API tools faq
paste
Advertisement
MartineauPASTEBIN

WiFiVPN.sh v1.0x Beta

MartineauPASTEBIN
Feb 2nd, 2018
799
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 45.40 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/sh
  2. VER="v1.03b (Public Beta)"
  3. #============================================================================== © 2016-2018 Martineau, v01.03b Public Beta)
  4. #
  5. # Configure a Wifi interface to use a VPN Client connection
  6. #
  7. #          WiFiVPN     [ {'help'} | {'-h'} | status | diag]
  8. #                      { wifi_interface | ssid [ vpn_number | 'del' | 'status'] }  ['nodns'] ['autodnsmasq'] ['nobridge'] ['openlan'] ['novpn'] ['vlan'{X}] ['debug'] ['brctlopt']
  9. # e.g.
  10. #          WiFiVPN
  11. #                      List ALL WiFi interfaces and associated VPN bridges.
  12. #          WiFiVPN     wl0.2 1
  13. #                      Guest 2.4Ghz #2 (wl0.2) is forced to use VPN Client 1 using bridge 1 (br1) and forces VPN 1 DNS
  14. #          WiFiVPN     wl0.2 del
  15. #                      Guest 2.4Ghz #2 (wl0.2) is reset to use the WAN rather than the VPN
  16. #          WiFiVPN     wl0.2 nodns
  17. #                      Guest 2.4Ghz #2 (wl0.2) is forced to use VPN Client 1 using bridge 1 (br1) and uses router DNS.
  18. #          WifiVPN     wl1.3 status
  19. #                      Guest 5Ghz #3 (wl1.3) config is listed in detail.
  20. #          WiFiVPN     br2g24 5
  21. #                      Guest SSID 'br2g24' (could be 2.4GHz Wifi Guest #2!?) is forced to use VPN Client 5 using bridge 5 (br5) and forces VPN 5 DNS
  22. #          WiFiVPN     eth1 1
  23. #                      2.4Ghz WiFi network (eth1) is forced to use VPN Client 1 using bridge 1 (br1) and forces VPN 1 DNS
  24. #          WiFiVPN     eth2 2
  25. #                      5Ghz WiFi network (eth2) is forced to use VPN Client 2 using bridge 2 (br2)  and forces VPN 2 DNS
  26. #          WiFiVPN     status
  27. #                      List ALL WiFi interfaces and associated VPN bridges.
  28. #          WiFiVPN     diag
  29. #                      List ALL WiFi interfaces and associated VPN bridges. Prompts to delete/show config.
  30. #
  31.  
  32. # NOTE: Requires 'brX' interface to be defined in '/jffs/configs/dnsmasq.conf.add'
  33. #       e.g. VPN Client 2 (tun12) will expect to use br2 interface
  34. #
  35. #       **WARNING** If 'dnsmasq' is specified, if no bridge config is found in '/etc/dnsmasq.conf', the script will configure one!.
  36. #
  37. # P.S.  Connected Wifi clients will no longer appear in the Network Map status? :(
  38. #                 but can be seen in the Wireless Log! ;-)
  39.  
  40. #
  41. #         Bridge brX uses DHCP pool 192.168.10x.2 - 192.168.10x.20
  42. #         interface=brx
  43. #         dhcp-range=brx,192.168.10x.2,192.168.10x.20,255.255.255.0,14400s
  44. #         dhcp-option=brx,3,192.168.10x.1
  45. #         dhcp-option=brx,6,192.168.10x.1
  46.  
  47.  
  48. #*=====================================Functions=====================================================
  49.  
  50. # Print between line beginning with'#==' to first blank line inclusive
  51. ShowHelp() {
  52.     echo -en $cBWHT
  53.     awk '/^#==/{f=1} f{print; if (!NF) exit}' $0
  54.     echo -en $cRESET
  55. }
  56. Say(){
  57.    /usr/bin/logger -st "($(basename $0))" $$ $@
  58. }
  59. ANSIColours () {
  60.  
  61.     cRESET="\e[0m";cBLA="\e[30m";cRED="\e[31m";cGRE="\e[32m";cYEL="\e[33m";cBLU="\e[34m";cMAG="\e[35m";cCYA="\e[36m";cGRA="\e[37m"
  62.     cBGRA="\e[90m";cBRED="\e[91m";cBGRE="\e[92m";cBYEL="\e[93m";cBBLU="\e[94m";cBMAG="\e[95m";cBCYA="\e[96m";cBWHT="\e[97m"
  63.     aBOLD="\e[1m";aDIM="\e[2m";aUNDER="\e[4m";aBLINK="\e[5m";aREVERSE="\e[7m"
  64.     cRED_="\e[41m";cGRE_="\e[42m"
  65.  
  66. }
  67. Check_Router_Mode() {
  68.     local OK=1                              # Assume not Router mode
  69.     case "$(nvram get sw_mode)" in
  70.         0) SW_MODE="Unconfigured";;
  71.         1) SW_MODE="Router";OK=0;;
  72.         2) SW_MODE="Repeater";;
  73.         3) SW_MODE="AP";;
  74.         4) SW_MODE="Hotspot";;
  75.         *) SW_MODE="Unknown nvram sw_mode value="$(nvram get sw_mode);;
  76.     esac
  77.     echo $SW_MODE
  78.     return $OK
  79. }
  80. # Function Parse(String delimiter(s) variable_names)
  81. Parse() {
  82.     #
  83.     #   Parse       "Word1,Word2|Word3" ",|" VAR1 VAR2 REST
  84.     #               (Effectivley executes VAR1="Word1";VAR2="Word2";REST="Word3")
  85.  
  86.     local string IFS
  87.  
  88.     TEXT="$1"
  89.     IFS="$2"
  90.     shift 2
  91.     read -r -- "$@" <<EOF
  92. $TEXT
  93. EOF
  94. }
  95. Get_VPN_ADDR() {
  96.  
  97.     local VPNADDRS=`nvram show 2> /dev/null | grep -E "vpn_client.*addr" | grep -v t_addr`
  98.     local VPN_ADDR=""
  99.  
  100.     for VPN in $VPNADDRS
  101.     do
  102.  
  103.        if [ "${VPN:10:1}" = "$1" ]; then
  104.           VPN_ADDR=${VPN:17}
  105.           #Say "***DEBUG ACTIVE VPN Client="$1 "via" $VPN_ADDR "VPN="$VPN
  106.        #else
  107.        #   Say "Get_VPN_ADDR():" $VPN ">" ${VPN:10:1} ">>" ${VPN:17}
  108.        fi
  109.  
  110.     done
  111.  
  112.     echo $VPN_ADDR
  113.  
  114. }
  115. Config_dnsmasqBRx() {
  116.  
  117.     if [ -z $2 ];then
  118.         local FN="/jffs/configs/dnsmasq.conf.add"
  119.     else
  120.         local FN="$2"
  121.     fi
  122.  
  123.     local BRIDGE_ID="$1"
  124.     local DIGIT=${BRIDGE_ID:2:1}
  125.    
  126.  
  127.     if [ -f "$FN" ];then
  128.         local NOW=$(date +"%Y%m%d-%H%M%S")    # current date and time
  129.         cp $FN ${FN}-$NOW
  130.         sed -i "/$BRIDGE_ID/d" $FN          # Remove existing Bridge if it exists
  131.     fi
  132.  
  133.     local LANIPADDR=$(nvram get lan_ipaddr)
  134.     local LAN_SUBNET=${LANIPADDR%.*}
  135.     local LAN_TWO_OCTETS=$(echo "$LAN_SUBNET" | awk 'BEGIN { FS = "." } {print $1"."$2}')
  136.  
  137.  
  138.     # My numbering scheme for third OCTET:
  139.     #
  140.     #       10.88.8x.0      LAN
  141.     #       10.88.10x.0     Bridge          i.e. 101,102,103,104 and 105
  142.     #       10.88.24x.0     Wifi 2.4GHz     i.e. 241,242 and 243
  143.     #       10.88.5x.0      Wifi 5GHz       i.e. 51,52 and 53
  144.     #       10.88.x0.0      VLAN keep 'x' as multiple of 10 e.g. 50 won't clash with 51 aka Guest 5GHz #1
  145.     #                       but skip 60 as it is reserved by ASUS?
  146.  
  147.     if [ "$METHOD" == "Bridge" ];then
  148.         TYPE="10"
  149.     else
  150.         case "$WIFI_IF" in
  151.             wl0)
  152.                 TYPE="24"
  153.                 ;;
  154.             wl1)
  155.                 TYPE="5"
  156.                 ;;
  157.             vlan)
  158.                 TYPE="0"
  159.                 ;;
  160.             *)
  161.                 TYPE="8"
  162.                 ;;
  163.         esac
  164.     fi
  165.  
  166.     VPN_SUBNET_PREFIX=$LAN_TWO_OCTETS".$TYPE"
  167.  
  168. cat >> $FN << EOF
  169. # Bridge $BRIDGE_ID uses DHCP pool ${VPN_SUBNET_PREFIX}$DIGIT.2 - ${VPN_SUBNET_PREFIX}$DIGIT.20
  170. interface=$BRIDGE_ID
  171. dhcp-range=$BRIDGE_ID,${VPN_SUBNET_PREFIX}$DIGIT.2,${VPN_SUBNET_PREFIX}$DIGIT.20,255.255.255.0,14400s
  172. dhcp-option=$BRIDGE_ID,3,${VPN_SUBNET_PREFIX}$DIGIT.1
  173. dhcp-option=$BRIDGE_ID,6,${VPN_SUBNET_PREFIX}$DIGIT.1
  174. dhcp-option=$BRIDGE_ID,252,"\n"
  175. EOF
  176.     service restart_dnsmasq 2>&1 >/dev/null
  177.     #cat /etc/dnsmasq.conf
  178. }
  179. Drop_BR0() {
  180.  
