nigger/lixonet-ee
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update tinc-up.tmpl

Browse Source
This commit is contained in:
Manevolent 2023-04-23 20:20:57 -06:00 committed by GitHub
parent c69496f85a
commit 0cc168bc33
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
tinc/tinc-up.tmpl
View File

@ -13,14 +13,18 @@ ifconfig ${internal_interface} ${internal_address6}/${internal_mask6:-128}
iptables -t nat -I PREROUTING -d {{ . }} -i eth0 -j DNAT --to-destination ${tinc_peer_address} iptables -t nat -I PREROUTING -d {{ . }} -i eth0 -j DNAT --to-destination ${tinc_peer_address}
{{ end }}{{ end }} {{ end }}{{ end }}
# Enable IPv4 kernel routing/forwarding for this network # Plugins may communicate over eth0, the 'internal' docker network.
iptables -A FORWARD -o \$INTERFACE -d ${network_address}/${global_prefix:-16} -j ACCEPT # Because of this, we should allow masquerading NAT through eth0
{{ if len "${bgp_routes:-}" }}{{ range "$bgp_routes" | split "," }}iptables -A FORWARD -o eth0 -d {{.}} -j ACCEPT iptables -t nat -A POSTROUTING -i eth0 -o \$INTERFACE -j MASQUERADE
{{ end }}{{ end }}
# Prevent spoofing attacks # Prevent spoofing attacks
iptables -A FORWARD -i \$INTERFACE ! -s ${network_address}/${global_prefix:-16} -j DROP iptables -A FORWARD -i \$INTERFACE ! -s ${network_address}/${global_prefix:-16} -j DROP
{{ if len "${bgp_routes:-}" }}{{ range "$bgp_routes" | split "," }}iptables -A FORWARD -i \$INTERFACE -s {{.}} -j DROP {{ if len "${bgp_routes:-}" }}{{ range "$bgp_routes" | split "," }}iptables -A FORWARD -i \$INTERFACE -s {{.}} -j DROP
{{ end }}{{ end }} {{ end }}{{ end }}
# Enable IPv4 kernel routing/forwarding for this network
iptables -A FORWARD -o \$INTERFACE -d ${network_address}/${global_prefix:-16} -j ACCEPT
{{ if len "${bgp_routes:-}" }}{{ range "$bgp_routes" | split "," }}iptables -A FORWARD -o eth0 -d {{.}} -j ACCEPT
{{ end }}{{ end }}
ifconfig \$INTERFACE ${tinc_peer_address} netmask ${netmask:-255.255.255.0} ifconfig \$INTERFACE ${tinc_peer_address} netmask ${netmask:-255.255.255.0}