Script freenetis ipset: Porovnání verzí
(Založena nová stránka: ################################################################################## #! /bin/sh ...) |
|||
| Řádek 1: | Řádek 1: | ||
| − | + | <nowiki>################################################################################## | |
| − | + | #! /bin/sh # | |
| − | + | # # | |
| − | + | # Skript pro presmerovani ip adres. Data jsou nacitana automaticky z freenetisu. # | |
| − | + | # # | |
| − | + | # autor Sevcik Roman 2009 # | |
| − | + | # email sevcik.roman@slfree.net # | |
| − | + | # # | |
| − | + | ################################################################################## | |
| − | + | IPTABLES=/usr/local/sbin/iptables | |
| − | + | IP_SELF=10.143.128.1 | |
| − | + | IP_SELF1=10.143.129.0 | |
| − | + | IP_TARGET=212.111.4.121 | |
| − | + | PORT_WEB=80 | |
| − | + | PORT_REDIRECT=36000 | |
| − | + | SET_URL_RANGES=http://freenetis.slfree.net/cs/redirect/ipset/ranges | |
| − | + | SET_URL_PARTNERS=http://freenetis.slfree.net/cs/redirect/ipset/partners | |
| − | + | SET_URL_MEMBERS=http://freenetis.slfree.net/cs/redirect/ipset/members | |
| − | + | # Funkce testuje jestli je dana ip validne zapsana | |
| − | + | # @param ip adresa | |
| − | + | # return 1 pokud je ip validni | |
| − | + | function valid_ip() | |
| − | + | { | |
| − | + | local ip=$1 | |
| − | + | local stat=1 | |
| − | + | if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then | |
| − | + | OIFS=$IFS | |
| − | + | IFS='.' | |
| − | + | ip=($ip) | |
| − | + | IFS=$OIFS | |
| − | + | [[ ${ip[0]} -le 255 && ${ip[1]} -le 255 && ${ip[2]} -le 255 && ${ip[3]} -le 255 ]] | |
| − | + | stat=$? | |
| − | + | fi | |
| − | + | return $stat | |
| − | + | } | |
| − | + | # Funkce testuje jestli je dany subnet validne zapsany | |
| − | + | # @param subnet | |
| − | + | # return 1 pokud je subnet validni | |
| − | + | function valid_subnet() | |
| − | + | { | |
| − | + | local subnet=$1 | |
| − | + | local stat=1 | |
| − | + | if [[ $subnet =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/[0-9]{1,2}$ ]]; then | |
| − | + | OIFS=$IFS | |
| − | + | IFS='/' | |
| − | + | subnet=($subnet) | |
| − | + | IFS='.' | |
| − | + | ip=${subnet[0]} | |
| − | + | ip=($ip) | |
| − | + | mask=${subnet[1]} | |
| − | + | IFS=$OIFS | |
| − | + | [[ ${ip[0]} -le 255 && ${ip[1]} -le 255 && ${ip[2]} -le 255 && ${ip[3]} -le 255 ]] | |
| − | + | [[ $mask -le 31 ]] | |
| − | + | stat=$? | |
| − | + | fi | |
| − | + | return $stat | |
| − | + | } | |
| − | + | function update() | |
| − | + | { | |
| − | + | #Vymazeme obsah vsech setu | |
| − | + | echo "Erasing content of sets."; | |
| − | + | ipset -F ranges | |
| − | + | ipset -F partners | |
| − | + | ipset -F members | |
| − | + | echo "Downloading data"; | |
| − | + | wget -q -O /tmp/ranges $SET_URL_RANGES | |
| − | + | wget -q -O /tmp/partners $SET_URL_PARTNERS | |
| − | + | wget -q -O /tmp/members $SET_URL_MEMBERS | |
| − | + | BAKIFS=$IFS | |
| − | + | IFS=$(echo -en "\n\b") | |
| − | + | exec 3<&0 | |
| − | + | #Plnime set partners | |
| − | + | echo "Filling set partnets."; | |
| − | + | exec 0</tmp/partners | |
| − | + | while read LINE | |
| − | + | do | |
| − | + | if valid_subnet $LINE; then echo "$LINE - added to set partners."; ipset -A partners $LINE; else echo "$LINE - not valid subnet."; fi | |
| − | + | done | |
| − | + | #Plnime set members | |
| − | + | echo "Filling set members."; | |
| − | + | exec 0</tmp/members | |
| − | + | while read LINE | |
| − | + | do | |
| − | + | if valid_ip $LINE; then echo "$LINE - added to set members."; ipset -A members $LINE; else echo "$LINE - not valid IP address."; fi | |
| − | + | done | |
| − | + | #Plnime set ranges - je nutne aby se plnil az na konci. Jinak by byly presmerovane ip v dobe kdy se set nenbers a partners teprve plni. | |
| − | + | echo "Filling set ranges."; | |
| − | + | exec 0</tmp/ranges | |
| − | + | while read LINE | |
| − | + | do | |
