lixonet-ee/tinc/tinc-up.tmpl

19 lines
1.2 KiB
Cheetah
Raw Normal View History

#!/bin/sh
2020-06-22 00:32:04 +00:00
sysctl -w net.ipv6.conf.\$INTERFACE.disable_ipv6=1 || echo "[WARNING] IPv6 couldn't be disabled on the \$INTERFACE interface! Make sure you disable IPv6 at the host level with sysctl -w net.ipv6.conf.all.disable_ipv6=1"
2020-06-21 21:34:24 +00:00
2020-06-21 04:22:23 +00:00
{{ if len "${vip:-}" }}ifconfig "\$INTERFACE:0" ${vip}{{ end }}
{{ if len "${ip_aliases:-}" }}{{ range "$ip_aliases" | split "," }}iptables -t nat -I PREROUTING -d {{ . }} -i \$INTERFACE -j DNAT --to-destination ${tinc_peer_address}
iptables -t nat -I PREROUTING -d {{ . }} -i ${internal_interface:-eth0} -j DNAT --to-destination ${tinc_peer_address}
{{ end }}{{ end }}
2020-06-08 15:28:22 +00:00
# Enable IPv4 kernel routing/forwarding for this network
iptables -A FORWARD -o \$INTERFACE -d ${network_address}/${global_prefix:-16} -j ACCEPT
{{ if len "${bgp_routes:-}" }}{{ range "$bgp_routes" | split "," }}iptables -A FORWARD -o ${internal_interface:-eth0} -d {{.}} -j ACCEPT
2020-06-08 15:28:22 +00:00
{{ end }}{{ end }}
2020-06-12 22:58:53 +00:00
# Prevent spoofing attacks
2020-06-12 23:16:41 +00:00
iptables -A FORWARD -i \$INTERFACE ! -s ${network_address}/${global_prefix:-16} -j DROP
2020-06-12 23:12:41 +00:00
{{ if len "${bgp_routes:-}" }}{{ range "$bgp_routes" | split "," }}iptables -A FORWARD -i \$INTERFACE -s {{.}} -j DROP
{{ end }}{{ end }}
2020-06-21 21:34:58 +00:00
ifconfig \$INTERFACE ${tinc_peer_address} netmask ${netmask:-255.255.255.0}