merlin-ovpn-port-forward.sh

#!/bin/sh
#DEBUG= # uncomment/comment to enable/disable debug mode

#          name: merlin-ovpn-port-forward.sh
#       version: 2.0.0, 22-jul-2022, by eibgrad
#       purpose: openvpn client firewall-based killswitch
#       type(s): nat-start
#          href: https://tinyurl.com/3ebyzyyu
#  installation:
#    1. enable jffs custom scripts and configs (administration->system)
#    2. ssh to router and copy/paste the following command:
#         curl -kLs bit.ly/merlin-installer|tr -d '\r'|sh -s SqReWZnB
#    3. modify script w/ your preferred options using nano editor:
#         nano /jffs/scripts/merlin-ovpn-port-forward.sh
#    4. reboot

SCRIPTS_DIR="/jffs/scripts"
SCRIPT1="$SCRIPTS_DIR/merlin-ovpn-port-forward.sh"
SCRIPT2="$SCRIPTS_DIR/nat-start"

mkdir -p $SCRIPTS_DIR

# ---------------------- begin merlin-ovpn-port-forward ---------------------- #
cat << 'EOF' > $SCRIPT1
#!/bin/sh
#set -x # comment/uncomment to disable/enable debug mode
{
# ------------------------------ BEGIN OPTIONS ------------------------------- #

# interface source-ip/net proto extern-port intern-ip intern-port [comments...]
PORT_FORWARDS="
tun11 0.0.0.0/0 tcp 10022 $(nvram get lan_ipaddr) 22 router ssh server
tun12 0.0.0.0/0 tcp 10080 192.168.1.200 80
tun12 0.0.0.0/0 tcp 10443 192.168.1.200 443
#tun12 188.188.188.188 tcp 10088 192.168.1.210 8088
tun+ 199.199.199.0/24 udp 10999 192.168.1.210 999 all vpn network interfaces
"
# ------------------------------- END OPTIONS -------------------------------- #

# ---------------------- DO NOT CHANGE BELOW THIS LINE ----------------------- #

ipt() { iptables ${@/-[IA]/-D} 2>/dev/null; iptables $@; }

OIFS="$IFS"; IFS=$'\n'

for pf in $PORT_FORWARDS; do
    # skip comments and blank lines
    echo $pf | grep -Eq '^[[:space:]]*(#|$)' && continue

    # parse port forward into separate fields
    for i in 1 2 3 4 5 6; do eval f$i="$(echo $pf | cut -d' ' -f$i)"; done

    # redirect external port on vpn to internal ip+port
    ipt -t nat -I PREROUTING -i $f1 -s $f2 -p $f3 --dport $f4 \
        -j DNAT --to $f5:$f6
done

IFS="$OIFS"

# allow routing from vpn to router internal port
ipt -I INPUT -i tun+ -m conntrack --ctstate DNAT -j ACCEPT

# allow routing from vpn to lan internal ip+port
ipt -I FORWARD -i tun+ -m conntrack --ctstate DNAT -j ACCEPT

exit 0
} 2>&1 | logger -t $(basename $0 .sh)[$$]
EOF
[ ${DEBUG+x} ] && sed -ri '2 s/^#(set -x)/\1/' $SCRIPT1
chmod +x $SCRIPT1
echo "installed: $SCRIPT1"
# ----------------------- end merlin-ovpn-port-forward ----------------------- #

# ----------------------------- begin nat-start ------------------------------ #
create_script() {
cat << 'EOF' > $SCRIPT2
#!/bin/sh
#set -x # comment/uncomment to disable/enable debug mode
{
$SCRIPT1
} 2>&1 | logger -t $(basename $0)[$$]
EOF
[ ${DEBUG+x} ] && sed -ri '2 s/^#(set -x)/\1/' $SCRIPT2
sed -i "s:\$SCRIPT1:$SCRIPT1:g" $SCRIPT2
chmod +x $SCRIPT2
}

if [ -f $SCRIPT2 ]; then
    echo "error: $SCRIPT2 already exists; requires manual installation"
else
    create_script
    echo "installed: $SCRIPT2"
fi
# ------------------------------ end nat-start ------------------------------- #