| 2956 |
rexy |
1 |
#!/bin/bash
|
|
|
2 |
|
|
|
3 |
# alcasar-network.sh
|
|
|
4 |
# by Pierre RIVAULT and Rexy
|
|
|
5 |
# This script is distributed under the Gnu General Public License (GPL)
|
|
|
6 |
|
|
|
7 |
# Met à jour la configuration réseau conformément au fichier de configuration (alcasar.conf)
|
|
|
8 |
# update network configuration according to alcasar.conf
|
|
|
9 |
|
|
|
10 |
CONF_FILE="/usr/local/etc/alcasar.conf"
|
|
|
11 |
TMP_ip_gw_save="/tmp/ipset_ip_gw_save"
|
|
|
12 |
EXTIF=`grep ^EXTIF= $CONF_FILE|cut -d"=" -f2`
|
|
|
13 |
PUBLIC_IP=`grep ^PUBLIC_IP= $CONF_FILE|cut -d"=" -f2`
|
| 2983 |
rexy |
14 |
if [ $PUBLIC_IP != "dhcp" ]; then
|
|
|
15 |
GW1=`grep ^GW= $CONF_FILE|cut -d"=" -f2`
|
|
|
16 |
MTU=`grep ^PUBLIC_MTU= $CONF_FILE|cut -d"=" -f2`
|
|
|
17 |
MULTIWAN=`grep ^MULTIWAN= $CONF_FILE|cut -d"=" -f2`
|
|
|
18 |
MULTIWAN=${MULTIWAN:=off}
|
|
|
19 |
NET="`ipcalc -n $PUBLIC_IP | cut -d"=" -f2`/`ipcalc -p $PUBLIC_IP | cut -d"=" -f2`"
|
|
|
20 |
IP=`echo $PUBLIC_IP | cut -d"/" -f1`
|
|
|
21 |
PRIVATE_IP_MASK=`grep ^PRIVATE_IP $CONF_FILE | cut -d"=" -f2`
|
|
|
22 |
PRIVATE_IP=`echo $PRIVATE_IP_MASK | cut -d"/" -f1`
|
|
|
23 |
PRIVATE_NETMASK=`echo $PRIVATE_IP_MASK | cut -d"/" -f2`
|
|
|
24 |
PRIVATE_PREFIX=`/bin/ipcalc -p $PRIVATE_IP $PRIVATE_NETMASK |cut -d"=" -f2` # prefixe du réseau (ex. 24)
|
|
|
25 |
PRIVATE_NETWORK=`/bin/ipcalc -n $PRIVATE_IP $PRIVATE_NETMASK| cut -d"=" -f2` # @ réseau de consultation (ex.: 192.168.182.0)
|
|
|
26 |
PRIVATE_NETWORK_MASK=$PRIVATE_NETWORK/$PRIVATE_PREFIX # @ + masque du réseau de consult (192.168.182.0/24)
|
|
|
27 |
nb_gw=`grep ^WAN $CONF_FILE | wc -l`
|
|
|
28 |
fi
|
| 2956 |
rexy |
29 |
routecmd="ip route replace default scope global"
|
|
|
30 |
|
|
|
31 |
if [ $(whoami) != "root" ]; then
|
|
|
32 |
echo "You must be root to run this!" ; echo ; exit 1
|
|
|
33 |
fi
|
|
|
34 |
|
|
|
35 |
if [ $# -eq 0 ]; then
|
|
|
36 |
args="--apply"
|
|
|
37 |
else
|
|
|
38 |
args=$1
|
|
|
39 |
fi
|
|
|
40 |
|
|
|
41 |
case $args in
|
| 2960 |
rexy |
42 |
--save) # save all the IP before changing the configuration
|
| 2956 |
rexy |
43 |
rm -f $TMP_ip_gw_save
|
| 2960 |
rexy |
44 |
gw_list="gw0" # ipset name list for load_balancing
|
| 2956 |
rexy |
45 |
for ((i=1 ; i<=$nb_gw ; i++)); do
|
|
|
46 |
gw_list="${gw_list} gw$i"
|
|
|
47 |
done
|
|
|
48 |
# Saving all of the already connected IP in order to put them back in the load balancing after
|
|
|
49 |
for i in $gw_list;do
|
|
|
50 |
ipset list $i 1>/dev/null 2>&1
|
|
|
51 |
if [ $? -eq 0 ]
|
|
|
52 |
then
|
|
|
53 |
# the cut -d":" -f5 deletes all the lines with a :, i.e all the lines except the members
|
| 2960 |
rexy |
54 |
ipset list $i | grep -v ":" >> $TMP_ip_gw_save
|
| 2956 |
rexy |
55 |
fi
|
|
|
56 |
done
|
|
|
57 |
exit 0
|
|
|
58 |
;;
|
|
|
59 |
--apply)
|
|
|
60 |
[ -e /etc/sysconfig/network-scripts/ifcfg-$EXTIF ] && ifdown $EXTIF
|
|
|
61 |
# set the new configuration for EXTIF
|
| 2983 |
rexy |
62 |
if [ $PUBLIC_IP == "dhcp" ]; then
|
|
|
63 |
cat <<EOF > /etc/sysconfig/network-scripts/ifcfg-$EXTIF
|
| 2956 |
rexy |
64 |
