2 # Script to set up one of the nodes as a NAT gateway for all other nodes.
3 # This is used to ensure that all nodes in the cluster can still originate
4 # traffic to the external network even if there are no public addresses
8 [ -n "$CTDB_BASE" ] || \
9 export CTDB_BASE
=$
(cd -P $
(dirname "$0") ; dirname "$PWD")
11 .
$CTDB_BASE/functions
14 [ -n "$CTDB_NATGW_NODES" ] ||
exit 0
15 export CTDB_NATGW_NODES
19 [ -r "$CTDB_NATGW_NODES" ] || \
20 die
"error: CTDB_NATGW_NODES=${CTDB_NATGW_NODES} unreadable"
21 [ -n "$CTDB_NATGW_PUBLIC_IP" ] || \
22 die
"Invalid configuration: CTDB_NATGW_PUBLIC_IP not set"
23 [ -n "$CTDB_NATGW_PUBLIC_IFACE" ] || \
24 die
"Invalid configuration: CTDB_NATGW_PUBLIC_IFACE not set"
25 [ -n "$CTDB_NATGW_PRIVATE_NETWORK" ] || \
26 die
"Invalid configuration: CTDB_NATGW_PRIVATE_NETWORK not set"
29 natgw_set_capability
()
31 # Set NATGW capability depending on configuration
32 if [ "$CTDB_NATGW_SLAVE_ONLY" = "yes" ] ; then
33 ctdb setnatgwstate off
41 _ip
="${CTDB_NATGW_PUBLIC_IP%/*}"
42 _maskbits
="${CTDB_NATGW_PUBLIC_IP#*/}"
44 delete_ip_from_iface
$CTDB_NATGW_PUBLIC_IFACE $_ip $_maskbits >/dev
/null
2>&1
45 ip route del
0.0.0.0/0 metric
10 >/dev
/null
2>/dev
/null
47 # Delete the masquerading setup from a previous iteration where we
49 iptables
-D POSTROUTING
-t nat
-s $CTDB_NATGW_PRIVATE_NETWORK ! -d $CTDB_NATGW_PRIVATE_NETWORK -j MASQUERADE
>/dev
/null
2>/dev
/null
51 # remove any iptables rule we may have on this address
52 iptables
-D INPUT
-p tcp
--syn -d $_ip/32 -j REJECT
2>/dev
/null
57 set_proc sys
/net
/ipv
4/ip_forward
1
58 iptables
-A POSTROUTING
-t nat \
59 -s $CTDB_NATGW_PRIVATE_NETWORK ! -d $CTDB_NATGW_PRIVATE_NETWORK \
62 # block all incoming connections to the NATGW IP address
63 ctdb_natgw_public_ip_host
="${CTDB_NATGW_PUBLIC_IP%/*}/32"
64 iptables
-D INPUT
-p tcp
--syn \
65 -d $ctdb_natgw_public_ip_host -j REJECT
2>/dev
/null
66 iptables
-I INPUT
-p tcp
--syn \
67 -d $ctdb_natgw_public_ip_host -j REJECT
2>/dev
/null
69 ip addr add
$CTDB_NATGW_PUBLIC_IP dev
$CTDB_NATGW_PUBLIC_IFACE
70 ip route add
0.0.0.0/0 metric
10 via
$CTDB_NATGW_DEFAULT_GATEWAY >/dev
/null
2>/dev
/null
77 ip route add
0.0.0.0/0 via
"$_natgwip" metric
10
79 # Make sure winbindd does not stay bound to this address if we are
80 # no longer NATGW master
81 smbcontrol winbindd ip-dropped
$CTDB_NATGW_PUBLIC_IP >/dev
/null
2>&1
84 natgw_ensure_master
()
88 set -- $
(ctdb natgwlist
)
89 natgwmaster
="${1:--1}" # Default is -1 if natgwlist fails
92 if [ "$natgwmaster" = "-1" ]; then
94 die
"There is no NATGW master node"
107 # Error if CTDB_NATGW_PUBLIC_IP is listed in public addresses
108 grep -q "^$CTDB_NATGW_PUBLIC_IP[[:space:]]" "${CTDB_PUBLIC_ADDRESSES:-/etc/ctdb/public_addresses}" && \
109 die
"ERROR: NATGW configured to use a public address. NATGW must not use a public address."
111 # do not send out arp requests from loopback addresses
112 set_proc sys
/net
/ipv
4/conf
/all
/arp_announce
2
115 updatenatgw|ipreallocated
)
118 mypnn
=$
(ctdb pnn | cut
-d: -f2)
121 natgw_ensure_master
"$1"
125 if [ "$mypnn" = "$natgwmaster" ]; then
128 natgw_set_slave
"$natgwip"
131 # flush our route cache
132 set_proc sys
/net
/ipv
4/route
/flush
1
135 shutdown|removenatgw
)
143 natgw_ensure_master
"$1"
147 ctdb_standard_event_handler
"@"