip/32 -o eth1 -j SNAT --to-source $pubip >> $script
 111  echo $iptables -t nat -A $czfthirdindex -s $czfip/32 -o eth1 -j ACCEPT >> $script
 112
 113  echo -n .
 114  echo "echo -n ." >>$script
 115 done
 116 echo " done."
 117
 118 # ===============================================================
 119 #  Dashboard rules
 120 # ===============================================================
 121
 122 echo -n "Generating dashboard index rules "
 123
 124 for czfip in `grep ^10[.] $etchosts|grep dashboard-|cut -f 1`
 125 do
 126  czffirstindex=dash_`ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ |tr [./] _`
 127  czfsecondindex=dash_`ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ |tr [./] _`
 128  czfthirdindex=dash_`ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ |tr [./] _`
 129
 130  if ! grep $czffirstindex $script > /dev/null
 131  then
 132   echo $iptables -t nat -N $czffirstindex >> $script
 133   echo $iptables -t nat -F $czffirstindex >> $script
 134   echo $iptables -t nat -A PREROUTING -s `ipcalc -n $czfip/20|grep Network|cut -f 4 -d \ ` -i eth0 -j $czffirstindex >> $script
 135  fi
 136
 137  if ! grep $czfsecondindex $script > /dev/null
 138  then
 139   echo $iptables -t nat -N $czfsecondindex >> $script
 140   echo $iptables -t nat -F $czfsecondindex >> $script
 141   echo $iptables -t nat -A $czffirstindex -s `ipcalc -n $czfip/23|grep Network|cut -f 4 -d \ ` -i eth0 -j $czfsecondindex >> $script
 142  fi
 143
 144  if ! grep $czfthirdindex $script > /dev/null
 145  then
 146   echo $iptables -t nat -N $czfthirdindex >> $script
 147   echo $iptables -t nat -F $czfthirdindex >> $script
 148   echo $iptables -t nat -A $czfsecondindex -s `ipcalc -n $czfip/26|grep Network|cut -f 4 -d \ ` -i eth0 -j $czfthirdindex >> $script
 149  fi
 150
 151  echo $iptables -t nat -A $czfthirdindex -s $czfip -d ! 10.0.0.0/8 -p tcp --dport 80 -j REDIRECT --to 8080 >> $script
 152  echo $iptables -t nat -A $czfthirdindex -s $czfip -d ! 10.0.0.0/8 -p tcp --dport 3128 -j REDIRECT --to 8080  >> $script
 153  echo $iptables -t nat -A $czfthirdindex -s $czfip -d ! 10.0.0.0/8 -p tcp --dport 8080 -j ACCEPT >> $script
 154  echo $iptables -t nat -A $czfthirdindex -s $czfip -d ! 10.0.0.0/8 -j DROP  >> $script
 155
 156  echo -n .
 157  echo "echo -n ." >>$script
 158
 159 done
 160 echo " done."
 161
 162 chmod a+x $script