API tools faq
paste
Guest User

Untitled

a guest
Apr 13th, 2011
252
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 10.84 KB | None | 0 0
raw download clone embed print report
  1. #
  2. # pb-route, Copyright (C) 2010 Phillip Smith
  3. # This program comes with ABSOLUTELY NO WARRANTY; This is free software, and you are
  4. # welcome to use and redistribute it under the conditions of the GPL license version 2
  5. # See the "COPYING" file for further details.
  6. #
  7. # Setting up multiple routing tables
  8. /usr/sbin/ip route flush table 1 2>/dev/null
  9. /usr/sbin/ip rule del fwmark 101 table 1 2>/dev/null
  10. /usr/sbin/ip route add table 1 172.31.12.1 via 172.31.12.5 dev tun0 2>/dev/null
  11. /usr/sbin/ip route add table 1 172.31.12.5 dev tun0 proto kernel  scope link  src 172.31.12.6 2>/dev/null
  12. /usr/sbin/ip route add table 1 59.167.195.32/29 via 172.31.12.5 dev tun0 2>/dev/null
  13. /usr/sbin/ip route add table 1 192.168.31.0/27 dev eth0 proto kernel  scope link  src 192.168.31.20  metric 202 2>/dev/null
  14. /usr/sbin/ip route add table 1 192.168.0.0/23 via 172.31.12.5 dev tun0 2>/dev/null
  15. /usr/sbin/ip route add table 1 172.31.0.0/16 via 172.31.12.5 dev tun0 2>/dev/null
  16. /usr/sbin/ip route add table 1 default via 202.14.166.254 dev eth0
  17. /usr/sbin/ip rule add fwmark 101 table 1
  18. /usr/sbin/ip route flush table 2 2>/dev/null
  19. /usr/sbin/ip rule del fwmark 102 table 2 2>/dev/null
  20. /usr/sbin/ip route add table 2 172.31.12.1 via 172.31.12.5 dev tun0 2>/dev/null
  21. /usr/sbin/ip route add table 2 172.31.12.5 dev tun0 proto kernel  scope link  src 172.31.12.6 2>/dev/null
  22. /usr/sbin/ip route add table 2 59.167.195.32/29 via 172.31.12.5 dev tun0 2>/dev/null
  23. /usr/sbin/ip route add table 2 192.168.31.0/27 dev eth0 proto kernel  scope link  src 192.168.31.20  metric 202 2>/dev/null
  24. /usr/sbin/ip route add table 2 192.168.0.0/23 via 172.31.12.5 dev tun0 2>/dev/null
  25. /usr/sbin/ip route add table 2 172.31.0.0/16 via 172.31.12.5 dev tun0 2>/dev/null
  26. /usr/sbin/ip route add table 2 default via 75.127.96.1 dev ppp200
  27. /usr/sbin/ip rule add fwmark 102 table 2
  28. # Flushing all chains in the "mangle" table
  29. /usr/sbin/iptables -t mangle -F
  30. /usr/sbin/iptables -t mangle -X
  31. # Setting up marking chains
  32. /usr/sbin/iptables -t mangle -N MARK-gw1
  33. /usr/sbin/iptables -t mangle -A MARK-gw1 -m comment --comment 'send via 202.14.166.254' -j MARK --set-mark 101
  34. /usr/sbin/iptables -t mangle -A MARK-gw1 -j CONNMARK --save-mark
  35. /usr/sbin/iptables -t mangle -A MARK-gw1 -j RETURN
  36. /usr/sbin/iptables -t mangle -N MARK-gw2
  37. /usr/sbin/iptables -t mangle -A MARK-gw2 -m comment --comment 'send via 75.127.96.1' -j MARK --set-mark 102
  38. /usr/sbin/iptables -t mangle -A MARK-gw2 -j CONNMARK --save-mark
  39. /usr/sbin/iptables -t mangle -A MARK-gw2 -j RETURN
  40. # Initializing "mangle" table
  41. # ==> Handle connection streams that have already been marked
  42. /usr/sbin/iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
  43. /usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment "this stream is already marked; escape early" -m mark ! --mark 0 -j ACCEPT
  44. # ==> Handle incoming connection streams to route back via where they came in
  45. /usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment 'prevent asynchronous routing' -i eth0 -m state --state NEW -j MARK-gw1
  46. /usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment 'prevent asynchronous routing' -i ppp200 -m state --state NEW -j MARK-gw2
  47. # Setting up DESTINATION based routing policies (2 policies)
  48. /usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment '74.125.0.0/16 via gw1' -m state --state NEW -d 74.125.0.0/16 -j MARK-gw1
  49. /usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment '74.125.0.0/16 via gw1' -m state --state NEW -d 74.125.0.0/16 -j ACCEPT
