4ce00a6ac3
- move static routes from role service-rclocal to scripts run by systemd unit - mv routing specific sysctl settings
96 lines
4 KiB
Django/Jinja
96 lines
4 KiB
Django/Jinja
#!/bin/sh -e
|
|
#
|
|
# {{ ansible_managed }}
|
|
#
|
|
# rc.local
|
|
#
|
|
# This script is executed at the end of each multiuser runlevel.
|
|
# Make sure that the script will "exit 0" on success or any other
|
|
# value on error.
|
|
#
|
|
# In order to enable or disable this script just change the execution
|
|
# bits.
|
|
#
|
|
# By default this script does nothing.
|
|
|
|
#
|
|
# IP rules
|
|
#
|
|
|
|
# Priority 7 - lookup rt_table mwu for all incoming traffic of freifunk related interfaces
|
|
{% for mesh in meshes %}
|
|
ip -4 rule add from {{ mesh.ipv4_network | ipaddr('network') }}/16 lookup mwu priority 7
|
|
ip -4 rule add to {{ mesh.ipv4_network | ipaddr('network') }}/16 lookup mwu priority 7
|
|
ip -4 rule add from all oif {{ mesh.id }}BR lookup mwu priority 7
|
|
{% for ula in mesh.ipv6_ula %}
|
|
ip -6 rule add from {{ ula }} lookup mwu priority 7
|
|
ip -6 rule add to {{ ula }} lookup mwu priority 7
|
|
{% endfor %}
|
|
{% for public in mesh.ipv6_public %}
|
|
ip -6 rule add from {{ public }} lookup mwu priority 7
|
|
ip -6 rule add to {{ public }} lookup mwu priority 7
|
|
{% endfor %}
|
|
ip -6 rule add from all oif {{ mesh.id }}BR lookup mwu priority 7
|
|
{% endfor %}
|
|
|
|
# Priority 23 - lookup rt_table icvpn for all incoming traffic of freifunk bridges
|
|
{% for mesh in meshes %}
|
|
ip -4 rule add from {{ mesh.ipv4_network | ipaddr('network') }}/16 lookup icvpn priority 23
|
|
ip -4 rule add to {{ mesh.ipv4_network | ipaddr('network') }}/16 lookup icvpn priority 23
|
|
ip -4 rule add from all oif {{ mesh.id }}BR lookup icvpn priority 23
|
|
{% for ula in mesh.ipv6_ula %}
|
|
ip -6 rule add from {{ ula }} lookup icvpn priority 23
|
|
ip -6 rule add to {{ ula }} lookup icvpn priority 23
|
|
{% endfor %}
|
|
{% for public in mesh.ipv6_public %}
|
|
ip -6 rule add from {{ public }} lookup icvpn priority 23
|
|
ip -6 rule add to {{ public }} lookup icvpn priority 23
|
|
{% endfor %}
|
|
ip -6 rule add from all oif {{ mesh.id }}BR lookup icvpn priority 23
|
|
{% endfor %}
|
|
ip -4 rule add from all oif icVPN lookup icvpn priority 23
|
|
ip -6 rule add from all oif icVPN lookup icvpn priority 23
|
|
|
|
# Priority 41 - lookup rt_table internet for all incoming traffic of freifunk bridges
|
|
{% for mesh in meshes %}
|
|
ip -4 rule add from {{ mesh.ipv4_network | ipaddr('network') }}/16 lookup internet priority 41
|
|
{% for ula in mesh.ipv6_ula %}
|
|
ip -6 rule add from {{ ula }} lookup internet priority 41
|
|
ip -6 rule add to {{ ula }} lookup internet priority 41
|
|
{% endfor %}
|
|
{% for public in mesh.ipv6_public %}
|
|
ip -6 rule add from {{ public }} lookup internet priority 41
|
|
ip -6 rule add to {{ public }} lookup internet priority 41
|
|
{% endfor %}
|
|
ip -6 rule add from all oif {{ mesh.id }}BR lookup internet priority 41
|
|
{% endfor %}
|
|
ip -4 rule add from {{ ffrl_public_ipv4_nat | ipaddr('host') }} lookup internet priority 41
|
|
ip -4 rule add to {{ ffrl_public_ipv4_nat | ipaddr('host') }} lookup internet priority 41
|
|
|
|
# Priority 61 - at this point this is the end of policy routing for freifunk related routes
|
|
{% for mesh in meshes %}
|
|
ip -4 rule add from all iif {{ mesh.id }}BR type unreachable priority 61
|
|
ip -6 rule add from all iif {{ mesh.id }}BR type unreachable priority 61
|
|
{% endfor %}
|
|
ip -4 rule add from all iif icVPN type unreachable priority 61
|
|
ip -4 rule add from all iif {{ ansible_default_ipv4.interface }} type unreachable priority 61
|
|
{% for server_id, server_value in ffrl_exit_server.iteritems() %}
|
|
ip -4 rule add from all iif {{ server_id }} type unreachable priority 61
|
|
ip -6 rule add from all iif {{ server_id }} type unreachable priority 61
|
|
{% endfor %}
|
|
ip -6 rule add from all iif icVPN type unreachable priority 61
|
|
ip -6 rule add from all iif {{ ansible_default_ipv6.interface }} type unreachable priority 61
|
|
{% for mesh in meshes %}
|
|
{% for public in mesh.ipv6_public %}
|
|
ip -6 rule add from {{ public }} type unreachable priority 61
|
|
ip -6 rule add to {{ public }} type unreachable priority 61
|
|
{% endfor %}
|
|
{% endfor %}
|
|
|
|
# Priority 107 - lookup policies for the gateway host self originating traffic
|
|
ip -4 rule add from all lookup mwu priority 107
|
|
ip -4 rule add from all lookup icvpn priority 107
|
|
ip -6 rule add from all lookup mwu priority 107
|
|
ip -6 rule add from all lookup icvpn priority 107
|
|
|
|
exit 0
|