release/src-rt-6.x.4708/router/others/vpnrouting

   1 #!/bin/sh
   2
   3 #
   4 # Copyright (C) 2015 shibby
   5 #
   6
   7 SERVICE=$1
   8 ACTION=$2
   9
  10
  11 find_iface(){
  12     if [ "$SERVICE" == "client1" ]; then
  13         IFACE="tun11"
  14         ID="111"
  15     elif [ "$SERVICE" == "client2" ]; then
  16         IFACE="tun12"
  17         ID="112"
  18     else
  19         echo "vpnrouting: Interface not found"
  20         exit 0
  21     fi
  22
  23     FIREWALL="/etc/openvpn/fw/vpnrouting$ID.sh"
  24 }
  25
  26 cleanup(){
  27     ip route flush table $ID
  28     ip route flush cache
  29     RULE=`ip rule | grep "lookup $ID" | wc -l`
  30     if [ "$RULE" -gt 0 ]; then
  31         ip rule del fwmark $ID table $ID
  32     fi
  33
  34     rm $FIREWALL
  35     service firewall restart
  36
  37     ipset destroy vpnrouting$ID
  38     sed -i /etc/dnsmasq.ipset -e "/vpnrouting$ID/d"
  39
  40     logger vpnrouting: clean-up
  41 }
  42
  43 case "$ACTION" in
  44 "start")
  45     find_iface
  46     cleanup
  47
  48     CONNECTED="0"
  49     VPN_GW=""
  50
  51     #wait for gateway
  52     while [ $CONNECTED == "0" ]; do
  53         VPN_GW=`ifconfig $IFACE | awk '/inet addr/ {split ($2,A,":"); print A[2]}'`
  54         if [ -n "$VPN_GW" ]; then
  55             logger vpnrouting: got gateway for $IFACE - IP $VPN_GW - ID $ID
  56             CONNECTED="1"
  57         else
  58             logger vpnrouting: searching gateway for $IFACE
  59             sleep 3
  60         fi
  61     done
  62
  63     #logger vpnrouting: Applying routing on VPN $SERVICE - Interface $IFACE - Table $ID - GW $VPN_GW
  64
  65     ip route add table $ID default via $VPN_GW dev $IFACE
  66     ip rule add fwmark $ID table $ID priority 1000
  67
  68     modprobe xt_set
  69     modprobe ip_set
  70     modprobe ip_set_hash_ip
  71     ipset create vpnrouting$ID hash:ip
  72
  73     echo "#!/bin/sh" > $FIREWALL
  74     echo "echo 0 > /proc/sys/net/ipv4/conf/$IFACE/rp_filter" >> $FIREWALL
  75     echo "echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter" >> $FIREWALL
  76     echo "iptables -t mangle -A PREROUTING -m set --match-set vpnrouting$ID dst,src -j MARK --set-mark $ID" >> $FIREWALL
  77
  78     #example of routing_val: 1<2<8.8.8.8>1<1<1.2.3.4>1<3<domain.com>
  79     VALUE=`nvram get vpn_"$SERVICE"_routing_val`
  80
  81     DNSMASQ="0"
  82
  83     for i in $(echo $VALUE | tr ">" "\n")
  84     do
  85         VAL1=`echo $i | cut -d "<" -f1`
  86         VAL2=`echo $i | cut -d "<" -f2`
  87         VAL3=`echo $i | cut -d "<" -f3`
  88
  89         #only if rule is enabled
  90         if [ "$VAL1" == "1" ]; then
  91
  92             case "$VAL2" in
  93                 1) #from source
  94                     logger vpnrouting: Type: $VAL2 - add $VAL3
  95                     echo "iptables -t mangle -A PREROUTING -s $VAL3 -j MARK --set-mark $ID" >> $FIREWALL
  96                     ;;
  97                 2) #to destination
  98                     logger vpnrouting: Type: $VAL2 - add $VAL3
  99                     echo "iptables -t mangle -A PREROUTING -d $VAL3 -j MARK --set-mark $ID" >> $FIREWALL
 100                     ;;
 101                 3) #to domain
 102                     logger vpnrouting: Type: $VAL2 - add $VAL3
 103                     echo "ipset=/$VAL3/vpnrouting$ID" >> /etc/dnsmasq.ipset
 104
 105                     #try to add ipset rule using forced query to DNS server
 106                     nslookup $VAL3 127.0.0.1 > /dev/null
 107
 108                     DNSMASQ="1"
 109                     ;;
 110                 *) continue ;;
 111             esac
 112         fi
 113     done
 114
 115     chmod +x $FIREWALL
 116     service firewall restart
 117
 118     if [ "$DNSMASQ" == "1" ]; then
 119         service dnsmasq restart
 120     fi
 121     ;;
 122 "stop")
 123     find_iface
 124     cleanup
 125     ;;
 126 *)
 127     echo "vpnrouting: unsupported command"
 128     exit 0
 129     ;;
 130 esac