154 lines
3.8 KiB
Bash
Executable File
154 lines
3.8 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
# Debugging function
|
|
debug() {
|
|
if [ $DEBUG -eq 1 ]; then
|
|
echo "DEBUG: "$1 $2 $3
|
|
fi;
|
|
}
|
|
|
|
# Task type variables
|
|
NSENTER=$NSENTER
|
|
PREROUTING=$PREROUTING
|
|
POSTROUTING=$POSTROUTING
|
|
|
|
# Mandatory task variables
|
|
CHAIN=$CHAIN
|
|
NAME=$NAME
|
|
COMMENT=$COMMENT
|
|
NAME=$NAME-$COMMENT
|
|
PROTOCOL=$TYPE
|
|
|
|
EXTRA_OPTIONS="$2 $3 $4"
|
|
|
|
# turn on debug mode by extra option "debug"
|
|
if [[ "$(echo "$EXTRA_OPTIONS" | grep debug)" != "" ]] ; then
|
|
DEBUG=1
|
|
fi;
|
|
|
|
|
|
##############################
|
|
|
|
echo 1 > /proc/sys/net/ipv4/ip_forward
|
|
|
|
##############################
|
|
|
|
IPTABLES=/sbin/iptables-legacy
|
|
|
|
###############################
|
|
|
|
prerouting() {
|
|
LINES=$($iptables --line-number -n | grep $COMMENT | grep PREROUTING |awk '{print $1}'| tac)
|
|
|
|
# DELETE UNECESSARY LINES FROM PREVIOUS RULES
|
|
if [ -n "$LINES" ] ; then
|
|
for i in $LINES; do
|
|
$iptables -D $i
|
|
sleep 0.1
|
|
done
|
|
fi
|
|
|
|
$iptables -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT
|
|
}
|
|
|
|
postrouting() {
|
|
LINES=$($iptables --line-number -n | grep $COMMENT | grep POSTROUTING | awk '{print $1}'| tac)
|
|
|
|
# DELETE UNECESSARY LINES FROM PREVIOUS RULES
|
|
if [ -n "$LINES" ] ; then
|
|
for i in $LINES; do
|
|
$iptables -D $i
|
|
sleep 0.1
|
|
done
|
|
fi
|
|
|
|
$iptables -I POSTROUTING -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE
|
|
}
|
|
|
|
COUNT_SOURCE_IP=$(set |grep SOURCE_IP |wc -l)
|
|
COUNT_SOURCE_PORT=$(set |grep SOURCE_PORT |wc -l)
|
|
COUNT_TARGET_IP=$(set |grep TARGET_IP |wc -l)
|
|
COUNT_TARGET_PORT=$(set |grep TARGET_PORT |wc -l)
|
|
|
|
for source_ip_index in $(seq 1 $COUNT_SOURCE_IP) ; do
|
|
if set |grep SOURCE_IP_ ; then
|
|
SOURCE_IP=$(eval "echo \${"SOURCE_IP_$source_ip_index"}")
|
|
fi
|
|
|
|
for source_port_index in $(seq 1 $COUNT_SOURCE_PORT) ; do
|
|
if set |grep SOURCE_PORT_ ; then
|
|
SOURCE_PORT=$(eval "echo \${"SOURCE_PORT_$source_port_index"}")
|
|
fi
|
|
|
|
for target_ip_index in $(seq 1 $COUNT_TARGET_IP) ; do
|
|
if set |grep TARGET_IP_ ; then
|
|
TARGET_IP=$(eval "echo \${"TARGET_IP_$target_ip_index"}")
|
|
fi
|
|
|
|
for target_port_index in $(seq 1 $COUNT_TARGET_PORT) ; do
|
|
if set |grep TARGET_PORT_ ; then
|
|
TARGET_PORT=$(eval "echo \${"TARGET_PORT_$target_port_index"}")
|
|
fi
|
|
|
|
#############################
|
|
# NSENTER Specific settings #
|
|
if [[ "$NSENTER" == "true" ]] ; then
|
|
|
|
if [[ "$PREROUTING" == "true" ]] || [[ "$POSTROUTING" == "true" ]] ; then
|
|
iptables="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- $IPTABLES -t nat";
|
|
|
|
debug "iptables: "$IPTABLES;
|
|
|
|
if [[ "$PREROUTING" == "true" ]] ; then
|
|
prerouting;
|
|
|
|
elif [[ "$POSTROUTING" == "true" ]] ; then
|
|
postrouting;
|
|
fi;
|
|
else
|
|
ip_route="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- ip route";
|
|
|
|
|
|
fi
|
|
|
|
|
|
else
|
|
if [[ "$PREROUTING" == "true" ]] || [[ "$POSTROUTING" == "true" ]] ; then
|
|
if [[ "$PREROUTING" == "true" ]] ; then
|
|
prerouting;
|
|
|
|
elif [[ "$POSTROUTING" == "true" ]] ; then
|
|
postrouting;
|
|
fi;
|
|
else
|
|
|
|
if $IPTABLES --list $CHAIN |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then
|
|
echo "nothing to do";
|
|
else
|
|
$IPTABLES -I $CHAIN -m state --state established,related -j ACCEPT;
|
|
fi
|
|
|
|
#
|
|
# DELETE UNECESSARY LINES FROM PREVIOUS RULES
|
|
LINES=$($IPTABLES --line-number -n --list $CHAIN | grep $SOURCE_IP |grep $TARGET_IP |grep $PROTOCOL |grep $TARGET_PORT | awk '{print $1}'| tac)
|
|
|
|
if [ -n "$LINES" ] ; then
|
|
for i in $LINES; do
|
|
$IPTABLES -D $CHAIN $i
|
|
sleep 0.1
|
|
done
|
|
fi
|
|
|
|
$IPTABLES -I $CHAIN -s $SOURCE_IP -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT
|
|
|
|
#############################
|
|
fi
|
|
fi
|
|
|
|
done # target_port
|
|
done # target_ip
|
|
done # source_port
|
|
done # source_ip
|
|
|
|
|