DEVICE=$EXTIF
|
| 2983 |
rexy |
65 |
BOOTPROTO=dhcp
|
|
|
66 |
DNS1=127.0.0.1
|
|
|
67 |
PEERDNS=no
|
|
|
68 |
RESOLV_MODS=yes
|
|
|
69 |
ONBOOT=yes
|
|
|
70 |
NOZEROCONF=yes
|
|
|
71 |
METRIC=10
|
|
|
72 |
MII_NOT_SUPPORTED=yes
|
|
|
73 |
IPV6INIT=no
|
|
|
74 |
IPV6TO4INIT=no
|
|
|
75 |
ACCOUNTING=no
|
|
|
76 |
USERCTL=no
|
|
|
77 |
MTU=$MTU
|
|
|
78 |
EOF
|
|
|
79 |
ifup $EXTIF
|
|
|
80 |
else
|
|
|
81 |
cat <<EOF > /etc/sysconfig/network-scripts/ifcfg-$EXTIF
|
|
|
82 |
DEVICE=$EXTIF
|
| 2956 |
rexy |
83 |
BOOTPROTO=static
|
|
|
84 |
IPADDR=$IP
|
|
|
85 |
NETMASK=`ipcalc -m $PUBLIC_IP | cut -d= -f2`
|
|
|
86 |
NETWORK=`ipcalc -n $PUBLIC_IP | cut -d= -f2`
|
|
|
87 |
GATEWAY=$GW1
|
|
|
88 |
DNS1=127.0.0.1
|
|
|
89 |
RESOLV_MODS=yes
|
|
|
90 |
ONBOOT=yes
|
|
|
91 |
METRIC=10
|
|
|
92 |
MII_NOT_SUPPORTED=yes
|
|
|
93 |
IPV6INIT=no
|
|
|
94 |
IPV6TO4INIT=no
|
|
|
95 |
ACCOUNTING=no
|
|
|
96 |
USERCTL=no
|
|
|
97 |
MTU=$MTU
|
|
|
98 |
NOZEROCONF=yes
|
|
|
99 |
EOF
|
| 2983 |
rexy |
100 |
ifup $EXTIF
|
|
|
101 |
ip route flush ${NET} # Remove the previous route for the network of EXTIF
|
|
|
102 |
ip route delete default scope global # Remove the previous default route
|
|
|
103 |
ip route add ${NET} dev ${EXTIF} src ${IP} # Set the new route for EXTIF network
|
|
|
104 |
ip route add ${NET} dev ${EXTIF} src ${IP} table 200 # Set the new default route. If no multiwan, these lines are equivalent to `ip route add default via ${GW1}`
|
|
|
105 |
ip route add default via ${GW1} table 200
|
|
|
106 |
routecmd="${routecmd} nexthop via ${GW1} dev ${EXTIF}"
|
|
|
107 |
ip rule flush # Remove the previous routing rules
|
|
|
108 |
ip rule add from all lookup main pref 32766 # Set back the main rules
|
|
|
109 |
ip rule add from all lookup default pref 32767 # Set back the default rules
|
|
|
110 |
ip rule add from ${PRIVATE_NETWORK_MASK} fwmark 200 lookup 200 # Add the rule for the first gateway
|
|
|
111 |
if [ "$MULTIWAN" == "on" ] || [ "$MULTIWAN" == "On" ]; then
|
|
|
112 |
nb_gw_supp=`grep ^WAN $CONF_FILE|wc -l`
|
|
|
113 |
for ((i=0 ; $i < $nb_gw_supp ; i++)); do
|
|
|
114 |
table=$(($i + 201)) # This number is used to mark the paquets in order to route them to the choosen GW
|
|
|
115 |
GW=`grep ^WAN$(($i + 1))= $CONF_FILE|awk -F'"' '{ print $2 }' | awk -F, '{print $1}'`
|
|
|
116 |
ip route add ${NET} dev ${EXTIF} src ${IP} table $table # Add the others route in their respective tables
|
|
|
117 |
ip route add default via ${GW} table $table
|
|
|
118 |
ip rule add from ${PRIVATE_NETWORK_MASK} fwmark $table lookup $table # Add the rule for each rule depending of the mark set by the firewall
|
|
|
119 |
routecmd="${routecmd} nexthop via ${GW} dev ${EXTIF}" # add the added gateway into the default gateway
|
|
|
120 |
done
|
|
|
121 |
fi
|
|
|
122 |
${routecmd} # define the default gateway for outgoing traffic
|
|
|
123 |
ip route flush cache
|
| 2956 |
rexy |
124 |
fi
|
| 2983 |
rexy |
125 |
/usr/local/bin/alcasar-iptables.sh
|
| 2956 |
rexy |
126 |
exit 0
|
|
|
127 |
;;
|
|
|
128 |
*)
|
|
|
129 |
exit 1
|
|
|
130 |
;;
|
|
|
131 |
esac
|