  50. /usr/sbin/iptables -t mangle -A OUTPUT -m comment --comment '74.125.0.0/16 via gw1' -m state --state NEW -d 74.125.0.0/16 -j MARK-gw1
  51. /usr/sbin/iptables -t mangle -A OUTPUT -m comment --comment '74.125.0.0/16 via gw1' -m state --state NEW -d 74.125.0.0/16 -j ACCEPT
  52. /usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment '209.0.0.0/8 via gw1' -m state --state NEW -d 209.0.0.0/8 -j MARK-gw1
  53. /usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment '209.0.0.0/8 via gw1' -m state --state NEW -d 209.0.0.0/8 -j ACCEPT
  54. /usr/sbin/iptables -t mangle -A OUTPUT -m comment --comment '209.0.0.0/8 via gw1' -m state --state NEW -d 209.0.0.0/8 -j MARK-gw1
  55. /usr/sbin/iptables -t mangle -A OUTPUT -m comment --comment '209.0.0.0/8 via gw1' -m state --state NEW -d 209.0.0.0/8 -j ACCEPT
  56. # Setting up PORT based routing policies (4 policies)
  57. /usr/sbin/iptables -t mangle -N PORT_80_gw2
  58. /usr/sbin/iptables -t mangle -A PORT_80_gw2 -m comment --comment 'tcp 80 via gw2' -p tcp --dport 80 -j MARK-gw2
  59. /usr/sbin/iptables -t mangle -A PORT_80_gw2 -m comment --comment 'tcp 80 via gw2' -p tcp --dport 80 -j ACCEPT
  60. /usr/sbin/iptables -t mangle -A PORT_80_gw2 -m comment --comment 'udp 80 via gw2' -p udp --dport 80 -j MARK-gw2
  61. /usr/sbin/iptables -t mangle -A PORT_80_gw2 -m comment --comment 'udp 80 via gw2' -p udp --dport 80 -j ACCEPT
  62. /usr/sbin/iptables -t mangle -A PORT_80_gw2 -j RETURN
  63. /usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment 'tcp 80 via gw2' -m state --state NEW  -j PORT_80_gw2
  64. /usr/sbin/iptables -t mangle -A OUTPUT -m comment --comment 'tcp 80 via gw2' -m state --state NEW -j PORT_80_gw2
  65. /usr/sbin/iptables -t mangle -N PORT_443_gw2
  66. /usr/sbin/iptables -t mangle -A PORT_443_gw2 -m comment --comment 'tcp 443 via gw2' -p tcp --dport 443 -j MARK-gw2
  67. /usr/sbin/iptables -t mangle -A PORT_443_gw2 -m comment --comment 'tcp 443 via gw2' -p tcp --dport 443 -j ACCEPT
  68. /usr/sbin/iptables -t mangle -A PORT_443_gw2 -m comment --comment 'udp 443 via gw2' -p udp --dport 443 -j MARK-gw2
  69. /usr/sbin/iptables -t mangle -A PORT_443_gw2 -m comment --comment 'udp 443 via gw2' -p udp --dport 443 -j ACCEPT
  70. /usr/sbin/iptables -t mangle -A PORT_443_gw2 -j RETURN
  71. /usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment 'tcp 443 via gw2' -m state --state NEW  -j PORT_443_gw2
  72. /usr/sbin/iptables -t mangle -A OUTPUT -m comment --comment 'tcp 443 via gw2' -m state --state NEW -j PORT_443_gw2
  73. /usr/sbin/iptables -t mangle -N PORT_21_gw1
  74. /usr/sbin/iptables -t mangle -A PORT_21_gw1 -m comment --comment 'tcp 21 via gw1' -p tcp --dport 21 -j MARK-gw1
  75. /usr/sbin/iptables -t mangle -A PORT_21_gw1 -m comment --comment 'tcp 21 via gw1' -p tcp --dport 21 -j ACCEPT
  76. /usr/sbin/iptables -t mangle -A PORT_21_gw1 -m comment --comment 'udp 21 via gw1' -p udp --dport 21 -j MARK-gw1
  77. /usr/sbin/iptables -t mangle -A PORT_21_gw1 -m comment --comment 'udp 21 via gw1' -p udp --dport 21 -j ACCEPT
  78. /usr/sbin/iptables -t mangle -A PORT_21_gw1 -j RETURN
  79. /usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment 'tcp 21 via gw1' -m state --state NEW  -j PORT_21_gw1
  80. /usr/sbin/iptables -t mangle -A OUTPUT -m comment --comment 'tcp 21 via gw1' -m state --state NEW -j PORT_21_gw1
  81. /usr/sbin/iptables -t mangle -N PORT_22_gw2
  82. /usr/sbin/iptables -t mangle -A PORT_22_gw2 -m comment --comment 'tcp 22 via gw2' -p tcp --dport 22 -j MARK-gw2
  83. /usr/sbin/iptables -t mangle -A PORT_22_gw2 -m comment --comment 'tcp 22 via gw2' -p tcp --dport 22 -j ACCEPT
  84. /usr/sbin/iptables -t mangle -A PORT_22_gw2 -m comment --comment 'udp 22 via gw2' -p udp --dport 22 -j MARK-gw2
  85. /usr/sbin/iptables -t mangle -A PORT_22_gw2 -m comment --comment 'udp 22 via gw2' -p udp --dport 22 -j ACCEPT
  86. /usr/sbin/iptables -t mangle -A PORT_22_gw2 -j RETURN
