-
#!/sbin/runscript
-
# Distributed under the terms of the GNU General Public License v2
-
-
-
IFACE=$(netstat -rn | grep UG | awk ‘NR==1{print($8)}’)
-
ITUN=”tun0″
-
TBL=”VPN1″
-
-
depend() {
-
use dnsmasq
-
}
-
-
start() {
-
# starting openVPN
-
/etc/init.d/openvpn.vpn1 start
-
-
# wait until VPN is fully operationnal [ route is built ]
-
while [ -z “$(route -n | awk ‘/'”$ITUN”‘/&&/255/ {print($1)}’)” ]; do sleep .25; done
-
-
# getting our VPN IP, range & mask
-
ITUNADDR=$(ifconfig $ITUN | awk ‘/dr:/ { gsub(/.*:/,””,$2); print($2); }’)
-
TUNRANGE=$(route -n | awk ‘/tun0/ && /255/ {print($1)}’)
-
TUNMASK=$(route -n | awk ‘/tun0/ && /255/ {print($3)}’)
-
-
# adding $TBL table if necessary
-
if [ ! -n “$(grep “200 $TBL” /etc/iproute2/rt_tables)” ]; then
-
echo “200 $TBL” >> /etc/iproute2/rt_tables
-
fi
-
-
# re-add standard nameserver
-
echo “nameserver 127.0.0.1” > /etc/resolv.conf
-
-
# making route to VPN
-
ip route add default dev $ITUN table $TBL
-
-
# marked packets follows VPN route
-
ip rule add fwmark 0x45 table $TBL
-
-
# accept packets from VPN
-
iptables -A INPUT -i $ITUN -j ACCEPT
-
-
# some services are marked to follow the route
-
iptables -t mangle -A OUTPUT -p udp –dport 53 -j MARK –set-mark 0x45
-
iptables -t mangle -A OUTPUT -p tcp –dport 443 -j MARK –set-mark 0x45
-
iptables -t mangle -A OUTPUT -p tcp –dport 8080 -j MARK –set-mark 0x45
-
-
# binding tun’s ip to tun’s interface
-
iptables -t nat -A POSTROUTING -o $ITUN -j SNAT –to $ITUNADDR
-
-
# force output packets (from VPN) to go out through VPN too
-
iptables -t mangle -A OUTPUT -s $ITUNADDR -j MARK –set-mark 0x45
-
-
# disable ALL source-address verification filtering
-
for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 0 > $i; done
-
}
-
-
stop() {
-
# getting our VPN IP, range & mask
-
#ITUNADDR=$(ifconfig $ITUN | awk ‘NR==2{print $2}’ | sed ‘s/adr://g’)
-
ITUNADDR=$(ifconfig $ITUN | awk ‘/dr:/ { gsub(/.*:/,””,$2); print($2); }’)
-
TUNRANGE=$(route -n | awk ‘/tun0/ && /255/ {print($1)}’)
-
TUNMASK=$(route -n | awk ‘/tun0/ && /255/ {print($3)}’)
-
-
# stoping openVPN
-
/etc/init.d/openvpn.vpn1 stop
-
-
# removing VPN route if is present
-
if [ ! -z “$(route -n | awk ‘/'”$ITUN”‘/&&/255/ {print($1)}’)” ]; then
-
ip route del default dev $ITUN table $TBL
-
fi
-
-
# remove route for marked packets
-
ip rule del fwmark 0x45 table $TBL
-
-
# remove accept packets from VPN
-
iptables -D INPUT -i $ITUN -j ACCEPT
-
-
# remove iptables packet marking
-
iptables -t mangle -D OUTPUT -p udp –dport 53 -j MARK –set-mark 0x45
-
iptables -t mangle -D OUTPUT -p tcp –dport 443 -j MARK –set-mark 0x45
-
iptables -t mangle -D OUTPUT -p tcp –dport 8080 -j MARK –set-mark 0x45
-
-
# removing binding
-
iptables -t nat -D POSTROUTING -o $ITUN -j SNAT –to $ITUNADDR
-
-
# remove output packets to go out throuth VPN
-
iptables -t mangle -D OUTPUT -s $ITUNADDR -j MARK –set-mark 0x45
-
-
# re-enable ALL source-address verification filtering
-
for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $i; done
-
#echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
-
}