  181.     if [ "$DEBUG" == "debug" ];then
  182.         Say "br0 Before='"$(nvram get lan_ifnames)"'"
  183.     fi
  184.     echo $(nvram get lan_ifnames) | sed -e "s/\<$1\>//g"            # \< and \> force a sed word boundary
  185.     return 0
  186.  
  187. }
  188. WiFiBridgeVPN() {
  189.  
  190.     if [ "$1" == "delete" ];then
  191.         local ACTIONS="-D"              # Iteration action to perform when deleting rules
  192.     else
  193.         local ACTIONS="-D -I"           # Iteration actions to perform when inserting rules
  194.     fi
  195.  
  196.     # Delete Firewall rules and reinsert if required
  197.     for ACTION in $ACTIONS
  198.         do
  199.  
  200.             FWRULENO=
  201.  
  202.             if [ "$ACTION" == "-I" ];then
  203.                 FWRULENO=`iptables -nvL FORWARD --line | grep -E "ACCEPT     all.*state RELATED,ESTABLISHED" | awk '{print $1}'`
  204.                 FWRULENO=$(($FWRULENO+1))
  205.             fi
  206.  
  207.             # Firewall rules
  208.             if [ "$FIREWALL_TYPE" != "OpenLAN" ];then
  209.                 $IPT $ACTION INPUT -i $BRIDGE_ID -j DROP 2> /dev/null                           # Drop everything
  210.                 #$IPT $ACTION logdrop -i br1 -j LOG --log-prefix "WiFi VPN DROP " 2> /dev/null      # Eye-catcher for above
  211.  
  212.                 # Allow dnsmasq to listen to new bridge for explicit services
  213.                 $IPT $ACTION INPUT -i $BRIDGE_ID -p udp --dport 67:68 -j ACCEPT 2> /dev/null        # DHCP
  214.  
  215.                 for PROTO in tcp udp
  216.                     do
  217.                         $IPT $ACTION INPUT -i $BRIDGE_ID -p $PROTO --dport 53 -j ACCEPT 2> /dev/null    # DNS (TCP DNS is used by DNSSEC?)
  218.                     done
  219.             else
  220.                $IPT $ACTION INPUT -i  $BRIDGE_ID  -m state --state NEW -j ACCEPT 2> /dev/null   # Router Access
  221.             fi
  222.  
  223.             #Allow packets from vlanX0 to/from WiFi
  224.             if [ "$VLAN_PORT" != "NONE" ];then
  225.                 $EBT $ACTION FORWARD $FWRULENO -i vlan${VLAN_PORT}0 -o $WIFI_IF -j ACCEPT
  226.                 $EBT $ACTION FORWARD $FWRULENO -i $WIFI_IF -o vlan${VLAN_PORT}0 -j ACCEPT
  227.             fi
  228.  
  229.             # Force 'Exclusive' use of VPN DNS unless 'nodns' specified by user request
  230.             local FIRST_VPN_DNS=$(awk 'NR==1{print $2}' /etc/openvpn/dns/client${VPN_ID}.resolv)
  231.             local RULE="-j DNAT --to "$FIRST_VPN_DNS            # Use VPN DNS - default
  232.             if [ "$ACTION" == "-D" ];then
  233.                 if [ -z "$($IPT -t nat -L DNSVPN$VPN_ID | grep $BRIDGE_SUBNET_PREFIX | grep "DNAT")" ];then
  234.                     local RULE="-j RETURN"                                                                  # Delete WAN DNS
  235.                 fi
  236.             else
  237.                 if [ "$VPNDNS" == "VPNDNS" ];then
  238.                     ACTION="-A"                                                                             # Use VPN DNS using 'A'
  239.                 else
  240.                     local RULE="-j RETURN"                                                                  # Use WAN DNS using '-I'
  241.                 fi
  242.             fi
  243.             $IPT -t nat $ACTION DNSVPN$VPN_ID -i $BRIDGE_ID -s $BRIDGE_SUBNET_PREFIX.0/24 $RULE 2> /dev/null    # DNS to be used
  244.             [ "$ACTION" == "-A" ] && ACTION="-I"                                                            # Revert to Insert
  245.  
  246.             # Chromecast seems to want to PING the router?
  247.             $IPT $ACTION INPUT -i $BRIDGE_ID \
  248.                 -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT 2> /dev/null
  249.             $IPT $ACTION INPUT -i br0 \
  250.                 -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT 2> /dev/null
  251.  
  252.             # VPN rules
  253.             if [ "$VPN_CONFIG" != "UseWAN" ];then
  254.                 $IPT $ACTION FORWARD $FWRULENO -i $BRIDGE_ID -d $LAN_SUBNET.0/24 -j DROP 2> /dev/null
  255.                 $IPT $ACTION FORWARD $FWRULENO -i tun1$VPN_ID -o $BRIDGE_ID  -j ACCEPT 2> /dev/null     # Allow bridge replies inbound from VPN
  256.                 $IPT $ACTION FORWARD $FWRULENO -i $BRIDGE_ID  -o tun1$VPN_ID -j ACCEPT 2> /dev/null     # Allow bridge requests outbound via VPN
  257.  
  258.                 $IPT -t nat $ACTION POSTROUTING -s $BRIDGE_SUBNET_PREFIX.0/24 -o tun1$VPN_ID -j MASQUERADE 2> /dev/null
  259.             fi
  260.  
  261.             # Application/local device rules
  262.             if [ "$FIREWALL_TYPE" != "OpenLAN" ];then
  263.  
  264.                 $IPT $ACTION FORWARD $FWRULENO -o $BRIDGE_ID -i br0 -s 10.88.8.111 -d $BRIDGE_SUBNET_PREFIX.0/24 -p tcp --dport 22 -j ACCEPT 2> /dev/null   # <- LAN SSH pinhole
  265.                 $IPT $ACTION FORWARD $FWRULENO -i $BRIDGE_ID -o br0 -s $BRIDGE_SUBNET_PREFIX.0/24  -d 10.88.8.131   -j ACCEPT 2> /dev/null  # LAN printer ->
  266.                 $IPT $ACTION FORWARD $FWRULENO -o $BRIDGE_ID -i br0 -s 10.88.8.131 -d $BRIDGE_SUBNET_PREFIX.0/24 -j ACCEPT 2> /dev/null # <- LAN printer
  267.             else
  268.                 $IPT $ACTION FORWARD $FWRULENO -i $BRIDGE_ID -o br0 -j ACCEPT 2> /dev/null
  269.             fi
  270.  
  271.         done
  272. }
  273. WiFiVPN() {
  274.  
  275.     if [ "$1" == "delete" ];then
  276.         local ACTIONS="-D"              # Iteration action to perform when deleting rules
  277.     else
  278.         local ACTIONS="-D -I"           # Iteration actions to perform when inserting rules
  279.     fi
  280.  
  281.     # Delete Firewall rules and reinsert if required
  282.     for ACTION in $ACTIONS
  283.         do
  284.  
  285.  
  286.             if [ "$FIREWALL_TYPE" != "OpenLAN" ];then
  287.                 $IPT $ACTION INPUT -i $WIFI_IF -j logdrop 2> /dev/null                          # Drop everything
  288.                 #$IPT $ACTION logdrop -i br1 -j LOG --log-prefix "WiFi VPN DROP " 2> /dev/null      # Eye-catcher for above
  289.  
  290.                 # Allow dnsmasq to listen to new bridge for explicit services
  291.                 $IPT $ACTION INPUT -i $WIFI_IF -p udp --dport 67:68 -j ACCEPT 2> /dev/null      # DHCP
  292.  
  293.                 for PROTO in tcp udp
  294.                     do
  295.                         $IPT $ACTION INPUT -i $WIFI_IF -p $PROTO --dport 53 -j ACCEPT 2> /dev/null  # DNS (TCP DNS is used by DNSSEC?)
  296.                     done
  297.  
  298.             else
  299.                 $IPT $ACTION INPUT -i $WIFI_IF -m state --state NEW -j ACCEPT 2> /dev/null      # Allow ALL Router access!!!
  300.             fi
  301.  
  302.             # Guest Wireless Bridge
  303.             for PROTO in ipv4 arp
  304.                 do
  305.                     $EBT -t broute $ACTION BROUTING -p $PROTO -i $WIFI_IF -j DROP 2> /dev/null  # Pass upto iptables for access/blocking
  306.                 done
  307.  
  308.             # Force 'Exclusive' use of VPN DNS unless 'nodns' specified by user request
  309.             local FIRST_VPN_DNS=$(awk 'NR==1{print $2}' /etc/openvpn/dns/client${VPN_ID}.resolv)
  310.             local RULE="-j DNAT --to "$FIRST_VPN_DNS            # Use VPN DNS - default
  311.             if [ "$ACTION" == "-D" ];then
  312.                 if [ -z "$($IPT -t nat -L DNSVPN$VPN_ID | grep $BRIDGE_SUBNET_PREFIX | grep "DNAT")" ];then
  313.                     local RULE="-j RETURN"                                                                  # Delete WAN DNS
  314.                 fi
  315.             else
  316.                 if [ "$VPNDNS" == "VPNDNS" ];then
  317.                     ACTION="-A"                                                                             # Use VPN DNS using 'A'
  318.                 else
  319.                     local RULE="-j RETURN"                                                                  # Use WAN DNS using '-I'
  320.                 fi
  321.             fi
  322.  
  323.             $IPT -t nat $ACTION DNSVPN$VPN_ID -i $BRIDGE_ID -s $BRIDGE_SUBNET_PREFIX.0/24 $RULE 2> /dev/null    # DNS to be used
  324.             [ "$ACTION" == "-A" ] && ACTION="-I"                                                            # Revert to Insert
  325.  