| − | + | if valid_subnet $LINE; then echo "$LINE - added to set ranges."; ipset -A ranges $LINE; else echo "$LINE - not valid subnet."; fi | |
| − | + | done | |
| − | + | exec 0<&3 | |
| − | + | IFS=$BAKIFS | |
| − | + | #Cleaning up | |
| − | + | rm /tmp/ranges | |
| − | + | rm /tmp/partners | |
| − | + | rm /tmp/members | |
| − | + | } | |
| − | + | case "$1" in | |
| − | + | start) | |
| − | + | echo "Adding sets."; | |
| − | + | ipset -N ranges nethash --hashsize 1024 --probes 4 --resize 50 | |
| − | + | ipset -N partners nethash --hashsize 1024 --probes 4 --resize 50 | |
| − | + | ipset -N members iphash --hashsize 10000 --probes 8 --resize 50 | |
| − | + | echo "Adding firewall rules."; | |
| − | + | #Pravidlo pro pridani ip do setu members. Pokud projde firewallem packet na danou cilovou ip prida se zdrojova ip do setu members. | |
| − | + | $IPTABLES -t nat -A PREROUTING -m set --set ranges src -d $IP_TARGET -j SET --add-set members src | |
| − | + | #Pokud uz je ip v setu members nebo partners neaplikuje se presmerovani. | |
| − | + | $IPTABLES -t nat -A PREROUTING -m set --set partners src -j ACCEPT | |
| − | + | $IPTABLES -t nat -A PREROUTING -m set --set members src -j ACCEPT | |
| − | + | #Povoleni portu 36000 pro potreby presmerovani. Na tomto portu nasloucha webserver a provede presmerovani na zvolenou url. | |
| − | + | $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p tcp --dport $PORT_REDIRECT -j ACCEPT | |
| − | + | #Presmerovani vseho co miri do internetu a ma cilovy port 80 na port 36000. | |
| − | + | $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p tcp --dport $PORT_WEB -j REDIRECT --to-port $PORT_REDIRECT | |
| − | + | #Vyjimky ip adres a portu ktere budou fungovat i po presmerovani. | |
| − | + | $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p icmp -d $IP_SELF -j ACCEPT | |
| − | + | $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p udp -d $IP_SELF --dport 53 -j ACCEPT | |
| − | + | $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p tcp -d $IP_SELF --dport 22 -j ACCEPT | |
| − | + | $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p icmp -d $IP_SELF1 -j ACCEPT | |
| − | + | $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p udp -d $IP_SELF1 --dport 53 -j ACCEPT | |
| − | + | $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p tcp -d $IP_SELF1 --dport 22 -j ACCEPT | |
| − | + | #Vyjimka pro kecalka pro podporu | |
| − | + | $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p tcp -d 67.23.29.84 --dport 80 -j ACCEPT | |
| − | + | $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p tcp -d 67.23.27.61 --dport 80 -j ACCEPT | |
| − | + | #Jinak vse ostatni zahod. | |
| − | + | $IPTABLES -t nat -A PREROUTING -m set --set ranges src -j DROP | |
| − | + | exit 1 | |
| − | + | ;; | |
| − | + | restart) | |
| − | + | $0 stop | |
| − | + | $0 start | |
| − | + | exit 1 | |
| − | + | ;; | |
| − | + | update) | |
| − | + | update | |
| − | + | exit 1 | |
| − | + | ;; | |
| − | + | stop) | |
| − | + | echo "Deleting firewall rules."; | |
| − | + | #Pravidlo pro pridani ip do setu members. Pokud projde firewallem packet na danou cilovou ip prida se zdrojova ip do setu members. | |
| − | + | $IPTABLES -t nat -D PREROUTING -m set --set ranges src -d $IP_TARGET -j SET --add-set members src | |
| − | + | #Pokud uz je ip v setu members nebo partners neaplikuje se presmerovani. | |
| − | + | $IPTABLES -t nat -D PREROUTING -m set --set partners src -j ACCEPT | |
| − | + | $IPTABLES -t nat -D PREROUTING -m set --set members src -j ACCEPT | |
| − | + | #Povoleni portu 36000 pro potreby presmerovani. Na tomto portu nasloucha webserver a provede presmerovani na zvolenou url. | |
| − | + | $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p tcp --dport $PORT_REDIRECT -j ACCEPT | |
| − | + | #Presmerovani vseho co miri do internetu a ma cilovy port 80 na port 36000. | |
| − | + | $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p tcp --dport $PORT_WEB -j REDIRECT --to-port $PORT_REDIRECT | |
| − | + | #Vyjimky ip adres a portu ktere budou fungovat i po presmerovani. | |
