Unverified Commit 63c60d12 authored by Kroese's avatar Kroese Committed by GitHub
Browse files

fix: iptables for NAT (#278)

parent 2e1a1d64

src/network.sh

+23 −24
Original line number Diff line number Diff line
@@ -93,6 +93,26 @@ configureDNS() { 


configureNAT() {



  # Create the necessary file structure for /dev/net/tun

  if [ ! -c /dev/net/tun ]; then

    [ ! -d /dev/net ] && mkdir -m 755 /dev/net

    if mknod /dev/net/tun c 10 200; then

      chmod 666 /dev/net/tun

    fi

  fi



  if [ ! -c /dev/net/tun ]; then

    error "TUN device missing. $ADD_ERR --cap-add NET_ADMIN" && exit 25

  fi



  # Check port forwarding flag

  if [[ $(< /proc/sys/net/ipv4/ip_forward) -eq 0 ]]; then

    { sysctl -w net.ipv4.ip_forward=1 ; rc=$?; } || :

    if (( rc != 0 )); then

      error "IP forwarding is disabled. $ADD_ERR --sysctl net.ipv4.ip_forward=1" && exit 24

    fi

  fi



  # Create a bridge with a static IP for the VM guest



  VM_NET_IP='20.20.20.21'
@@ -131,6 +151,9 @@ configureNAT() { 
  done



  # Add internet connection to the VM

  update-alternatives --set iptables /usr/sbin/iptables-legacy > /dev/null

  update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy > /dev/null

  

  iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -j MASQUERADE

  # shellcheck disable=SC2086

  iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p tcp $CONTROL_PORT_ARGS -j DNAT --to "$VM_NET_IP"
@@ -144,14 +167,6 @@ configureNAT() { 
  { set +x; } 2>/dev/null

  [[ "$DEBUG" == [Yy1]* ]] && echo



  # Check port forwarding flag

  if [[ $(< /proc/sys/net/ipv4/ip_forward) -eq 0 ]]; then

    { sysctl -w net.ipv4.ip_forward=1 ; rc=$?; } || :

    if (( rc != 0 )); then

      error "IP forwarding is disabled. $ADD_ERR --sysctl net.ipv4.ip_forward=1" && exit 24

    fi

  fi



  NET_OPTS="-netdev tap,ifname=$VM_NET_TAP,script=no,downscript=no,id=hostnet0"



  { exec 40>>/dev/vhost-net; rc=$?; } 2>/dev/null || :
@@ -224,28 +239,12 @@ getInfo() { 
#  Configure Network

# ######################################



# Create the necessary file structure for /dev/net/tun

if [ ! -c /dev/net/tun ]; then

  [ ! -d /dev/net ] && mkdir -m 755 /dev/net

  if mknod /dev/net/tun c 10 200; then

    chmod 666 /dev/net/tun

  fi

fi



if [ ! -c /dev/net/tun ]; then

  error "TUN device missing. $ADD_ERR --cap-add NET_ADMIN" && exit 25

fi



# Create the necessary file structure for /dev/vhost-net

if [ ! -c /dev/vhost-net ]; then

  if mknod /dev/vhost-net c 10 238; then

    chmod 660 /dev/vhost-net

  fi

fi



update-alternatives --set iptables /usr/sbin/iptables-legacy > /dev/null

update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy > /dev/null



getInfo



if [[ "$DHCP" == [Yy1]* ]]; then