  326.             # VPN routes
  327.             if [ "$VPN_CONFIG" != "UseWAN" ];then
  328.                 $IPT $ACTION FORWARD $FWRULENO -i tun1$VPN_ID -o$WIFI_IF  -j ACCEPT 2> /dev/null        # Allow bridge replies inbound from VPN
  329.                 $IPT $ACTION FORWARD $FWRULENO -i $WIFI_IF  -o tun1$VPN_ID -j ACCEPT 2> /dev/null       # Allow bridge requests outbound via VPN
  330.                 $IPT -t nat $ACTION POSTROUTING -s $BRIDGE_SUBNET_PREFIX.0/24 -o tun1$VPN_ID -j MASQUERADE 2> /dev/null
  331.             fi
  332.  
  333.             # Application/local device rules
  334.  
  335.             if [ "$FIREWALL_TYPE" != "OpenLAN" ];then
  336.                 $IPT $ACTION FORWARD $FWRULENO -i $WIFI_IF -d $LAN_SUBNET.0/24 -j DROP 2> /dev/null
  337.                 $IPT $ACTION FORWARD $FWRULENO -i $WIFI_IF -d 10.88.8.131 -j logaccept                              # LAN Printer
  338.                 #$IPT $ACTION FORWARD $FWRULENO -i $WIFI_IF -d 10.88.8.131 -p icmp --icmp-type 8 -j logaccept
  339.             fi
  340.  
  341.         done
  342. }
  343. GetBr_ID () {
  344.  
  345.     INTERFACE="$1"
  346.  
  347.     if [ ! -z "$INTERFACE" ];then
  348.         echo $(brctl show | awk -v pattern="${INTERFACE}\$" '/^br/ { HDR=$1 } ; $0 ~ pattern {f=1} f{print HDR; f=0; exit}')
  349.         return 0
  350.     else
  351.         echo ""
  352.         return 1
  353.     fi
  354. }
  355. Show_Status () {
  356.  
  357.     if [ ! -z $2 ];then
  358.         local BRIDGE_IF=$2
  359.     else
  360.         local BRIDGE_IF=$(GetBr_ID "$1")                                            # Which bridge is the Wifi Guest defined on?
  361.     fi
  362.     if [ ! -z $3 ];then
  363.         local BR_SUBNET_PREFIX=
  364.     fi
  365.  
  366.     if [ "$METHOD" != "Bridge" ];then
  367.         local BRIDGE_IF=$1
  368.     fi
  369.  
  370.     local VPN_NUM=
  371.     if [ "$METHOD" == "Bridge" ];then
  372.         if [ "${BRIDGE_IF:0:2}" == "br" ];then
  373.             local VPN_NUM=${BRIDGE_IF:2:1}
  374.             local BR_SUBNET=$(ip route show table "11"$VPN_NUM | grep $BRIDGE_IF | awk '{print $1}')
  375.         else
  376.             local BR_SUBNET=
  377.         fi
  378.     else
  379.         local VPN_NUM=$VPN_ID
  380.         local BR_SUBNET=$(ip route show table "11"$VPN_NUM | grep $BRIDGE_IF | awk '{print $1}')
  381.     fi
  382.  
  383.     echo -en $cBWHT
  384.     if [ "$METHOD" == "Bridge" ];then
  385.         echo -e "\n\n\t\t\t\tBridge config";echo -e "\t\t\t\t============="
  386.     else
  387.         echo -e "\n\n\t\t\t\tWiFi config";echo -e "\t\t\t\t==========="
  388.     fi
  389.  
  390.     echo -e "\n\t\t\tfilter INPUT rule config";echo -e "\t\t\t========================"
  391.  
  392.     echo -en $cBMAG
  393.  
  394.     if [ ! -z $BRIDGE_IF ];then
  395.         $IPT -nvL INPUT --line -t filter | grep $BRIDGE_IF
  396.     else
  397.         $IPT -nvL --line -t filter | grep br | grep -v br0
  398.     fi
  399.  
  400.     echo -e $cBWHT"\n\t\t\tfilter FORWARD rule config";echo -e "\t\t\t=========================="
  401.     echo -en $cBMAG
  402.     if [ ! -z $BRIDGE_IF ];then
  403.         $IPT -nvL FORWARD --line -t filter | grep $BRIDGE_IF
  404.     else
  405.         $IPT -nvL --line -t filter | grep br | grep -v br0
  406.     fi
  407.  
  408.     if [ ! -z $BR_SUBNET ];then
  409.         FIRST_VPN_DNS=$(awk 'NR==1{print $2}' /etc/openvpn/dns/client${VPN_ID}.resolv)
  410.         local DNSTEXT="using VPN DNS ("$FIRST_VPN_DNS")"
  411.         echo -e $cBWHT"\n\t\t\\tnat DNSVPN"$VPN_NUM "rule config";echo -e "\t\t\t======================="
  412.         echo -en $cBMAG
  413.         $IPT -nvL DNSVPN${VPN_NUM} --line -t nat | grep $BR_SUBNET
  414.         if [ -z "$(iptables -nvL DNSVPN${VPN_NUM} --line -t nat | grep $BR_SUBNET | grep -v "RETURN")" ];then
  415.             local DNSTEXT=
  416.         fi
  417.         echo -e $cBWHT"\n\t\t\\tnat POSTROUTING rule config";echo -e "\t\t\t============================"$cBMAG
  418.         $IPT -nvL POSTROUTING --line -t nat | grep $BR_SUBNET
  419.     fi
  420.  
  421.     if [ "$METHOD" == "Bridge" ];then
  422.         echo -e $cBWHT"\n\n\t\tBridge" $BRIDGE_IF "interface config";echo -e "\t\t==========================="$cBMAG
  423.         brctl show | awk -v pattern="${BRIDGE_IF}" '$0 ~ pattern {flag=1;print $0;next}/^br/{flag=0}flag'
  424.         if [ "${BRIDGE_IF:0:2}" == "br" ];then
  425.             echo -e $cBWHT"\n\n\t\t\tBridge" $BRIDGE_IF "details";echo -e "\t\t\t=================="$cBMAG
  426.             local TEMP=$(/usr/sbin/brctl showstp $BRIDGE_IF 2>&1 /dev/null)
  427.             if [ -z "$(echo $TEMP | grep "No such device")" ];then
  428.                 /usr/sbin/brctl showstp $BRIDGE_IF
  429.             else                                    # brX: can't get info No such device
  430.                 BRIDGE_IF="??"
  431.             fi
  432.         fi
  433.  
  434.         # Vlan switch port?
  435.         if [ ! -z "$(robocfg show | grep -E "vlan[1-9][0]")" ];then     # X0, X00
  436.             echo -e $cBWHT"\n\n\tVLAN Config";echo -e "\t==========="$cBMAG
  437.             robocfg show | grep -E "vlan1|vlan[1-5][0]|vlan[7-9][0]"        # Ignore 60!!!!! not mine
  438.         fi
  439.     else
  440.         echo -e $cBWHT"\n\n\t\t\t\tebtables Rules";echo -e "\t\t\t\t==============\n"
  441.         echo -e "\n\t\t\\tbroute BROUTING rule config";echo -e "\t\t\t==========================="$cBMAG
  442.         $EBT -t broute -L | grep $BRIDGE_IF
  443.         echo -e $cBWHT"\n\t\t\\tfilter FORWARD rule config";echo -e "\t\t\t=========================="$cBMAG
  444.         $EBT -t filter -L | grep $BRIDGE_IF
  445.     fi
  446.  
  447.     echo -e $cBWHT"\n\n\tRPDB Rules";echo -e "\t=========="$cBMAG
  448.     /usr/sbin/ip rule
  449.  
  450.     if [ ! -z "$VPN_NUM" ];then
  451.  
  452.         local VPNTAG=$(nvram get vpn_client${VPN_NUM}_desc)
  453.         if [ -z "$VPNTAG" ];then
  454.             local VPNTAG=`grep -i "11"$VPN_NUM /etc/iproute2/rt_tables | awk '{print $2}'`
  455.         fi
  456.         local LENGTH=${#VPNTAG}
  457.         local LENGTH=$((27+$LENGTH))
  458.         local EQUALS="$(printf %${LENGTH}s |tr " " "=")"
  459.         echo -e $cBWHT"\n\n\tRPDB VPN Client" $VPN_NUM "("$VPNTAG") routes";echo -e "\t$EQUALS"$cBMAG
  460.  
  461.         /usr/sbin/ip route show table 11$VPN_NUM
  462.     fi
  463.  
  464.     local WIFI_Type="WiFi"
  465.     if [ "$WIFI_IF" == "eth1" ] || [ "$WIFI_IF" == "eth2" ];then
  466.        local WIFI_Type="WiFi"
  467.     fi
  468.  
  469.     STATE="OK"
  470.  
  471.     if [ "$METHOD" == "Bridge" ];then
  472.         if [ ${BRIDGE_IF:0:2} != "br" ] || [ "$BRIDGE_ID" != "$BRIDGE_IF" ];then            # Probably already attached to br0
  473.            STATE="N/A"
  474.         fi
  475.     else
  476.         if [ -z "$(iptables -nvL FORWARD | grep -E "${WIFI_IF:0:3}\.${WIFI_IF:4:1}.*tun1")" ];then
  477.             STATE="N/A"
  478.         fi
  479.     fi
  480.  
  481.     if [ "$STATE" != "OK" ];then
  482.         echo -e $cRED"\a\n\n\t"$WIFI_Type $WIFI_DESC $SSID "("$WIFI_IF") isn't routed via a VPN Client?\n"
  483.     else
  484.         echo -e $cBGRE"\n\n\tStatus: "$WIFI_Type $WIFI_DESC "("$WIFI_IF")" $SSID "("$BR_SUBNET") routed via VPN Client" \
  485.                  $VPN_NUM "("$VPNTAG")" $DNSTEXT "via bridge:"$BRIDGE_IF"\n"
  486.     fi
  487.     echo -en $cRESET
  488.     return 0
  489. }
  490. ManageVPNStatus () {
  491.     # If this script is running then surely we expect the associated VPN Client connection to be UP!!!??  ;-)
  492.     #echo -e "\nChecking status of VPN Client" $VPN_ID "......"