  87. /usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment 'tcp 22 via gw2' -m state --state NEW  -j PORT_22_gw2
  88. /usr/sbin/iptables -t mangle -A OUTPUT -m comment --comment 'tcp 22 via gw2' -m state --state NEW -j PORT_22_gw2
  89. # Setting up PROTOCOL based routing policies (1 policies)
  90. /usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment 'icmp via gw2' -m state --state NEW -p icmp -j MARK-gw2
  91. /usr/sbin/iptables -t mangle -A PREROUTING -m comment --comment 'icmp via gw2' -m state --state NEW -p icmp -j ACCEPT
  92. /usr/sbin/iptables -t mangle -A OUTPUT -m comment --comment 'icmp via gw2' -m state --state NEW -p icmp -j MARK-gw2
  93. /usr/sbin/iptables -t mangle -A OUTPUT -m comment --comment 'icmp via gw2' -m state --state NEW -p icmp -j ACCEPT
  94. # Setting up DEFAULT routing policy
  95. /usr/sbin/iptables -t mangle -N DEF_POL
  96. /usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'default balancing' -p tcp -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
  97. /usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'default balancing' -p udp -m state --state ESTABLISHED,RELATED -j CONNMARK --restore-mark
  98. /usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw1 tcp' -m mark --mark 0 -p tcp -m state --state NEW -m statistic --mode nth --every 2 --packet 0 -j MARK-gw1
  99. /usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw1 tcp' -m mark --mark 0 -p tcp -m state --state NEW -m statistic --mode nth --every 2 --packet 0 -j ACCEPT
  100. /usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw2 tcp' -m mark --mark 0 -p tcp -m state --state NEW -m statistic --mode nth --every 2 --packet 1 -j MARK-gw2
  101. /usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw2 tcp' -m mark --mark 0 -p tcp -m state --state NEW -m statistic --mode nth --every 2 --packet 1 -j ACCEPT
  102. /usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw1 udp' -m mark --mark 0 -p udp -m state --state NEW -m statistic --mode nth --every 2 --packet 0 -j MARK-gw1
  103. /usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw1 udp' -m mark --mark 0 -p udp -m state --state NEW -m statistic --mode nth --every 2 --packet 0 -j ACCEPT
  104. /usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw2 udp' -m mark --mark 0 -p udp -m state --state NEW -m statistic --mode nth --every 2 --packet 1 -j MARK-gw2
  105. /usr/sbin/iptables -t mangle -A DEF_POL -m comment --comment 'balance gw2 udp' -m mark --mark 0 -p udp -m state --state NEW -m statistic --mode nth --every 2 --packet 1 -j ACCEPT
  106. # Setting up Source NATs
  107. # ==> Adding SNAT for 192.168.0.0/16
  108. /usr/sbin/iptables -t nat -A POSTROUTING -m comment --comment 'snat outbound eth0' -o eth0 -s 192.168.0.0/16 -m mark --mark 101 -j SNAT --to-source 202.14.166.120
  109. /usr/sbin/iptables -t nat -A POSTROUTING -m comment --comment 'snat outbound ppp200' -o ppp200 -s 192.168.0.0/16 -m mark --mark 102 -j SNAT --to-source 75.127.96.189
  110. # ==> Adding SNAT for 172.16.0.0/12
  111. /usr/sbin/iptables -t nat -A POSTROUTING -m comment --comment 'snat outbound eth0' -o eth0 -s 172.16.0.0/12 -m mark --mark 101 -j SNAT --to-source 202.14.166.120
  112. /usr/sbin/iptables -t nat -A POSTROUTING -m comment --comment 'snat outbound ppp200' -o ppp200 -s 172.16.0.0/12 -m mark --mark 102 -j SNAT --to-source 75.127.96.189
  113. # ==> Adding SNAT for 10.0.0.0/8
  114. /usr/sbin/iptables -t nat -A POSTROUTING -m comment --comment 'snat outbound eth0' -o eth0 -s 10.0.0.0/8 -m mark --mark 101 -j SNAT --to-source 202.14.166.120
  115. /usr/sbin/iptables -t nat -A POSTROUTING -m comment --comment 'snat outbound ppp200' -o ppp200 -s 10.0.0.0/8 -m mark --mark 102 -j SNAT --to-source 75.127.96.189
  116. # Flushing route cache so new routes take effect
  117. /usr/sbin/ip route flush cache
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!