open-source-mirrors
/
arch-qbittorrentvpn
mirror of https://github.com/binhex/arch-qbittorrentvpn
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix up iptables

Browse Source
pull/7/head
binhex 6 years ago
parent c604954d4c
commit c51870e632
1 changed files with 17 additions and 59 deletions
Show Stats Download Patch File Download Diff File

76
run/root/iptable.sh
Unescape View File

@ -42,22 +42,10 @@ if [[ $iptable_mangle_exit_code == 0 ]]; then
echo "[info] iptable_mangle support detected, adding fwmark for tables"
# setup route for rutorrent http using set-mark to route traffic for port 80 to eth0
echo "9080 rutorrent_http" >> /etc/iproute2/rt_tables
ip rule add fwmark 1 table rutorrent_http
ip route add default via $DEFAULT_GATEWAY table rutorrent_http
# setup route for rutorrent https using set-mark to route traffic for port 443 to eth0
echo "9443 rutorrent_https" >> /etc/iproute2/rt_tables
ip rule add fwmark 2 table rutorrent_https
ip route add default via $DEFAULT_GATEWAY table rutorrent_https
# setup route for flood using set-mark to route traffic for port 3000 to eth0
if [[ $ENABLE_FLOOD == "yes" || $ENABLE_FLOOD == "both" ]]; then
echo "3000 flood" >> /etc/iproute2/rt_tables
ip rule add fwmark 3 table flood
ip route add default via $DEFAULT_GATEWAY table flood
fi
# setup route for qbittorrent http using set-mark to route traffic for port 8080 to eth0
echo "8080 qbittorrent_http" >> /etc/iproute2/rt_tables
ip rule add fwmark 1 table qbittorrent_http
ip route add default via $DEFAULT_GATEWAY table qbittorrent_http
fi
@ -101,19 +89,9 @@ iptables -A INPUT -s "${docker_network_cidr}" -d "${docker_network_cidr}" -j ACC
# accept input to vpn gateway
iptables -A INPUT -i eth0 -p $VPN_PROTOCOL --sport $VPN_PORT -j ACCEPT
# accept input to rutorrent port 9080
iptables -A INPUT -i eth0 -p tcp --dport 9080 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 9080 -j ACCEPT
# accept input to rutorrent port 9443
iptables -A INPUT -i eth0 -p tcp --dport 9443 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 9443 -j ACCEPT
# accept input to flood port 3000 if enabled
if [[ $ENABLE_FLOOD == "yes" || $ENABLE_FLOOD == "both" ]]; then
iptables -A INPUT -i eth0 -p tcp --dport 3000 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 3000 -j ACCEPT
fi
# accept input to qbittorrent port 8080
iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 8080 -j ACCEPT
# process lan networks in the list
for lan_network_item in "${lan_network_list[@]}"; do
@ -121,8 +99,8 @@ for lan_network_item in "${lan_network_list[@]}"; do
# strip whitespace from start and end of lan_network_item
lan_network_item=$(echo "${lan_network_item}" | sed -e 's~^[ \t]*~~;s~[ \t]*$~~')
# accept input to rtorrent scgi - used for lan access
iptables -A INPUT -i eth0 -s "${lan_network_item}" -p tcp --dport 5000 -j ACCEPT
# accept input to qbittorrent api - used for lan access
iptables -A INPUT -i eth0 -s "${lan_network_item}" -p tcp --dport 8080 -j ACCEPT
# accept input to privoxy if enabled
if [[ $ENABLE_PRIVOXY == "yes" ]]; then
@ -158,35 +136,15 @@ iptables -A OUTPUT -o eth0 -p $VPN_PROTOCOL --dport $VPN_PORT -j ACCEPT
# if iptable mangle is available (kernel module) then use mark
if [[ $iptable_mangle_exit_code == 0 ]]; then
# accept output from rutorrent port 9080 - used for external access
iptables -t mangle -A OUTPUT -p tcp --dport 9080 -j MARK --set-mark 1
iptables -t mangle -A OUTPUT -p tcp --sport 9080 -j MARK --set-mark 1
# accept output from rutorrent port 9443 - used for external access
iptables -t mangle -A OUTPUT -p tcp --dport 9443 -j MARK --set-mark 2
iptables -t mangle -A OUTPUT -p tcp --sport 9443 -j MARK --set-mark 2
# accept output from flood port 3000 if enabled - used for external access
if [[ $ENABLE_FLOOD == "yes" || $ENABLE_FLOOD == "both" ]]; then
iptables -t mangle -A OUTPUT -p tcp --dport 3000 -j MARK --set-mark 3
iptables -t mangle -A OUTPUT -p tcp --sport 3000 -j MARK --set-mark 3
fi
# accept output from qbittorrent port 8080 - used for external access
iptables -t mangle -A OUTPUT -p tcp --dport 8080 -j MARK --set-mark 1
iptables -t mangle -A OUTPUT -p tcp --sport 8080 -j MARK --set-mark 1
fi
# accept output from rutorrent port 9080 - used for lan access
iptables -A OUTPUT -o eth0 -p tcp --dport 9080 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 9080 -j ACCEPT
# accept output from rutorrent port 9443 - used for lan access
iptables -A OUTPUT -o eth0 -p tcp --dport 9443 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 9443 -j ACCEPT
# accept output from flood port 3000 if enabled - used for lan access
if [[ $ENABLE_FLOOD == "yes" || $ENABLE_FLOOD == "both" ]]; then
iptables -A OUTPUT -o eth0 -p tcp --dport 3000 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 3000 -j ACCEPT
fi
# accept output from qbittorrent port 8080 - used for lan access
iptables -A OUTPUT -o eth0 -p tcp --dport 8080 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 8080 -j ACCEPT
# process lan networks in the list
for lan_network_item in "${lan_network_list[@]}"; do
@ -194,8 +152,8 @@ for lan_network_item in "${lan_network_list[@]}"; do
# strip whitespace from start and end of lan_network_item
lan_network_item=$(echo "${lan_network_item}" | sed -e 's~^[ \t]*~~;s~[ \t]*$~~')
# accept output to rtorrent scgi - used for lan access
iptables -A OUTPUT -o eth0 -d "${lan_network_item}" -p tcp --sport 5000 -j ACCEPT
# accept output to qbittorrent api - used for lan access
iptables -A OUTPUT -o eth0 -d "${lan_network_item}" -p tcp --sport 8080 -j ACCEPT
# accept output from privoxy if enabled - used for lan access
if [[ $ENABLE_PRIVOXY == "yes" ]]; then

Write Preview
Loading…
Cancel
Save