  493.  
  494.     if [ "$VPN_ID" -eq 0 ];then
  495.         echo "-1"
  496.         return
  497.     fi
  498.     local VPN_STATE=`nvram show 2> /dev/null | grep "vpn_client${VPN_ID}_state" | awk 'BEGIN {FS="="} {print $2}'`
  499.  
  500.     local WIFI_Type="WiFi"
  501.     if [ "$WIFI_IF" == "eth1" ] || [ "$WIFI_IF" == "eth2" ];then
  502.        local WIFI_Type="WiFi"
  503.     fi
  504.     if [ "$VPN_STATE" -eq 0 ];then
  505.         if [ "$1" != "?" ];then
  506.             Say $WIFI_Type $WIFI_DESC $SSID "requesting start of VPN Client" $VPN_ID "("$VPNTAG")"
  507.             if [ -f /jffs/scripts/VPN_Client_Switch.sh ];then
  508.                 local STAT="Custom script '/jffs/scripts/VPN_Client_Switch.sh'"
  509.                 /jffs/scripts/VPN_Client_Switch.sh $VPN_ID "on"                     # Start it....will handle dnsmasq update for HMA etc.
  510.                 VPN_STATE=$(Check_VPNState "$VPN_ID" "2" "Quiet")           # Redundant but ensures consistency!
  511.                 echo $VPN_STATE
  512.             else
  513.                 local STAT="Normal service 'start_vpnclient"$VPN_ID"' request"
  514.                 service start_vpnclient$VPN_ID 2> /dev/null > /dev/null             # Start it using normal services
  515.                 VPN_STATE=$(Check_VPNState "$VPN_ID" "2")
  516.                 echo $VPN_STATE
  517.             fi
  518.         else
  519.             #echo -e "\a\n**WARNING VPN Client" $VPN_ID "isn't ACTIVE\n"
  520.             echo $VPN_STATE
  521.         fi
  522.     else
  523.         echo $VPN_STATE
  524.     fi
  525.  
  526. }
  527. Check_VPNState(){
  528.  
  529.       local I=0
  530.       local OK=0
  531.  
  532.       local VPNTAG=$(nvram get vpn_client${1}_desc)
  533.       if [ -z "$VPNTAG" ];then
  534.         local VPNTAG=`grep -i "11"$1 /etc/iproute2/rt_tables | awk '{print $2}'`
  535.       fi
  536.  
  537.       if [ "$2" = "2" ]; then
  538.          local WSTATE="connect"
  539.       fi
  540.       if [ "$2" = "0" ]; then
  541.          local WSTATE="disconnect"
  542.       fi
  543.       #while sleep 1; do logger "vpn_client$1_state is `nvram get vpn_client$1_state`"; done    # Command line equivalent
  544.       if [ -z $3 ];then
  545.         Say "Waiting for VPN Client" $1 "("$VPNTAG") to" $WSTATE"....."
  546.       fi
  547.       local VPN_STATE=0
  548.       while [ $I -lt 60 ]; do
  549.         sleep 1
  550.         #Say"Waiting for VPN Client" $1 "to" $WSTATE"....." $i
  551.         if [ "$(nvram get "vpn_client"$1"_state")" = "$2" ];then
  552.            OK="1"
  553.            local VPN_STATE=$(nvram get "vpn_client"$1"_state")
  554.            break
  555.         fi
  556.         I=$(($I + 1))
  557.       done
  558.       if [ "$OK" = "1" ];then
  559.             if [ -z $3 ];then
  560.                 #echo -en $cBYEL
  561.                 Say "VPN Client" $1 "("$VPNTAG")" $WSTATE"'d in" $I "secs"
  562.                 #echo -en $cRESET
  563.             fi
  564.             echo "$VPN_STATE"
  565.             return 0
  566.       else
  567.             #echo -e " "
  568.             if [ -z $3 ];then
  569.                 #echo -en $cBRED
  570.                 Say "***ERROR*** VPN Client" $1 "("$VPNTAG") FAILED to" $WSTATE "after" $I "secs"
  571.                 #echo -en $cBWHT
  572.             fi
  573.             #echo -e "\a"
  574.             echo "$VPN_STATE"
  575.             return 1
  576.       fi
  577. }
  578. Drop_VLAN1() {
  579.  
  580.     #Say "vlan1 Before='"$(robocfg show | grep "vlan1" | cut -d":" -f3)"'"
  581.  
  582.     # Remove the switch port from vlan 1                                                         (strip leading/trailing spaces!!)
  583.     local VLAN1_PORTS=`robocfg show | grep "vlan1" | cut -d":" -f3 | sed -e "s/\$1//g" | awk '{$1=$1};1'`
  584.     robocfg vlan 1 ports "$VLAN1_PORTS"                                                                     # Delete port from vlan1
  585.  
  586.     #Say "vlan1 After='"$VLAN1_PORTS"'"
  587.  
  588.     return 0
  589.  
  590. }
  591. ValidVLAN(){
  592.  
  593.     local FOUND=0
  594.     local SWITCHPORT="BAD"
  595.  
  596.     for THISARG in $*
  597.     do
  598.         if [ ${THISARG:0:4} == "vlan" ];then
  599.             FOUND=1
  600.             break
  601.         fi
  602.     done
  603.  
  604.     if [ $FOUND -eq 1 ];then
  605.         local SWITCHPORT=$(echo $THISARG | grep -E "^vlan[1|2|3]$")         # Exclude Switch port 4 - uplink to TP-Link switch
  606.         if [ ! -z $SWITCHPORT ];then
  607.             local SWITCHPORT=${SWITCHPORT:4:1}
  608.             echo $SWITCHPORT
  609.             return 0
  610.         fi
  611.     fi
  612.  
  613.     echo $SWITCHPORT
  614.     return 1
  615.  
  616. }
  617. Set_WiFi_Description () {
  618.  
  619.     WIFI_DESC=
  620.  
  621.     if [ "${WIFI_IF:0:3}" == "wl0" ];then
  622.         WIFI_DESC=$WIFI_DESC"2.4GHz Guest "${WIFI_IF:4:1}
  623.         SSID=$(nvram show 2> /dev/null | grep "_ssid" | grep -E "wl[0-1]\." | grep -i $WIFI_IF)
  624.         SSID=${SSID##*=}
  625.     fi
  626.     if [ "${WIFI_IF:0:3}" == "wl1" ];then
  627.         WIFI_DESC=$WIFI_DESC"5GHz   Guest "${WIFI_IF:4:1}
  628.         SSID=$(nvram show 2> /dev/null | grep "_ssid" | grep -E "wl[0-1]\." | grep -i $WIFI_IF)
  629.         SSID=${SSID##*=}
  630.     fi
  631.     if [ "$WIFI_IF" == "eth1" ];then
  632.         WIFI_DESC=$WIFI_DESC"2.4GHz Network"
  633.     fi
  634.     if [ "$WIFI_IF" == "eth2" ];then
  635.         WIFI_DESC=$WIFI_DESC"5GHz   Network"
  636.     fi
  637. }
  638. Show_Status_Diagnostics () {
  639.  
  640.     echo -e $cBWHT
  641.  
  642.     Say $VER "© 2016-2017 Martineau," "WiFi VPN status request.....[$@]"
  643.  
  644.     MODE="Normal"
  645.     TXT="Status for"
  646.     if [ "$(echo $@ | grep -cw "diag")" -gt 0 ];then
  647.         MODE="diag"
  648.         TXT="Diagnostics for"
  649.     fi
  650.  
  651.     echo -e $cBCYA"\n\tWiFi->VPN Configuration "${TXT}" interfaces:\n"
  652.  
  653.     if [ "$MODE" == "diag" ];then
  654.         echo -e $cBYEL"\tNVRAM lan_ifnames='"$(nvram get lan_ifnames)
  655.         echo -en $cBMAG
  656.         brctl show
  657.         echo -e
  658.     fi
  659.  
  660.     for WIFI_IF in wl0.1 wl0.2 wl0.3 wl1.1 wl1.2 wl1.3 eth1 eth2
  661.         do
  662.             MSGCOLOR="$cBGRE"
  663.             Set_WiFi_Description
  664.             SSID=$(nvram get $WIFI_IF"_ssid")
  665.             [ "$WIFI_IF" == "eth1" ] && SSID=$(nvram get wl0_ssid)
  666.             [ "$WIFI_IF" == "eth2" ] && SSID=$(nvram get wl1_ssid)
  667.             WIFI_DEFINED=$(ifconfig | grep $WIFI_IF | cut -d' ' -f1)
  668.             BRIDGE_IF=$(GetBr_ID "$WIFI_IF")
  669.             BRIDGE_ID=$BRIDGE_IF                    # Ugly global variable Hack for Showstatus()
  670.             VPN_NUM=${BRIDGE_IF:2:1}
  671.             VPN_ID=$VPN_NUM                     # Ugly global variable Hack for Showstatus()
  672.  
  673.             # Guest WiFi not ACTIVE
  674.             if [ -z "$WIFI_DEFINED" ];then
  675.                 WIFI_DEFINED="-----"
  676.                 SSID="("$SSID")"
  677.                 WIFI_DESC=$(printf "%-16s" "$WIFI_DESC")"** Disabled **"
  678.             fi
  679.  