| − | + | $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p icmp -d $IP_SELF -j ACCEPT | |
| − | + | $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p udp -d $IP_SELF --dport 53 -j ACCEPT | |
| − | + | $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p tcp -d $IP_SELF --dport 22 -j ACCEPT | |
| − | + | $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p icmp -d $IP_SELF1 -j ACCEPT | |
| − | + | $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p udp -d $IP_SELF1 --dport 53 -j ACCEPT | |
| − | + | $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p tcp -d $IP_SELF1 --dport 22 -j ACCEPT | |
| − | + | #Vyjimka pro kecalka pro podporu | |
| − | + | $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p tcp -d 67.23.29.84 --dport 80 -j ACCEPT | |
| − | + | $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p tcp -d 67.23.27.61 --dport 80 -j ACCEPT | |
| − | + | #Jinak vse ostatni zahod. | |
| − | + | $IPTABLES -t nat -D PREROUTING -m set --set ranges src -j DROP | |
| − | + | echo "Deleting sets."; | |
| − | + | ipset -X ranges | |
| − | + | ipset -X partners | |
| − | + | ipset -X members | |
| − | + | exit 1 | |
| − | + | ;; | |
| − | + | esac | |
| − | + | exit 0 | |
| + | |||
| + | </nowiki> | ||
Verze z 1. 3. 2010, 08:25
################################################################################## #! /bin/sh # # # # Skript pro presmerovani ip adres. Data jsou nacitana automaticky z freenetisu. # # # # autor Sevcik Roman 2009 # # email sevcik.roman@slfree.net # # # ################################################################################## IPTABLES=/usr/local/sbin/iptables IP_SELF=10.143.128.1 IP_SELF1=10.143.129.0 IP_TARGET=212.111.4.121 PORT_WEB=80 PORT_REDIRECT=36000 SET_URL_RANGES=http://freenetis.slfree.net/cs/redirect/ipset/ranges SET_URL_PARTNERS=http://freenetis.slfree.net/cs/redirect/ipset/partners SET_URL_MEMBERS=http://freenetis.slfree.net/cs/redirect/ipset/members # Funkce testuje jestli je dana ip validne zapsana # @param ip adresa # return 1 pokud je ip validni function valid_ip() { local ip=$1 local stat=1 if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then OIFS=$IFS IFS='.' ip=($ip) IFS=$OIFS [[ ${ip[0]} -le 255 && ${ip[1]} -le 255 && ${ip[2]} -le 255 && ${ip[3]} -le 255 ]] stat=$? fi return $stat } # Funkce testuje jestli je dany subnet validne zapsany # @param subnet # return 1 pokud je subnet validni function valid_subnet() { local subnet=$1 local stat=1 if [[ $subnet =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/[0-9]{1,2}$ ]]; then OIFS=$IFS IFS='/' subnet=($subnet) IFS='.' ip=${subnet[0]} ip=($ip) mask=${subnet[1]} IFS=$OIFS [[ ${ip[0]} -le 255 && ${ip[1]} -le 255 && ${ip[2]} -le 255 && ${ip[3]} -le 255 ]] [[ $mask -le 31 ]] stat=$? fi return $stat } function update() { #Vymazeme obsah vsech setu echo "Erasing content of sets."; ipset -F ranges ipset -F partners ipset -F members echo "Downloading data"; wget -q -O /tmp/ranges $SET_URL_RANGES wget -q -O /tmp/partners $SET_URL_PARTNERS wget -q -O /tmp/members $SET_URL_MEMBERS BAKIFS=$IFS IFS=$(echo -en "\n\b") exec 3<&0 #Plnime set partners echo "Filling set partnets."; exec 0</tmp/partners while read LINE do if valid_subnet $LINE; then echo "$LINE - added to set partners."; ipset -A partners $LINE; else echo "$LINE - not valid subnet."; fi done #Plnime set members echo "Filling set members."; exec 0</tmp/members while read LINE do if valid_ip $LINE; then echo "$LINE - added to set members."; ipset -A members $LINE; else echo "$LINE - not valid IP address."; fi done #Plnime set ranges - je nutne aby se plnil az na konci. Jinak by byly presmerovane ip v dobe kdy se set nenbers a partners teprve plni. echo "Filling set ranges."; exec 0</tmp/ranges while read LINE do if valid_subnet $LINE; then echo "$LINE - added to set ranges."; ipset -A ranges $LINE; else echo "$LINE - not valid subnet."; fi done exec 0<&3 IFS=$BAKIFS #Cleaning up rm /tmp/ranges rm /tmp/partners rm /tmp/members } case "$1" in start) echo "Adding sets."; ipset -N ranges nethash --hashsize 1024 --probes 4 --resize 50 ipset -N partners nethash --hashsize 1024 --probes 4 --resize 50 ipset -N members iphash --hashsize 10000 --probes 8 --resize 50 echo "Adding firewall rules."; #Pravidlo pro pridani ip do setu members. Pokud projde firewallem packet na danou cilovou ip prida se zdrojova ip do setu members. $IPTABLES -t nat -A PREROUTING -m set --set ranges src -d $IP_TARGET -j SET --add-set members src #Pokud uz je ip v setu members nebo partners neaplikuje se presmerovani. $IPTABLES -t nat -A PREROUTING -m set --set partners src -j ACCEPT $IPTABLES -t nat -A PREROUTING -m set --set members src -j ACCEPT #Povoleni portu 36000 pro potreby presmerovani. Na tomto portu nasloucha webserver a provede presmerovani na zvolenou url. $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p tcp --dport $PORT_REDIRECT -j ACCEPT #Presmerovani vseho co miri do internetu a ma cilovy port 80 na port 36000. $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p tcp --dport $PORT_WEB -j REDIRECT --to-port $PORT_REDIRECT #Vyjimky ip adres a portu ktere budou fungovat i po presmerovani. $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p icmp -d $IP_SELF -j ACCEPT $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p udp -d $IP_SELF --dport 53 -j ACCEPT $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p tcp -d $IP_SELF --dport 22 -j ACCEPT $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p icmp -d $IP_SELF1 -j ACCEPT $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p udp -d $IP_SELF1 --dport 53 -j ACCEPT $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p tcp -d $IP_SELF1 --dport 22 -j ACCEPT #Vyjimka pro kecalka pro podporu $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p tcp -d 67.23.29.84 --dport 80 -j ACCEPT $IPTABLES -t nat -A PREROUTING -m set --set ranges src -p tcp -d 67.23.27.61 --dport 80 -j ACCEPT #Jinak vse ostatni zahod. $IPTABLES -t nat -A PREROUTING -m set --set ranges src -j DROP exit 1 ;; restart) $0 stop $0 start exit 1 ;; update) update exit 1 ;; stop) echo "Deleting firewall rules."; #Pravidlo pro pridani ip do setu members. Pokud projde firewallem packet na danou cilovou ip prida se zdrojova ip do setu members. $IPTABLES -t nat -D PREROUTING -m set --set ranges src -d $IP_TARGET -j SET --add-set members src #Pokud uz je ip v setu members nebo partners neaplikuje se presmerovani. $IPTABLES -t nat -D PREROUTING -m set --set partners src -j ACCEPT $IPTABLES -t nat -D PREROUTING -m set --set members src -j ACCEPT #Povoleni portu 36000 pro potreby presmerovani. Na tomto portu nasloucha webserver a provede presmerovani na zvolenou url. $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p tcp --dport $PORT_REDIRECT -j ACCEPT #Presmerovani vseho co miri do internetu a ma cilovy port 80 na port 36000. $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p tcp --dport $PORT_WEB -j REDIRECT --to-port $PORT_REDIRECT #Vyjimky ip adres a portu ktere budou fungovat i po presmerovani. $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p icmp -d $IP_SELF -j ACCEPT $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p udp -d $IP_SELF --dport 53 -j ACCEPT $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p tcp -d $IP_SELF --dport 22 -j ACCEPT $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p icmp -d $IP_SELF1 -j ACCEPT $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p udp -d $IP_SELF1 --dport 53 -j ACCEPT $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p tcp -d $IP_SELF1 --dport 22 -j ACCEPT #Vyjimka pro kecalka pro podporu $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p tcp -d 67.23.29.84 --dport 80 -j ACCEPT $IPTABLES -t nat -D PREROUTING -m set --set ranges src -p tcp -d 67.23.27.61 --dport 80 -j ACCEPT #Jinak vse ostatni zahod. $IPTABLES -t nat -D PREROUTING -m set --set ranges src -j DROP echo "Deleting sets."; ipset -X ranges ipset -X partners ipset -X members exit 1 ;; esac exit 0
