forked from extern/shorewall_code
b66929a65e
1) Elimination of the "shorewall monitor" command. 2) The /etc/shorewall/ipsec and /etc/shorewall/zones file are combined into a single /etc/shorewall/zones file. This is done in an upwardly-compatible way so that current users can continue to use their existing files. 3) Support has been added for the arp_ignore interface option. 4) DROPINVALID has been removed from shorewall.conf. Behavior is as if DROPINVALID=No was specified. 5) The 'nobogons' option and BOGON_LOG_LEVEL are removed. 6) Error and warning messages have been made easier to spot by using capitalization (e.g., ERROR: and WARNING:). 7) The /etc/shorewall/policy file now contains a new connection policy and a policy for ESTABLISHED packets. Useful for users of snort-inline who want to pass all packets to the QUEUE target. 8) A new 'critical' option has been added to /etc/shorewall/routestopped. Shorewall insures communication between the firewall and 'critical' hosts throughout start, restart, stop and clear. Useful for diskless firewall's with NFS-mounted file systems, LDAP servers, Crossbow, etc. 9) Macros. Macros are very similar to actions but are easier to use, allow parameter substitution and are more efficient. Almost all of the standard actions have been converted to macros in the EXPERIMENTAL branch. 10) The default value of ADD_IP_ALIASES in shorewall.conf is changed to No. 11) If you have 'make' installed on your firewall, then when you use the '-f' option to 'shorewall start' (as happens when you reboot), if your /etc/shorewall/ directory contains files that were modified after Shorewall was last restarted then Shorewall is started using the config files rather than using the saved configuration. git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2409 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
167 lines
3.6 KiB
Bash
Executable File
167 lines
3.6 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
RCDLINKS="2,S45 3,S45 6,K45"
|
|
################################################################################
|
|
# Script to create a gre or ipip tunnel -- Shorewall 2.6
|
|
#
|
|
# Modified - Steve Cowles 5/9/2000
|
|
# Incorporated init {start|stop} syntax and iproute2 usage
|
|
#
|
|
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
|
#
|
|
# (c) 2000,2001,2002,2003,2004,2005 - Tom Eastep (teastep@shorewall.net)
|
|
#
|
|
# Modify the following variables to match your configuration
|
|
#
|
|
# chkconfig: 2345 26 89
|
|
# description: GRE/IP Tunnel
|
|
#
|
|
################################################################################
|
|
|
|
#
|
|
# Type of tunnel (gre or ipip)
|
|
#
|
|
|
|
tunnel_type=gre
|
|
|
|
# Name of the tunnel
|
|
#
|
|
|
|
tunnel="dfwbos"
|
|
#
|
|
# Address of your External Interface (only required for gre tunnels)
|
|
#
|
|
myrealip="x.x.x.x"
|
|
|
|
# Address of the local system -- this is the address of one of your
|
|
# local interfaces (or for a mobile host, the address that this system has
|
|
# when attached to the local network).
|
|
#
|
|
|
|
myip="192.168.1.254"
|
|
|
|
# Address of the Remote system -- this is the address of one of the
|
|
# remote system's local interfaces (or if the remote system is a mobile host,
|
|
# the address that it uses when attached to the local network).
|
|
|
|
hisip="192.168.9.1"
|
|
|
|
# Internet address of the Remote system
|
|
#
|
|
|
|
gateway="x.x.x.x"
|
|
|
|
# Remote sub-network -- if the remote system is a gateway for a
|
|
# private subnetwork that you wish to
|
|
# access, enter it here. If the remote
|
|
# system is a stand-alone/mobile host, leave this
|
|
# empty
|
|
|
|
subnet="192.168.9.0/24"
|
|
|
|
# GRE Key -- set this to a number or to a dotted quad if you want
|
|
# a keyed GRE tunnel. You must specify a KEY if you
|
|
# intend to load ip_conntrack_proto_gre on either
|
|
# gateway system
|
|
|
|
key=
|
|
|
|
PATH=$PATH:/sbin:/usr/sbin:/usr/local/sbin
|
|
|
|
load_modules () {
|
|
case $tunnel_type in
|
|
ipip)
|
|
echo "Loading IP-ENCAP Module"
|
|
modprobe ipip
|
|
;;
|
|
gre)
|
|
echo "Loading GRE Module"
|
|
modprobe ip_gre
|
|
;;
|
|
esac
|
|
}
|
|
|
|
do_stop() {
|
|
|
|
if [ -n "`ip link show $tunnel 2>/dev/null`" ]; then
|
|
echo "Stopping $tunnel"
|
|
ip link set dev $tunnel down
|
|
fi
|
|
|
|
if [ -n "`ip addr show $tunnel 2>/dev/null`" ]; then
|
|
echo "Deleting $tunnel"
|
|
ip tunnel del $tunnel
|
|
fi
|
|
}
|
|
|
|
do_start() {
|
|
|
|
#NOTE: Comment out the next line if you have built gre/ipip into your kernel
|
|
|
|
load_modules
|
|
|
|
if [ -n "`ip link show $tunnel 2>/dev/null`" ]; then
|
|
do_stop
|
|
fi
|
|
|
|
echo "Adding $tunnel"
|
|
|
|
case $tunnel_type in
|
|
gre)
|
|
ip tunnel add $tunnel mode gre remote $gateway local $myrealip ttl 255 ${key:+key $key}
|
|
;;
|
|
*)
|
|
ip tunnel add $tunnel mode ipip remote $gateway
|
|
;;
|
|
esac
|
|
|
|
echo "Starting $tunnel"
|
|
|
|
|
|
ip link set dev $tunnel up
|
|
|
|
case $tunnel_type in
|
|
gre)
|
|
ip addr add $myip dev $tunnel
|
|
;;
|
|
*)
|
|
ip addr add $myip peer $hisip dev $tunnel
|
|
;;
|
|
esac
|
|
|
|
#
|
|
# As with all interfaces, the 2.4 kernels will add the obvious host
|
|
# route for this point-to-point interface
|
|
#
|
|
|
|
if [ -n "$subnet" ]; then
|
|
echo "Adding Routes"
|
|
case $tunnel_type in
|
|
gre)
|
|
ip route add $subnet dev $tunnel
|
|
;;
|
|
ipip)
|
|
ip route add $subnet via $gateway dev $tunnel onlink
|
|
;;
|
|
esac
|
|
fi
|
|
}
|
|
|
|
case "$1" in
|
|
start)
|
|
do_start
|
|
;;
|
|
stop)
|
|
do_stop
|
|
;;
|
|
restart)
|
|
do_stop
|
|
sleep 1
|
|
do_start
|
|
;;
|
|
*)
|
|
echo "Usage: $0 {start|stop|restart}"
|
|
exit 1
|
|
esac
|
|
exit 0
|