  680.             #echo -e "\t"$WIFI_IF "is on" $BRIDGE_IF
  681.             if [ ! -z "$VPN_NUM" ] && [ "$BRIDGE_IF" != "br0" ];then
  682.                 BR_SUBNET=$(ip route show table "11"$VPN_NUM | grep $BRIDGE_IF | awk '{print $1}')
  683.                 VPNTAG="$(nvram get vpn_client${VPN_NUM}_desc)"
  684.                 if [ -z "$VPNTAG" ];then
  685.                     VPNTAG=`grep -i "11"$VPN_NUM /etc/iproute2/rt_tables | awk '{print $2}'`
  686.                 fi
  687.                 BRIDGE_IF_IP=`grep -i "dhcp-option=$BRIDGE_ID,3" /etc/dnsmasq.conf  | awk 'BEGIN { FS = "," } {print $3}'`      # Extract I/P from 'dhcp-option=$GUEST_IF,3,10.88.241.1'
  688.                 BRIDGE_SUBNET_PREFIX=${BRIDGE_IF_IP%.*}                                                                     # Extract first three octets of I/P
  689.                 if [ -z "$BRIDGE_SUBNET_PREFIX" ];then
  690.                     BRIDGE_SUBNET_PREFIX="*unknown*"
  691.                 fi
  692.                 if [ -f "/etc/openvpn/dns/client${VPN_NUM}.resolv" ];then
  693.                     FIRST_VPN_DNS=$(awk 'NR==1{print $2}' /etc/openvpn/dns/client${VPN_NUM}.resolv)
  694.                 else
  695.                     FIRST_VPN_DNS="*unknown*"
  696.                     MSGCOLOR="$cBRED"
  697.                     VPNTAG="***ERROR VPN is DOWN"
  698.                 fi
  699.  
  700.                 if [ -z "$($IPT -t nat -nvL DNSVPN${VPN_NUM} 2> /dev/null | grep "$BRIDGE_ID")" ];then
  701.                     MSGCOLOR="$cBRED"
  702.                     DNSTEXT=" is MISSING a valid DNS entry in '-t nat DNSVPN"${VPN_NUM}"'"
  703.  
  704.                     if [ "$MODE" == "diag" ] && [ ! -z "$($IPT -t nat -nvL DNSVPN${VPN_NUM} 2> /dev/null)" ];then
  705.                         echo -en $cBMAG
  706.                         $IPT -t nat -nvL DNSVPN${VPN_NUM}
  707.                     fi
  708.                 else
  709.                     DNSTEXT="using VPN DNS ("$FIRST_VPN_DNS")"      # VPN DNS forced?
  710.                     if [ "$VPNTAG" != "***ERROR VPN is DOWN" ];then
  711.                         if [ -z "$($IPT -nvL DNSVPN${VPN_NUM} --line -t nat | grep $BRIDGE_SUBNET_PREFIX | grep -v "RETURN")" ];then
  712.                             DNSTEXT="using WAN DNS ("$(awk 'NR==1{print $2}' /tmp/resolv.conf)")"
  713.                         fi
  714.                     fi
  715.                 fi
  716.  
  717.                 if [ -z "$BR_SUBNET" ];then         # No physical route for the bridge
  718.                     BR_SUBNET="***ERROR no entry in table 11"$VPN_NUM"; "$BRIDGE_ID"  NOT"
  719.                     MSGCOLOR="$cBRED"
  720.                 fi
  721.                 if [ "$MSGCOLOR" == "$cBRED" ];then
  722.                     echo -en "\a"
  723.                 fi
  724.  
  725.  
  726.                 echo -e $MSGCOLOR"\t$(printf "%-7s" "$WIFI_DEFINED") $(printf "%-16s" "$SSID") $(printf "%-15s" "$WIFI_DESC")" "("$BR_SUBNET") routed through tunnel VPN Client" $VPN_NUM "("$VPNTAG")" $DNSTEXT "via bridge:"$BRIDGE_ID
  727.  
  728.                 if [ "$MODE" == "diag" ];then
  729.  
  730.                     echo -en $cBMAG
  731.                     brctl show | awk -v pattern="${BRIDGE_IF}" '$0 ~ pattern {flag=1;print $0;next}/^br/{flag=0}flag'
  732.  
  733.                     echo -en $cBYEL
  734.                     echo -e "\tNVRAM lan${VPN_NUM}_ifname='"$(nvram get lan${VPN_NUM}_ifname)"'"
  735.                     echo -e "\tNVRAM lan${VPN_NUM}_ifnames='"$(nvram get lan${VPN_NUM}_ifnames)"'"
  736.  
  737.                     echo -e
  738.  
  739.                     echo -en $cBWHT"\tDelete this WiFi->VPN configuration? "
  740.                     read -p "[ Type 'del' ] > " INPUT
  741.                     echo -en $cBYEL
  742.                     case "$INPUT" in
  743.                         "del")
  744.                             ./$(basename $0) $WIFI_IF $VPN_NUM del
  745.                             ;;
  746.                         *)
  747.                             echo -e
  748.                             ;;
  749.                     esac
  750.                     echo -en $cBWHT"\tShow   this WiFi VPN configuration? "
  751.                     read -p "[ Y/N ] > " INPUT
  752.                     echo -en $cBYEL
  753.                     case "$INPUT" in
  754.                         "Y"|"y")
  755.                             Show_Status $WIFI_IF $BRIDGE_IF
  756.                             ;;
  757.                         *)
  758.                             echo -e
  759.                             ;;
  760.                     esac
  761.                 else
  762.                     echo -e
  763.                 fi
  764.  
  765.                 if [ ! -z "$(brctl show | grep -E "^br[1-5]" | grep "\.000000000000")" ];then
  766.                     echo -en $cBRED"\a\n\t***ERROR invalid bridge configuration\n\t\t"
  767.                     brctl show | grep -E "^br[1-5]" | grep "\.000000000000"
  768.                     BRIDGE_IF=$(brctl show | grep -E "^br[1-5]" | grep "\.000000000000" | awk '{print $1}')
  769.                     echo -e
  770.  
  771.                     if [ "$MODE" == "diag" ];then
  772.                         echo -en $cBWHT"\tDelete this invalid configuration? "
  773.                         read -p "[ Y/N ] > " INPUT
  774.                         echo -en $cBYEL
  775.                         case "$INPUT" in
  776.                             "Y"|"y")
  777.                                 ifconfig $BRIDGE_IF down
  778.                                 brctl delbr $BRIDGE_IF
  779.                                 echo -e
  780.                                 ;;
  781.                             *)
  782.                                 echo -e
  783.                                 ;;
  784.                         esac
  785.                     fi
  786.                 fi
  787.             else
  788.                 echo -e ${cBLU}"\t$(printf "%-7s" "$WIFI_DEFINED") $(printf "%-16s" "$SSID") $(printf "%-15s" "$WIFI_DESC")"
  789.             fi
  790.         done
  791.  
  792.         if [ "$MODE" == "diag" ];then
  793.             echo -e $cBYEL"\nWAN DNS "$(awk 'NR==1{print $2}' /tmp/resolv.conf)
  794.             echo -e $cBYEL"\n$(Check_DuplicateVPNPorts "2" "diag")"
  795.         fi
  796. }
  797. Get_VPN_ADDR() {
  798.  
  799. local VPNADDRS=`nvram show 2> /dev/null | grep -E "vpn_client.*addr" | grep -v t_addr`
  800. local VPN_ADDR=""
  801.  
  802. for VPN in $VPNADDRS
  803. do
  804.  
  805.    if [ "${VPN:10:1}" = "$1" ]; then
  806.       VPN_ADDR=${VPN:17}
  807.       #Say "***DEBUG ACTIVE VPN Client="$1 "via" $VPN_ADDR "VPN="$VPN
  808.    #else
  809.    #   Say "Get_VPN_ADDR():" $VPN ">" ${VPN:10:1} ">>" ${VPN:17}
  810.    fi
  811.  
  812. done
  813.  
  814. echo $VPN_ADDR
  815.  
  816. }
  817. Check_DuplicateVPNPorts() {
  818.  
  819.     local VPN_ID=
  820.     local VPN_ADDR=
  821.     local VPN_PORTS=
  822.    
  823.     local VPN_ID_LIST="1 2 3 4 5"
  824.  
  825.    
  826.     #local VPN_CLIENTPORTS=$(nvram show 2> /dev/null | grep -E "vpn_client.*port" | grep -v "client_port")
  827.     for VPN_ID in $VPN_ID_LIST
  828.         do
  829.             VPN_ADDR=$(Get_VPN_ADDR "$VPN_ID")
  830.             if [ -z "$VPN_ADDR" ];then
  831.                 continue                                # VPN Client instance not configured?
  832.             fi
  833.             # vpn_client1_port=553
  834.             # vpn_client1_proto=udp
  835.             if [ "$1" == "2" ];then
  836.                 local VPN_STATE=$(nvram get "vpn_client"$VPN_ID"_state")
  837.                 if [ "$VPN_STATE" != "2" ];then
  838.                     continue
  839.                 fi
  840.             fi
  841.             local THIS=$(echo $(nvram get vpn_client${VPN_ID}_port)":"$(nvram get vpn_client${VPN_ID}_proto | tr "a-z" "A-Z") )
  842.             if [ "$2" == "diag" ];then
  843.                 local VPN_PORTS=$( echo -e "$VPN_PORTS VPN client" $VPN_ID "ACTIVE using port" $THIS", ")
  844.             else
  845.                 local VPN_PORTS=$(echo -e "$VPN_PORTS ${THIS}\n")
  846.             fi
  847.         done
  848.     if [ "$2" != "diag" ];then
  849.         # Convert words to individual lines and report on duplicates
  850.         echo $VPN_PORTS | tr ' ' '\n' | sort -n | uniq -d
  851.     else
  852.         echo $VPN_PORTS
  853.     fi
  854.  
  855. }
  856. #*=================================================Main=====================================================
  857.  
  858. ANSIColours
  859.  
  860. # Can only run in Router Mode;
  861. if [ "$(Check_Router_Mode)" != "Router" ];then 
  862.     echo -e "\e[41m\a\n\n\n\n\t\t\t\t** "$(Check_Router_Mode)" mode is not supported **\t\t\t\t\t\n\n\n\e[0m"
  863.     exit 999
  864. fi
  865.  
  866. IPT="/usr/sbin/iptables"
  867. EBT="/usr/sbin/ebtables"
  868.  
  869.  
  870. # Check override options specified....
