gregoryfenton
04-10-2013, 11:23
After a (definitely earned) good night's sleep I have completed my script.
Thanks for all your help Myatu, it was massively appreciated.
I have added this script to the howto section, save it getting lost
http://forum.ovh.co.uk/showthread.php?p=55961#post55961
Here's my script:
Thanks for all your help Myatu, it was massively appreciated.
I have added this script to the howto section, save it getting lost
http://forum.ovh.co.uk/showthread.php?p=55961#post55961
Here's my script:
Code:
#!/bin/bash
sys=`which sysctl`
ipt=`which iptables`
mp=`which modprobe`
grep=`which grep`
if [[ "$sys" == "" || $ipt == "" || $mp == "" || $grep == "" ]]; then
echo "Error - needed program not found"
return -1
fi
services=/etc/services
function getport
{
local a b p
p=$1
if [ "$p" == "" ]; then
echo "noport"
return
fi
a=`$grep -m 1 -w "$p" $services`
if [ "$a" == "" ]; then
echo "no match"
return
fi
b=${a%%/*}
p=${b%%$p*}
echo -n $p
}
ipprefix=192.168.0
#the IP below ($proxyip) handles all requests for $proxiedports from the outside world
proxyip=200
#Starting IP
firstip=200
dns=53
http=80
ftp=21
ssh=22
rsync=873
proxiedports=( $dns $http )
#VM names
vm1=201
vm2=202
vm3=203
vm4=204
toips=( $proxyip $vm1 $vm2 $vm3 $vm4 )
ports=( $ftp $ssh $dns $http $rsync )
netmask=24
extif=vmbr0
intif=vmbr1
#Flush iptables
$ipt -F
$ipt -t nat -F
# Net Sharing
$mp iptable_nat
echo Enabling ipv4 forwarding
$sys net.ipv4.ip_forward=1
echo 1 > /proc/sys/net/ipv4/ip_forward
$ipt -t nat -A POSTROUTING -o eth0 -j MASQUERADE
$ipt -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$ipt -A INPUT -i lo -j ACCEPT
$ipt -A INPUT -j LOG --log-level 4 --log-prefix "ATTACK"
$ipt -A INPUT -j DROP
# Add your additional rules here
$ipt -t nat -A POSTROUTING -s $ipprefix.0/$netmask -j MASQUERADE
#hardcoded rules
#default services that need remapping and must remain on a standard port:
# DNS (port $dns)
# Web server (port $http)
#both of these will be handled by the first VM
for port in ${proxiedports[@]}; do
echo Setting up $ipprefix.$proxyip to handle external calls to port $port \($(getport $port)\)
$ipt -t nat -A PREROUTING -p tcp -i $extif --dport $port -j DNAT --to-destination $ipprefix.$proxyip:$port
$ipt -t nat -A POSTROUTING -p tcp -o $extif -d $ipprefix.$proxyip --dport $port -j MASQUERADE
$ipt -t nat -A PREROUTING -p udp -i $extif --dport $port -j DNAT --to-destination $ipprefix.$proxyip:$port
$ipt -t nat -A POSTROUTING -p udp -o $extif -d $ipprefix.$proxyip --dport $port -j MASQUERADE
done
count=0
for toip in ${toips[@]}; do
echo Configuring VM $ipprefix.$toip
for port in ${ports[@]}; do
oldport=$port
if [ $(printf "%.0f" $port) -gt 99 ]; then
port=$(echo "scale=1; $port / 10" | bc)
if [ $(printf "%.0f" $port) -gt 99 ]; then
port=$(echo "scale=1; $port / 10" | bc)
fi
fi
mport=$(printf "%.0f" `echo "scale=0; ($port * 100) + ($toip - $firstip)" | bc`)
port=$oldport
echo mapping external port $mport to $ipprefix.$toip:$port \($(getport $port)\)
$ipt -t nat -D PREROUTING -i $extif -p tcp --dport $mport -j DNAT --to-destination $ipprefix.$toip:$port > /dev/null 2>&1
$ipt -t nat -D POSTROUTING -o $extif -p tcp -d $ipprefix.$toip --dport $port -j MASQUERADE > /dev/null 2>&1
$ipt -t nat -A PREROUTING -i $extif -p tcp --dport $mport -j DNAT --to-destination $ipprefix.$toip:$port
$ipt -t nat -A POSTROUTING -o $extif -p tcp -d $ipprefix.$toip --dport $port -j MASQUERADE
done
done
return 1
Originally Posted by gregoryfenton