diff --git a/routing/rc.local b/routing/rc.local index 3bf5628..01cb8ca 100755 --- a/routing/rc.local +++ b/routing/rc.local @@ -11,30 +11,30 @@ # # By default this script does nothing. iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o tun+ -j SNAT --to 185.117.82.237 -iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o eth1.999 -j SNAT --to 185.117.82.237 -#iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o eth1.6 -j MASQUERADE # REMOVE WHEN TESTING IN INITLAB DONE -iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth1.10 -j MASQUERADE -#iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth1.6 -j MASQUERADE # REMOVE WHEN TESTING IN INITLAB DONE +iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o bond0.999 -j SNAT --to 185.117.82.237 +#iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o bond0.6 -j MASQUERADE # REMOVE WHEN TESTING IN INITLAB DONE +iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o bond0.10 -j MASQUERADE +#iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o bond0.6 -j MASQUERADE # REMOVE WHEN TESTING IN INITLAB DONE # BCP38 filter -iptables -A FORWARD ! -s 10.20.0.0/22 -i eth1.20 -j DROP -iptables -A FORWARD ! -s 10.21.0.0/22 -i eth1.21 -j DROP -iptables -A FORWARD ! -s 10.22.0.0/22 -i eth1.22 -j DROP -iptables -A FORWARD ! -s 10.23.0.0/22 -i eth1.23 -j DROP -iptables -A FORWARD ! -s 10.24.0.0/22 -i eth1.24 -j DROP +iptables -A FORWARD ! -s 10.20.0.0/22 -i bond0.20 -j DROP +iptables -A FORWARD ! -s 10.21.0.0/22 -i bond0.21 -j DROP +iptables -A FORWARD ! -s 10.22.0.0/22 -i bond0.22 -j DROP +iptables -A FORWARD ! -s 10.23.0.0/22 -i bond0.23 -j DROP +iptables -A FORWARD ! -s 10.24.0.0/22 -i bond0.24 -j DROP # zone firewall for i in 20 23 24; do iptables -A FORWARD -d 10.${i}.0.0/24 -i tun+ -j ACCEPT - iptables -A FORWARD -d 10.${i}.0.0/24 -i eth1.999 -j ACCEPT + iptables -A FORWARD -d 10.${i}.0.0/24 -i bond0.999 -j ACCEPT iptables -A FORWARD -d 10.${i}.0.0/24 -j DROP done -iptables -A FORWARD -d 10.24.0.0/24 ! -i eth1.10 -j DROP -#iptables -A FORWARD -d 10.20.0.0/24 ! -i eth1.6 -j DROP # REMOVE WHEN TESTING IN INITLAB DONE -#iptables -A FORWARD -d 10.23.0.0/24 ! -i eth1.6 -j DROP # REMOVE WHEN TESTING IN INITLAB DONE -#iptables -A FORWARD -d 10.24.0.0/24 ! -i eth1.6 -j DROP # REMOVE WHEN TESTING IN INITLAB DONE +iptables -A FORWARD -d 10.24.0.0/24 ! -i bond0.10 -j DROP +#iptables -A FORWARD -d 10.20.0.0/24 ! -i bond0.6 -j DROP # REMOVE WHEN TESTING IN INITLAB DONE +#iptables -A FORWARD -d 10.23.0.0/24 ! -i bond0.6 -j DROP # REMOVE WHEN TESTING IN INITLAB DONE +#iptables -A FORWARD -d 10.24.0.0/24 ! -i bond0.6 -j DROP # REMOVE WHEN TESTING IN INITLAB DONE iptables -A FORWARD -p tcp --dport 25 -j DROP @@ -42,11 +42,11 @@ iptables -A FORWARD -p tcp --dport 25 -j DROP ip rule add from 94.26.100.155 iif lo table tbc ip rule add from 194.141.112.139 iif lo table tpark -echo 1 > /proc/sys/net/ipv4/conf/eth1.21/proxy_arp_pvlan -echo 1 > /proc/sys/net/ipv4/conf/eth1.22/proxy_arp_pvlan +echo 1 > /proc/sys/net/ipv4/conf/bond0.21/proxy_arp_pvlan +echo 1 > /proc/sys/net/ipv4/conf/bond0.22/proxy_arp_pvlan -echo 0 > /proc/sys/net/ipv4/conf/eth1.21/send_redirects -echo 0 > /proc/sys/net/ipv4/conf/eth1.22/send_redirects +echo 0 > /proc/sys/net/ipv4/conf/bond0.21/send_redirects +echo 0 > /proc/sys/net/ipv4/conf/bond0.22/send_redirects echo 8388608 > /proc/sys/net/core/wmem_max echo 8388608 > /proc/sys/net/core/wmem_default