  871. DEBUG=
  872. VPNDNS="VPNDNS"                                                 # Force VPN DNS                     (default)
  873. METHOD="Bridge"                                                 # Create separate bridge i.e. br1-5 (default)
  874. FIREWALL_TYPE="BlockLAN"                                        # Explicity block Router/LAN access (default)
  875. VPN_CONFIG="VPN_CONFIG"                                         # Force VPN (default)
  876. VLAN_PORT="NONE"                                                # No switch port attached to Bridge (default)
  877. WIFI_IF=""                                                      # $1 arg required override
  878. VPN_ID=""                                                       # $2 arg override
  879. BRCTL_OPT=
  880.  
  881. WIFI_DESC=
  882.  
  883. if [ ! -z $1 ];then
  884.     if [ $(echo $@ | grep -cw "debug") -gt 0 ];then         # 'debug'   requested?
  885.         DEBUG="debug"
  886.         if [ "$1" == "debug" ];then
  887.             shift                                               # Remove from arg list!
  888.         fi
  889.         echo -e "\n\n\t\t"$cBWHT$aBLINK"DEBUG mode enabled"\t"$cBWHT$aBLINK"DEBUG mode enabled"\n\n"$cRESET
  890.         set -x                                                  # Enable trace
  891.     fi
  892.     if [ $(echo $@ | grep -cw "nodns") -gt 0 ];then
  893.         VPNDNS="NODNS"                                          # 'nodns' requested so use router DNS
  894.     fi
  895.     if [ $(echo $@ | grep -cw "nobridge") -gt 0 ];then
  896.         METHOD="NoBridge"                                       # 'nobridge' requested so don't create 'brx' interface use wlX.n or eth1/2
  897.     fi
  898.     if [ $(echo $@ | grep -cw "openlan") -gt 0 ];then
  899.         FIREWALL_TYPE="OpenLAN"                                 # 'openlan' requested so don't create LAN DROP rules - Router/LAN open to all!!
  900.     fi
  901.     if [ $(echo $@ | grep -cw "novpn") -gt 0 ];then
  902.         VPN_CONFIG="UseWAN"                                     # 'novpn' requested so don't route bridge via VPN
  903.     fi
  904.     if [ $(echo $@ | grep -cw "brctlopt") -gt 0 ];then
  905.         BRCTL_OPT="BRCTLOPT"                                    # 'brctlopt' requested so force STP=DISABLE and BRIDGE FORWARD TIMEOUT=0
  906.     fi
  907.     if [ $(echo $@ | grep -cw "vlan") -gt 0 ];then
  908.         VLAN_PORT=$(ValidVLAN $@)                               # 'vlanX' requested so add switch port X to Bridge
  909.         if [ $? -ne 0 ] || [ "$VLAN_PORT" == "BAD" ];then
  910.             echo -e $cBRED"\a\n\t"
  911.                 Say "***ERROR VLAN switch port invalid [$@]"
  912.                 echo -e $cRESET
  913.             exit 98
  914.         fi
  915.         # Only valid for a Bridge
  916.         if [ "$METHOD" != "Bridge" ];then
  917.             echo -e $cBRED"\a\n\t"
  918.             Say "***ERROR VLAN switch port" $VLAN_PORT "cannot be configured if 'nobridge' specified [$@]"
  919.             echo -e $cRESET
  920.             exit 99
  921.         fi
  922.     fi
  923. fi
  924.  
  925. # Provide assistance
  926. if [ "$1" = "-h" ] || [ "$1" = "help" ]; then
  927.    ShowHelp                                                     # Show help
  928.    exit 0
  929. fi
  930.  
  931. # Show status or detailed status and diagnostics actions
  932. if [ "$1" == "status" ] || [ "$1" == "diag" ] || [ -z $1 ]; then
  933.     Show_Status_Diagnostics $1 $2
  934.     if [ ! -z "$(Check_DuplicateVPNPorts "2")" ];then
  935.         echo -e "\n"${cRED}"**Warning for multiple ACTIVE concurrent VPN Clients UNIQUE ports are advised - Port" $(Check_DuplicateVPNPorts) "is configured for use by several VPN Clients"
  936.     fi
  937.     echo -e $cRESET
  938.     exit 0
  939. fi
  940.  
  941. # Validate mandatory args e.g. Wifi Interface and VPN Client instance.
  942. if [ ! -z $1 ] && [ "$1" != "del" ] && [ "$1" != "debug" ] && [ "$1" != "nodns" ] \
  943.                 && [ "$1" != "autodnsmasq" ] && [ "$1" != "nobridge" ] && [ "$1" != "openlan" ] && [ "$1" != "novpn" ] \
  944.                 && [ "$1" != "vlan1" ] && [ "$1" != "vlan2" ] && [ "$1" != "vlan3" ];then
  945.     WIFI_IF=$1
  946.     # Check if a valid Guest Wifi was specified....
  947.     VALID=$(echo $WIFI_IF | grep -E "^eth[1|2]|wl[0|1]\.[1-3]")     # Guest 2.4 Wifi wl0.1/2/3 & eth1 and 5Ghz wl1.1/2/3 & eth2
  948.     if [ -z "$VALID" ];then
  949.         # Check if a Guest WiFi SSID was specified (rather than the actual Guest WiFi interface)
  950.         WIFI_VAR=$(nvram show 2> /dev/null | grep "_ssid" | grep -E "wl[0-1]\." | grep -iE "=$1$")
  951.         #Say "**DEBUG**" $WIFI_VAR
  952.         if [ -z "$WIFI_VAR" ]; then
  953.             echo -en $cBRED"\a\n\t"
  954.             Say "**ERROR**" "Valid WiFi interface (or SSID) required e.g. wl0.3; ('"$1"') is not a valid SSID!"
  955.             echo -e $cRESET
  956.             exit 95
  957.         else
  958.             WIFI_IF=${WIFI_VAR:0:5}
  959.             #Say "**DEBUG**" $WIFI_IF
  960.         fi
  961.  
  962.     fi
  963.     VPN_ID="0"
  964.     # VPN Client instance
  965.     if [ ! -z $2 ] && [ "$2" != "del" ] && [ "$2" != "debug" ] && [ "$2" != "nodns" ] \
  966.                     && [ "$2" != "autodnsmasq" ] && [ "$2" != "nobridge" ] && [ "$2" != "openlan" ] && [ "$2" != "novpn" ] \
  967.                     && [ "$2" != "vlan1" ] && [ "$2" != "vlan2" ] && [ "$2" != "vlan3" ];then
  968.         VPN_ID=$2                       # User supplied WiFi interface
  969.     fi
  970. fi
  971.  
  972. if [ "$METHOD" == "Bridge" ];then
  973.                                                             # Ideally New Bridge interface is the same as the VPN number
  974.     #BRIDGE_ID="br"$(brctl show | grep -cE "^br[0-9]")      # but get next in sequence for eapd compatibility :-(
  975.     BRIDGE_ID="br"$VPN_ID
  976.  
  977.     if [ "$2" = "del" ];then
  978.         BRIDGE_ID=$(GetBr_ID "$WIFI_IF")
  979.         #if [ -z $BRIDGE_ID ];then          #
  980.             #BRIDGE_ID="br"$VPN_ID          # Bridge interface is the same as the VPN number
  981.         #fi
  982.     fi
  983.  
  984.     # No explicit interface specified, so look for configured bridge to report on
  985.     #if [ "$1" == "status" ];then
  986.         #BRIDGE_ID=`/usr/sbin/brctl show | grep -E "^br[1-5]" | awk '{print $1}'`
  987.     #fi
  988.  
  989.     if [ "${BRIDGE_ID:0:2}" == "br" ] && [ "$BRIDGE_ID" != "br0" ] ;then
  990.         INDEX=${BRIDGE_ID:2:1}
  991.         #INDEX=3                            # Hmm must the NVRAM variables ALWAYS be 'lan3_ifname' and 'lan3_ifnames' ????
  992.         WIFI_VAR=`/usr/sbin/brctl show | grep -E "^br[1-5]" | awk '{print $4}'`
  993.         if [ ! -z "$WIFI_VAR" ];then
  994.             if [ "$(echo $WIFI_VAR | grep -c "vlan")" -eq 0 ];then                  # Ignore VLAN switch port!
  995.                 #WIFI_IF=$WIFI_VAR
  996.                 BUGFIX=
  997.             fi
  998.         fi
  999.     fi
  1000. else
  1001.     BRIDGE_ID=$WIFI_IF
  1002. fi
  1003.  
  1004. # For titles ONLY
  1005. WIFI_Type="Guest WiFi"
  1006. if [ "$WIFI_IF" == "eth1" ] || [ "$WIFI_IF" == "eth2" ];then
  1007.     WIFI_Type="WiFi"
  1008. fi
  1009.  
  1010. VPNTAG=$(nvram get vpn_client${VPN_ID}_desc)
  1011. if [ -z "$VPNTAG" ];then
  1012.     VPNTAG=`grep -i "11"${VPN_ID} /etc/iproute2/rt_tables | awk '{print $2}'`
  1013. fi
  1014.  
  1015. echo -e $cBWHT
  1016. if [ "$METHOD" == "Bridge" ];then
  1017.     Say $VER "© 2016-2017 Martineau," $WIFI_Type "VPN Bridge request.....[$@]"
  1018. else
  1019.     Say $VER "© 2016-2017 Martineau," $WIFI_Type "VPN WiFi Bridge request.....[$@]"
  1020. fi
  1021.  
  1022. WIFI_Type="WiFi ("$WIFI_IF")"
  1023.  
  1024. # Cosmetic desciption
  1025. Set_WiFi_Description
  1026.  
  1027. if [ "$BRIDGE_ID" == "br0" ] || [ "$BRIDGE_ID" == "brstatus" ];then
  1028.     BRIDGE_ID="N/A"
  1029.     echo -en $cRED"\a\n\t"
  1030.     Say "**Warning" $WIFI_Type $WIFI_DESC $SSID "("$WIFI_IF") ambiguous command request?"
  1031.     echo -e $cRESET
  1032.     exit 96
  1033. fi
  1034.  
