init/on-openvpn

gehe zur Dokumentation dieser Datei

#!/bin/sh
 
 
# shellcheck source=opennet/packages/on-core/files/usr/lib/opennet/on-helper.sh
. "${IPKG_INSTROOT:-}/usr/lib/opennet/on-helper.sh"
 
 
configure_tunnel_network() {
    local uci_prefix=network.on_vpn
 
    # Abbruch falls das Netzwerk schon vorhanden ist
    [ -n "$(uci_get "$uci_prefix")" ] && return
 
    # add new network to configuration (to be recognized by olsrd)
    uci set "${uci_prefix}=interface"
    uci set "${uci_prefix}.proto=none"
    uci set "${uci_prefix}.device=tun-on-user"
 
    apply_changes network
}
 
 
configure_tunnel_firewall() {
    local was_changed=0
    local uci_prefix
    uci_prefix=$(find_first_uci_section firewall zone "name=$ZONE_TUNNEL")
 
    # Zone erzeugen, falls sie noch nicht vorhanden ist
    if [ -z "$(uci_get "$uci_prefix")" ]; then
        # Zone fuer ausgehenden Verkehr definieren
        uci_prefix=firewall.$(uci add firewall zone)
        uci set "${uci_prefix}.name=$ZONE_TUNNEL"
        uci add_list "${uci_prefix}.network=$NETWORK_TUNNEL"
        uci set "${uci_prefix}.forward=REJECT"
        uci set "${uci_prefix}.input=REJECT"
        uci set "${uci_prefix}.output=ACCEPT"
        uci set "${uci_prefix}.masq=1"
        was_changed=1
    fi
    create_uci_section_if_missing firewall forwarding \
            "src=$ZONE_LOCAL" "dest=$ZONE_TUNNEL" \
        && was_changed=1
    create_uci_section_if_missing firewall rule \
            "src=$ZONE_TUNNEL" "dest_port=22" "target=ACCEPT" "name=on-user-ssh" \
        && was_changed=1
    create_uci_section_if_missing firewall rule \
            "src=$ZONE_TUNNEL" "proto=icmp" "target=ACCEPT" "name=on-user-icmp" \
        && was_changed=1
    [ "$was_changed" = "0" ] && return 0
    apply_changes firewall
}
 
configure_tos_firewall_handling() {
    # Meaning of: <<-'EOF'
    #  <<EOF    is here docs and ends with string EOF as delimiter
    #  <<-EOF   means that leading tabs are stripped even in line containing delimiter
    #  <<-'EOF' means that not interpretation of text will take place
    cat >> /etc/firewall.user <<-'EOF'
    # 
    # Mit TOS 0x08 markierter Traffic wird nicht ueber den User-VPN-Tunnel geleitet, weil wir davon ausgehen,
    #  dass dieser Traffic zum UGW direkt gesendet werden soll. Siehe hierzu auch die Doku:
    #  https://downloads.opennet-initiative.de/openwrt/stable/latest/doc/md__funktionsdetails.html#ugw-nutzer-kombi
    # Wir muessen sicherstellen, dass jeglicher Traffic aus dem LAN kein TOS 0x08 hat.
    #
 
    ON_CHAIN="on_tos_lan_vpn"
    iptables  -t mangle --new-chain "$ON_CHAIN" 2>/dev/null || iptables  -t mangle --flush "$ON_CHAIN"
    ip6tables -t mangle --new-chain "$ON_CHAIN" 2>/dev/null || ip6tables -t mangle --flush "$ON_CHAIN"
 
    # Wenn Traffic aus LAN TOS 0x08 hat, dann ersetze TOS durch 0x00
    iptables  -t mangle -A "$ON_CHAIN" -i br-lan -m tos --tos 0x08 -j TOS --set-tos 0x00
    ip6tables -t mangle -A "$ON_CHAIN" -i br-lan -m tos --tos 0x08 -j TOS --set-tos 0x00
 
    # Loesche Regeln, falls bereits vorhanden. Regeln muessen idempotent sein.
    iptables  -t mangle -D PREROUTING -j "$ON_CHAIN" 2>/dev/null
    ip6tables -t mangle -D PREROUTING -j "$ON_CHAIN" 2>/dev/null
    # Fuege Weiterleitung an unsere Chain hinzu.
    iptables  -t mangle -A PREROUTING -j "$ON_CHAIN"
    ip6tables -t mangle -A PREROUTING -j "$ON_CHAIN"
    EOF
}
 
configure_tunnel_network
configure_tunnel_firewall
configure_tos_firewall_handling