38 lines
1.6 KiB
Bash
Executable File
38 lines
1.6 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
zero_enable="$(uci get zerotier.sample_config.enabled)"
|
|
[ "$zero_enable" -eq "1" ] || exit 1
|
|
|
|
count=0
|
|
[ -f "/tmp/zero.log" ] && {
|
|
while [ -z "$(ifconfig | grep 'zt' | awk '{print $1}')" ]
|
|
do
|
|
sleep 2
|
|
let count++
|
|
[ "$count" -lt 5 ] || exit 19
|
|
done
|
|
}
|
|
|
|
nft_incdir="/usr/share/nftables.d/chain-pre"
|
|
rm -f "$nft_incdir/input/zerotier.nft" "$nft_incdir/forward/zerotier.nft" "$$nft_incdir/srcnat/zerotier.nft"
|
|
|
|
nat_enable="$(uci get zerotier.sample_config.nat)"
|
|
[ "$nat_enable" -eq "1" ] && {
|
|
[ -d "$nft_incdir/input" ] || mkdir -p "$nft_incdir/input"
|
|
[ -d "$nft_incdir/forward" ] || mkdir -p "$nft_incdir/forward"
|
|
[ -d "$nft_incdir/srcnat" ] || mkdir -p "$nft_incdir/srcnat"
|
|
for i in $(ifconfig | grep 'zt' | awk '{print $1}')
|
|
do
|
|
ip_segment="$(ip route | grep "dev $i proto kernel" | awk '{print $1}')"
|
|
echo "iifname $i counter accept comment \"!fw4: Zerotier allow inbound $i\"" >> "$nft_incdir/input/zerotier.nft"
|
|
echo "iifname $i counter accept comment \"!fw4: Zerotier allow inbound forward $i\"" >> "$nft_incdir/forward/zerotier.nft"
|
|
echo "oifname $i counter accept comment \"!fw4: Zerotier allow outbound forward $i\"" >> "$nft_incdir/forward/zerotier.nft"
|
|
echo "oifname $i counter masquerade comment \"!fw4: Zerotier $i outbound postrouting masq\"" >> "$nft_incdir/srcnat/zerotier.nft"
|
|
[ -z "$ip_segment" ] || echo "ip saddr $ip_segment counter masquerade comment \"!fw4: Zerotier $ip_segment postrouting masq\"" >> "$nft_incdir/srcnat/zerotier.nft"
|
|
done
|
|
echo "zt interface rules added!" > "/tmp/zero.log"
|
|
uci -q set firewall.@defaults[0].auto_includes="1"
|
|
uci -q commit firewall
|
|
fw4 reload
|
|
}
|