  1035. # Detailed WiFi interface Status request...done here since we need variables set
  1036. if [ "$2" == "status" ] || [ "$3" == "status" ] || [ "$FORCE_STATUS" == "1" ];then
  1037.     if [ "$BRIDGE_ID" == "brstatus" ];then
  1038.         BRIDGE_ID=$(GetBr_ID "$WIFI_IF")            # Which bridge is the WiFi interface attached to
  1039.         VPN_ID=${BRIDGE_ID:2:1}
  1040.     fi
  1041.  
  1042.     if [ ! -z "$(iptables -nvL FORWARD | grep -E "${WIFI_IF:0:3}\.${WIFI_IF:4:1}.*tun1")" ];then
  1043.         METHOD="NoBridge"
  1044.     fi
  1045.     Show_Status $WIFI_IF $BRIDGE_ID
  1046.     if [ "$(ManageVPNStatus "?")" != "2" ];then
  1047.         echo -e $cRED"\a\n\t"
  1048.         Say "**Warning" "VPN Client" $VPN_ID "is not ACTIVE"
  1049.         echo -e $cRESET
  1050.     fi
  1051.     exit 0
  1052. fi
  1053.  
  1054. # Check VPN Client is ACTIVE; if not start it except if it's a delete request!!!
  1055. if [ "$2" != "del" ] && [ "$3" != "del" ];then
  1056.     if [ -z "$VPN_ID" ];then
  1057.         echo -en $cBRED"\a\n\t"
  1058.         Say "***ERROR Missing VPN arg2; Cannot check VPN status for mapping" $WIFI_Type $WIFI_DESC "("$WIFI_IF")"
  1059.         echo -e $cRESET
  1060.         exit 98
  1061.     fi
  1062.     if [ "$(ManageVPNStatus)" != "2" ];then
  1063.         echo -e $cBRED"\a\n\t**ERROR VPN Client" $VPN_ID "isn't ACTIVE\n"
  1064.         echo -en $cRESET
  1065.         exit 99                                                         # VPN didn't start ?
  1066.     else
  1067.         # If this ACTIVE VPN Client has the same UDP/TCP as another ACTIVE VPN Client then inform user!
  1068.         if [ ! -z "$(Check_DuplicateVPNPorts "2")" ];then
  1069.             echo -e "\n"${cBYEL}"**Warning for multiple ACTIVE concurrent VPN Clients UNIQUE ports are advised - Port" $(Check_DuplicateVPNPorts "2") "is configured for use by several VPN Clients"
  1070.         fi
  1071.     fi
  1072. fi
  1073.  
  1074. LANIPADDR=`nvram get lan_ipaddr`
  1075. LAN_SUBNET=${LANIPADDR%.*}
  1076.  
  1077. if [ "$METHOD" != "Bridge" ];then
  1078.     BRIDGE_ID=$WIFI_IF
  1079. fi
  1080.  
  1081. if [ ${BRIDGE_ID:0:3} != "eth" ];then
  1082.     #Check if /etc/dnsmasq.conf Bridge directives are defined for 'wlX.n' or 'brX'
  1083.     BRIDGE_IF_IP=$(grep -i "dhcp-option=$BRIDGE_ID,3" /etc/dnsmasq.conf  | awk 'BEGIN { FS = "," } {print $3}')     # Extract I/P from 'dhcp-option=$GUEST_IF,3,10.88.241.1'
  1084.     if [ -z $BRIDGE_IF_IP ]; then
  1085.         if [ $(echo $@ | grep -c "autodnsmasq") -eq 0  ];then
  1086.             echo -en $cBRED"\a\n\t"
  1087.             Say "***ERROR Bridge '"$BRIDGE_ID"' not defined in '/etc/dnsmasq.conf' - ABORTing.....(Use 'autodnsmasq' directive!)"
  1088.             echo -e $cRESET
  1089.             exit 96
  1090.         else
  1091.             echo -en $cRED"\a\n\t"
  1092.             Say "***Warning Bridge '"$BRIDGE_ID"' not defined in '/etc/dnsmasq.conf' - auto updating '/jffs/configs/dnsmasq.conf.add' with '"$BRIDGE_ID"' statements....."
  1093.             echo -e $cRESET
  1094.             # Insert the new Bridge directives into /jffs/configs/dnsmasq.conf.add
  1095.             if [ "$(nvram get jffs2_scripts)" == "1" ];then
  1096.                 Config_dnsmasqBRx $BRIDGE_ID
  1097.                 BRIDGE_IF_IP=`grep -i "dhcp-option=$BRIDGE_ID,3" /etc/dnsmasq.conf  | awk 'BEGIN { FS = "," } {print $3}'`      # Extract I/P from 'dhc
  1098.             else
  1099.                 echo -en $cBRED"\a\t"
  1100.                 Say "***ERROR Cannot update '/etc/dnsmasq.conf' using '/jffs/configs/dnsmasq.conf.add' - 'Enable JFFS custom scripts and configs' DISABLED!"
  1101.                 echo -e $cRESET
  1102.                 exit 97
  1103.             fi
  1104.         fi
  1105.     fi
  1106.     BRIDGE_SUBNET_PREFIX=${BRIDGE_IF_IP%.*}                                                                     # Extract first three octets of I/P
  1107. fi
  1108.  
  1109. # Check if valid WiFi guest interface
  1110. if [ "$(/usr/sbin/brctl show  | grep -c $WIFI_IF )" != "1" ]; then
  1111.     echo -en $cBRED"\a\n\t"
  1112.     Say "***ERROR" $WIFI_Type $WIFI_DESC $SSID "WiFi '"$WIFI_IF"' not ENABLED. ABORTing....."
  1113.     echo -e $cRESET
  1114.     exit 98
  1115. fi
  1116.  
  1117. # Delete request ?
  1118. if [ "$2" == "del" ] || [ "$3" == "del" ];then              # delete Guest VPN request e.g. 'wl0.1 del'
  1119.  
  1120.     if [ ! -z "$(iptables -nvL FORWARD | grep -E "${WIFI_IF:0:3}\.${WIFI_IF:4:1}.*tun1")" ];then
  1121.         METHOD="NoBridge"
  1122.     fi
  1123.  
  1124.     if [ "$METHOD" == "Bridge" ];then
  1125.  
  1126.         # Which bridge is the WiFi interface currently defined on?
  1127.         BRIDGE_ID=$(GetBr_ID "$WIFI_IF")
  1128.  
  1129.         if [ ${BRIDGE_ID:0:2} == "br" ];then                            # Imply the VPN instance
  1130.             VPN_ID=${BRIDGE_ID:2:1}
  1131.  
  1132.             VPNTAG=$(nvram get vpn_client${VPN_ID}_desc)
  1133.             if [ -z "$VPNTAG" ];then
  1134.                 VPNTAG=`grep -i "11"${VPN_ID} /etc/iproute2/rt_tables | awk '{print $2}'`
  1135.             fi
  1136.             BRIDGE_IF_IP=`grep -i "dhcp-option=$BRIDGE_ID,3" /etc/dnsmasq.conf  | awk 'BEGIN { FS = "," } {print $3}'`      # Extract I/P from 'dhcp-option=$GUEST_IF,3,10.88.241.1'
  1137.             BRIDGE_SUBNET_PREFIX=${BRIDGE_IF_IP%.*}                                                                     # Extract first three octets of I/P
  1138.         fi
  1139.  
  1140.         # If Wifi interface is attached to br0 then it shouldn't/can't be deleted???
  1141.         if [ "$BRIDGE_ID" != "$WIFI_IF" ] && [ "$BRIDGE_ID" != "br0" ];then         # If no bridge found then $BRIDGE_ID will be 'wlX.X'
  1142.             /usr/sbin/brctl delif $BRIDGE_ID $WIFI_IF
  1143.  
  1144.             # Don't delete the bridge if it still has WiFi/vlan interfaces defined
  1145.             KEEPBRIDGE=0
  1146.             if [ -z "$(brctl show | grep -E "^$BRIDGE_ID" | awk '{print $4}')" ];then
  1147.                 /sbin/ifconfig $BRIDGE_ID down              # ip link set $BRIDGE_ID down
  1148.                 /usr/sbin/brctl delbr $BRIDGE_ID            #
  1149.             else
  1150.                 KEEPBRIDGE=1                                # Retain this bridge for the other interfaces.
  1151.             fi
  1152.  
  1153.             /usr/sbin/brctl addif "br0" $WIFI_IF            # ip link set $WIFI_IF master br0
  1154.  
  1155.             nvram set lan_ifnames="$(nvram get lan_ifnames) "$WIFI_IF           # br0
  1156.             # is vlanX0 in the list
  1157.             if [ ! -z $(robocfg show | grep -iE "vlan[1-9]0" > /dev/null 2>&1) ];then
  1158.                 echo robocfg del $(nvram get wan0_ifname) "here"
  1159.             fi
  1160.             if [ "$(nvram get lan${VPN_ID}_ifnames | wc -w )" -eq 0 ];then
  1161.                 nvram unset lan${VPN_ID}_ifnames
  1162.                 nvram unset lan${VPN_ID}_ifname
  1163.             else
  1164.                 ZZ=$(nvram get lan${VPN_ID}_ifnames | sed -e "s/$WIFI_IF//g" )
  1165.                 ZZ=$(echo "$ZZ" | sed "s/^ //g")
  1166.                 nvram set lan${VPN_ID}_ifnames=$ZZ
  1167.             fi
  1168.             nvram commit
  1169.  
  1170.             killall eapd
  1171.             eapd
  1172.  
  1173.             if [ "$KEEPBRIDGE" != "1" ];then
  1174.                 WiFiBridgeVPN "delete"                          # Delete firewall rules and DNSVPNx entry
  1175.                 /usr/sbin/ip route del $BRIDGE_SUBNET_PREFIX.0/24 dev $BRIDGE_ID table 11$VPN_ID 2> /dev/null > /dev/null
  1176.                 /usr/sbin/ip rule del from $BRIDGE_SUBNET_PREFIX.0/24 2> /dev/null > /dev/null
  1177.             fi
  1178.  
