ange/VMs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: iptables simpler rules + 192.168.123.0/24

Browse Source
This commit is contained in:
ange 2024-03-09 23:25:52 +01:00
parent fe6b61ae17
commit 081c18be4d
Signed by: ange
GPG Key ID: 9E0C4157BB7BEB1D
2 changed files with 9 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
lib.sh
View File

@ -34,6 +34,7 @@ function _getnet() {
echo "$net" echo "$net"
} }
# TODO: -bios /usr/share/OVMF/OVMF_CODE.fd
function qemu() { function qemu() {
local maxram; maxram="$(_getmaxram)" local maxram; maxram="$(_getmaxram)"
local net; net="$(_getnet)" local net; net="$(_getnet)"

16
startnat.sh
View File

@ -24,7 +24,6 @@ if [ "$EUID" != 0 ]; then
fi fi
BRIDGE="${1-virbr0}" BRIDGE="${1-virbr0}"
DEV="$(ip route | grep -Po '^default.*dev\s+\K\w+')"
sysctl net.ipv4.conf.all.forwarding=1 sysctl net.ipv4.conf.all.forwarding=1
@ -35,22 +34,21 @@ fi
ip link set dev "$BRIDGE" up ip link set dev "$BRIDGE" up
ip address flush dev "$BRIDGE" ip address flush dev "$BRIDGE"
ip address add 192.168.122.1/24 dev "$BRIDGE" ip address add 192.168.123.1/24 dev "$BRIDGE"
# TODO: firewalld/nft?
newtable INPUT newtable INPUT
newtable FORWARD newtable FORWARD
newtable OUTPUT
newtable POSTROUTING -tnat newtable POSTROUTING -tnat
_iptables INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
_iptables INPUT -i virbr0 -j ACCEPT _iptables INPUT -i virbr0 -j ACCEPT
_iptables FORWARD -i "$BRIDGE" -o "$DEV" -j ACCEPT _iptables FORWARD -i virbr0 -j ACCEPT
_iptables FORWARD -i "$DEV" -o "$BRIDGE" -m state --state RELATED,ESTABLISHED -j ACCEPT _iptables FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
_iptables POSTROUTING -o "$DEV" -j MASQUERADE -tnat _iptables POSTROUTING -t nat -i "$BRIDGE" -j MASQUERADE
pidof dnsmasq | grep -q "$(cat /var/run/dnsmasq-virbr0.pid)" \ pidof dnsmasq | grep -q "$(cat /var/run/dnsmasq-virbr0.pid)" \
|| dnsmasq --bind-dynamic \ || dnsmasq -z \
-i "$BRIDGE" \ -i "$BRIDGE" \
-F 192.168.122.2,192.168.122.254,255.255.255.0 \ -F 192.168.123.2,192.168.123.254,255.255.255.0 \
-x /var/run/dnsmasq-virbr0.pid -x /var/run/dnsmasq-virbr0.pid