# Add connmark rules for policy routing
if [ "$CONNMARK" = "1" ]
then
iptables -t mangle -A PREROUTING -i $IF_V -j MARK --set-mark 6
iptables -A INPUT -i $IF_Q -j CONNMARK --set-mark 3
iptables -A INPUT -i $IF_O -j CONNMARK --set-mark 4
iptables -A INPUT -i $IF_C -j CONNMARK --set-mark 5
iptables -A INPUT -i $IF_V -j CONNMARK --set-mark 6
iptables -A INPUT -i $IF_M -j CONNMARK --set-mark 7
iptables -A INPUT -i $IF_X -j CONNMARK --set-mark 8
iptables -A INPUT -i $IF_T -j CONNMARK --set-mark 9
iptables -A INPUT -i $IF_S -j CONNMARK --set-mark 10
for if in $IF_A $IF_W $IF_S
do
iptables -A FWD_ACCEPT -i $IF_Q -o $if -j CONNMARK --set-mark 3
iptables -A FWD_ACCEPT -i $IF_O -o $if -j CONNMARK --set-mark 4
iptables -A FWD_ACCEPT -i $IF_C -o $if -j CONNMARK --set-mark 5
iptables -A FWD_ACCEPT -i $IF_V -o $if -j CONNMARK --set-mark 6
iptables -A FWD_ACCEPT -i $IF_M -o $if -j CONNMARK --set-mark 7
iptables -A FWD_ACCEPT -i $IF_X -o $if -j CONNMARK --set-mark 8
iptables -A FWD_ACCEPT -i $IF_T -o $if -j CONNMARK --set-mark 9
iptables -A FWD_ACCEPT -i $IF_S -o $if -j CONNMARK --set-mark 10
done
for chain in PREROUTING OUTPUT
do
iptables -t mangle -A $chain -j CONNMARK --restore-mark
done
fiiptables -t mangle -A $chain -j CONNMARK --restore-markiptables -t mangle -A $chain -m connmark --mark 5 -j MARK --set-mark 5for ip in 85.21.0.0/24 78.107.1.0/24
do
for p in tcp udp
do
iptables -t mangle -A OUTPUT -d $ip -p $p --dport 1701 -j MARK --set-mark 5
done
done#!/bin/sh
#set -v
source /lib/rc/sh/functions.sh
source /etc/firewall/vars
addpr() {
# if table mark
if=$1
table=$2
mark=$3
c=$(ip a l dev $if|grep scope\ global|awk '{ print $2 }')
ip=$(echo $c|cut -d / -f 1)
mask=$(echo $c|cut -d / -f 2)
net=$(ip ro l dev $if|grep scope\ link|grep -v metric|awk '{ print $1 }')
einfo Adding policy routing for $table [$net]
if [ -z "$net" ]
then
ewarn "SKIP $table [net undefined]"
return
fi
#einfo Adding ip=$ip mask=$mask net=$net
#echo ip route replace $net dev $if src $ip table $table
ip route replace $net dev $if src $ip table $table
#echo ip route replace $LAN_A dev $IF_A src $ip table $table
ip route replace $LAN_A dev $IF_A src $ip table $table
#echo ip route replace $LAN_W dev $IF_W src $ip table $table
ip route replace $LAN_W dev $IF_W src $ip table $table
# fixme: check wheither pointopoint or not, don't compare with ppp0
if [ "$if" = "ppp0" ]
then
ip route replace default dev $if table $table
else
gw=$(ip ro l dev $if|grep \ via\ |head -n 1|awk '{ print $3 }')
if [ -z "$gw" ]
then
net1=$(echo $net|cut -d / -f 1)
# fixme this is buggy
gw=$(echo $net1|perl -pne 's/\.0$/.1/')
einfo "BUGGY GW $gw"
fi
#echo $table ... gw=$gw
ip route replace default via $gw table $table
fi
ip ru del p 10$mark >& /dev/null
ip ru add p 10$mark fwmark $mark lookup $table
ip ru del p 11$mark >& /dev/null
ip1=$(echo $ip|tr . ' '|awk '{ print $1 "." $2 }')
if ! [ "$ip1" = "10.254" ]
then
ip ru add p 11$mark from $ip lookup $table
fi
}
eindent
eindent
addpr $IF_Q *** 3
addpr $IF_O *** 4
addpr $IF_C *** 5
addpr $IF_V l2tpvpn 6
addpr $IF_M *** 7
addpr $IF_X *** 8
addpr $IF_T *** 9
addpr $IF_S *** 10
eoutdent
Правда, по-прежнему непонятно, чего ему нужно.