forked from cpf/fomrouting
-
Notifications
You must be signed in to change notification settings - Fork 0
/
routing
executable file
·69 lines (53 loc) · 3.07 KB
/
routing
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
#! /bin/sh -e
#
# Author: Toon Geens
#
export PYTHONPATH="/root/fomrouting/tools:"
# Enable connection tracking
modprobe ip_conntrack # might be enabled by default
modprobe ip_conntrack_ftp # was not enbaled by default, required for passive FTP
echo "Removing existing rules"
ip rule del fwmark 1 |true
ip rule del fwmark 2 |true
ip rule del fwmark 3 |true
ip rule del fwmark 4 |true
ip rule del fwmark 5 |true
echo "Adding rules"
ip rule add fwmark 1 table dsl1 # telenet 1
ip rule add fwmark 2 table dsl2 # telenet 2
ip rule add fwmark 3 table dsl3 # telenet 3
ip rule add fwmark 4 table dsl4 # telenet 4
ip rule add fwmark 5 table dsl5 # vdsl
iptables -t nat -F
iptables -t nat -A POSTROUTING -s 172.16.0.0/16 -o eth1.11 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 172.16.0.0/16 -o eth1.12 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 172.16.0.0/16 -o eth1.13 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 172.16.0.0/16 -o eth1.14 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 172.16.0.0/16 -o eth1.15 -j MASQUERADE
# redirect http over local squid proxy
#iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
iptables -t mangle -F
#iptables -t mangle -A PREROUTING -m iprange --src-range 172.16.3.1-172.16.3.255 -j MARK --set-mark 1 # CREW
iptables -t mangle -A PREROUTING -m iprange --src-range 172.16.43.1-172.16.44.255 -j MARK --set-mark 2 # VIP
iptables -t mangle -A PREROUTING -m iprange --src-range 172.16.51.1-172.16.58.255 -j MARK --set-mark 2 # Zaal deel 1
iptables -t mangle -A PREROUTING -m iprange --src-range 172.16.59.1-172.16.60.255 -j MARK --set-mark 3 # Zaal deel 2
iptables -t mangle -A PREROUTING -m iprange --src-range 172.16.61.1-172.16.61.255 -j MARK --set-mark 4 # Zaal deel 2
iptables -t mangle -A PREROUTING -m iprange --src-range 172.16.62.1-172.16.63.255 -j MARK --set-mark 2 # Zaal deel 2
iptables -t mangle -A PREROUTING -m iprange --src-range 172.16.65.1-172.16.67.255 -j MARK --set-mark 4 # Zaal deel 3
iptables -t mangle -A PREROUTING -p tcp --dport 80 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -p tcp --dport 443 -j MARK --set-mark 1 # route https over proxy
#iptables -t mangle -A PREROUTING --source 172.16.41.3 -j MARK --set-mark 4 # line tester
iptables -t filter -F
iptables -t filter -P FORWARD DROP
iptables -t filter -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A PREROUTING -t nat -p tcp --dport 80 -j REDIRECT --to-port 8080 # You better start redirecting 80 to 8080 proxy
#iptables -t filter -A FORWARD -p tcp --dport 80 -j ACCEPT # redirected to 8080 proxy
iptables -t filter -A FORWARD -p tcp --dport 443 -j ACCEPT # allow https to go through
#iptables -t filter -A FORWARD -p tcp --dport 22 -j ACCEPT # SSH
#iptables -t filter -A FORWARD -p tcp --dport 2222 -j ACCEPT # temp - rent a lan
iptables -t filter -A FORWARD -p icmp -j ACCEPT # Allow icmp ping
#iptables -t filter -A FORWARD -p
# allow ftp for de-raedt.eu
iptables -t filter -A FORWARD -p tcp --destination 77.243.236.220 -j ACCEPT
# Load game iptable scripts
run-parts --verbose --regex '.*' configs.d