  1179.             BR_SUBNET=$(ip route show table "11"$VPN_ID | grep $BRIDGE_ID | awk '{print $1}')
  1180.             FIRST_VPN_DNS=$(awk 'NR==1{print $2}' /etc/openvpn/dns/client${VPN_ID}.resolv)
  1181.  
  1182.             echo -en $cBGRE"\n\t"
  1183.             Say $WIFI_Type $WIFI_DESC $SSID "("$BR_SUBNET") route though tunnel VPN Client" $VPN_ID "("$VPNTAG") via bridge:"$BRIDGE_ID "DELETED."
  1184.             echo -e $cRESET
  1185.             #Show_Status_Diagnostics
  1186.         else
  1187.             BRIDGE_ID="N/A"
  1188.             echo -en $cRED"\a\n\t"
  1189.             Say "**Warning" $WIFI_Type $WIFI_DESC $SSID "("$WIFI_IF") isn't routed through a VPN Client tunnel? - can't DELETE!!"
  1190.             echo -e $cRESET
  1191.         fi
  1192.     else
  1193.  
  1194.         BR_SUBNET=$(ip route show table "11"$VPN_ID | grep $BRIDGE_ID | awk '{print $1}')
  1195.         FIRST_VPN_DNS=$(awk 'NR==1{print $2}' /etc/openvpn/dns/client${VPN_ID}.resolv)
  1196.  
  1197.         WiFiVPN "delete"
  1198.  
  1199.         /usr/sbin/ip route del $BRIDGE_SUBNET_PREFIX.0/24 dev $BRIDGE_ID table 11$VPN_ID 2> /dev/null > /dev/null
  1200.         /usr/sbin/ip rule del from $BRIDGE_SUBNET_PREFIX.0/24 2> /dev/null > /dev/null
  1201.  
  1202.         echo -en "\n"$cGRE"\t"
  1203.         Say $WIFI_Type $WIFI_DESC $SSID "("$BR_SUBNET") route through tunnel VPN Client" $VPN_ID "("$VPNTAG") via bridge:"$BRIDGE_ID "DELETED."
  1204.         echo -e "\n"$cRESET
  1205.         #Show_Status_Diagnostics
  1206.  
  1207.     fi
  1208.     if [ "$(ManageVPNStatus "?")" != "2" ] && [ "$VPN_ID" != "0" ];then
  1209.         echo -en $cRED"\a\n\t"
  1210.         Say "**Warning" "VPN Client" $VPN_ID "is not ACTIVE"
  1211.         echo -e $cRESET
  1212.     fi
  1213.  
  1214.     exit 99
  1215. fi
  1216.  
  1217. # Add/create the WiFi VPN route
  1218. if [ "$METHOD" == "Bridge" ];then
  1219.  
  1220.     # Remove proposed VPN WiFi interface from br0
  1221.     /usr/sbin/brctl delif br0 $WIFI_IF 2> /dev/null > /dev/null     # ip link delete $WIFI_IF master br0
  1222.  
  1223.     # Create New Bridge e.g. br2
  1224.     # Only create the bridge if it doesn't currently exist...i.e. when adding multiple interfaces
  1225.     if [ -z "$(brctl show | grep -oE "^$BRIDGE_ID")" ];then
  1226.         /usr/sbin/brctl addbr $BRIDGE_ID                                # ip link add $BRIDGE_ID type bridge
  1227.     fi
  1228.     # Don't add the WiFi interface if it already exists on the bridge
  1229.     if [ "$(GetBr_ID "$WIFI_IF")" != "$BRIDGE_ID" ];then
  1230.         /usr/sbin/brctl addif $BRIDGE_ID $WIFI_IF                           # ip link set $WIFI_IF master $BRIDGE_ID
  1231.     else
  1232.         echo -e $cRED"\a\n\t**Warning WiFi ("$WIFI_IF")" $WIFI_DESC $SSID" already attached to bridge:" $BRIDGE_ID
  1233.     fi
  1234.     # Add a Switch port as a vlan to bridge
  1235.     if [ "$VLAN_PORT" != "NONE" ];then
  1236.         #robocfg vlan1 ports "1 2 3 4 5t"                               # RT-AC68U default
  1237.         Drop_VLAN1 $VLAN_PORT                                           # Drop switch port from vlan1
  1238.         robocfg vlan $VLAN_PORT"0" ports $VLAN_PORT"t 5t"               # Create the new vlanX0 e.g. vlan20 based on switch port 2
  1239.         #vconfig add $(nvram get wan0_ifname) $VLAN_PORT"0" 2> /dev/null            #
  1240.         vconfig add $BRIDGE_ID $VLAN_PORT"0" 2> /dev/null               #
  1241.         /usr/sbin/brctl addif $BRIDGE_ID vlan$VLAN_PORT"0"
  1242.         if [ ! -z "$BRCTL_OPT" ];then
  1243.             /usr/sbin/brctl stp $BRIDGE_ID disable                      # Explicitly
  1244.             /usr/sbin/brctl setfd $BRIDGE_ID 0                          # New Bridge default is 15 seconds?
  1245.         fi
  1246.         #ifconfig vlan$VLAN_PORT"0" $BRIDGE_SUBNET_PREFIX.2 netmask 255.255.255.0 broadcast $BRIDGE_SUBNET_PREFIX.255
  1247.         ifconfig vlan$VLAN_PORT"0" up
  1248.     fi
  1249.  
  1250.     /sbin/ifconfig $BRIDGE_ID $BRIDGE_SUBNET_PREFIX.1 netmask 255.255.255.0 broadcast $BRIDGE_SUBNET_PREFIX.255
  1251.  
  1252.     # Fix WPA2 on Guest WiFi
  1253.     nvram set lan_ifnames="$(Drop_BR0 $WIFI_IF)"
  1254.  
  1255.     if [ "$DEBUG" == "debug" ];then
  1256.         Say "br0 After='"$(nvram get lan_ifnames)"'"
  1257.     fi
  1258.  
  1259.     if [ "$VLAN_PORT" = "NONE" ];then
  1260.         # Append new WiFi interface
  1261.         if [ -z "$(nvram get lan${INDEX}_ifnames)" ];then
  1262.             nvram set lan${INDEX}_ifnames=$WIFI_IF
  1263.         else
  1264.             # Don't add the WiFI interface if it already exists in the NVRAM variable
  1265.             if [ -z "$(nvram get lan${INDEX}_ifnames | grep "$WIFI_IF")" ];then
  1266.                 nvram set lan${INDEX}_ifnames=$(nvram get lan${INDEX}_ifnames)" "$WIFI_IF
  1267.             else
  1268.                 echo -e $cRED"\a\t**Warning WiFi ("$WIFI_IF") already assigned to NVRAM variable: lan${INDEX}_ifnames"
  1269.             fi
  1270.         fi
  1271.     else
  1272.         nvram set lan${INDEX}_ifnames="$WIFI_IF vlan${VLAN_PORT}0"
  1273.     fi
  1274.  
  1275.     nvram set lan${INDEX}_ifname=$BRIDGE_ID
  1276.     nvram commit
  1277.     killall eapd
  1278.     eapd
  1279.  
  1280.     WiFiBridgeVPN "create"                  # Create the New Bridge interface Firewall rules
  1281. else
  1282.  
  1283.     # Bridge the WiFi interface without using a bridge
  1284.     /sbin/ifconfig $BRIDGE_ID $BRIDGE_SUBNET_PREFIX.1 netmask 255.255.255.0
  1285.  
  1286.     WiFiVPN
  1287. fi
  1288.  
  1289. if [ "$VPN_CONFIG" != "UseWAN" ];then
  1290.     # Route the Wifi bridge via VPN
  1291.     X=${BRIDGE_ID:2:1}
  1292.     #PRIO_VAL=$((7000+$X))
  1293.     PRIO_VAL="20"$X"00"
  1294.  
  1295.     ACTIONS="del add"
  1296.     for ACTION in $ACTIONS
  1297.         do
  1298.             /usr/sbin/ip route $ACTION $BRIDGE_SUBNET_PREFIX.0/24 dev $BRIDGE_ID table 11$VPN_ID 2> /dev/null > /dev/null
  1299.             /usr/sbin/ip rule  $ACTION from $BRIDGE_SUBNET_PREFIX.0/24 table 11$VPN_ID prio $PRIO_VAL 2> /dev/null > /dev/null
  1300.         done
  1301.  
  1302.     /usr/sbin/ip route flush cache
  1303. fi
  1304.  
  1305. # Summary action report
  1306. BR_SUBNET=$(ip route show table "11"$VPN_ID | grep $BRIDGE_ID | awk '{print $1}')
  1307. FIRST_VPN_DNS=$(awk 'NR==1{print $2}' /etc/openvpn/dns/client${VPN_ID}.resolv)
  1308. DNSTEXT="using VPN DNS ("$FIRST_VPN_DNS")"      # VPN DNS forced?
  1309. if [ -z "`$IPT -nvL DNSVPN${VPN_ID} --line -t nat | grep $BRIDGE_SUBNET_PREFIX | grep -v "RETURN"`" ];then
  1310.     DNSTEXT="using WAN DNS ("$(nvram get wan_dns | cut -d' ' -f1)")"
  1311. fi
  1312. echo -en "\n"$cBGRE"\t"
  1313. Say $WIFI_Type $WIFI_DESC $SSID "("$BR_SUBNET") routed through tunnel VPN Client" $VPN_ID "("$VPNTAG")" $DNSTEXT "via bridge:"$BRIDGE_ID
  1314. #Show_Status_Diagnostics
  1315. echo -e $cRESET
  1316.  
  1317.  
  1318.  
  1319. exit
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!