xenobyte/sukaato-ansible
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new major update

Browse Source
This commit is contained in:
Alex Tavarez committed 2026-09-26 14:18:27 -04:00
1 parent 161f8fc94e
commit 3f69aa6af1
60 files changed
+2228 -615
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/init-server/templates/usr/local/bin/dsnet-forward.sh.j2
-22
View File
@@ -1,22 +0,0 @@
#!/bin/bash
set -euo pipefail
if [[ "$1" == "start" ]]; then
/usr/sbin/iptables -A FORWARD -i dsnet -p tcp --sport 80 -j ACCEPT # HTTP
/usr/sbin/iptables -A FORWARD -i dsnet -p tcp --sport 443 -j ACCEPT # HTTPS (HTTP + SSL/TLS)
/usr/sbin/iptables -A FORWARD -i dsnet -p udp --sport 443 -j ACCEPT # HTTPS (HTTP + SSL/TLS)
/usr/sbin/iptables -A FORWARD -i dsnet -p tcp --sport 465 -j ACCEPT # SMTP (send)
/usr/sbin/iptables -A FORWARD -i dsnet -p tcp --sport 587 -j ACCEPT # SMTP (send)
/usr/sbin/iptables -A FORWARD -i dsnet -p tcp --sport 995 -j ACCEPT # POP3 (receive)
/usr/sbin/iptables -A FORWARD -i dsnet -p tcp --sport 993 -j ACCEPT # IMAP (receive)
/usr/sbin/iptables -t nat -A POSTROUTING -o dsnet -j MASQUERADE
elif [[ "$1" == "stop" ]]; then
/usr/sbin/iptables -D FORWARD -i dsnet -p tcp --sport 80 -j ACCEPT # HTTP
/usr/sbin/iptables -D FORWARD -i dsnet -p tcp --sport 443 -j ACCEPT # HTTPS (HTTP + SSL/TLS)
/usr/sbin/iptables -D FORWARD -i dsnet -p udp --sport 443 -j ACCEPT # HTTPS (HTTP + SSL/TLS)
/usr/sbin/iptables -D FORWARD -i dsnet -p tcp --sport 465 -j ACCEPT # SMTP (send)
/usr/sbin/iptables -D FORWARD -i dsnet -p tcp --sport 587 -j ACCEPT # SMTP (send)
/usr/sbin/iptables -D FORWARD -i dsnet -p tcp --sport 995 -j ACCEPT # POP3 (receive)
/usr/sbin/iptables -D FORWARD -i dsnet -p tcp --sport 993 -j ACCEPT # IMAP (receive)
/usr/sbin/iptables -t nat -D POSTROUTING -o dsnet -j MASQUERADE
fi
roles/init-server/templates/usr/local/bin/dsnet-routing.sh.j2
Executable
+28
View File
@@ -0,0 +1,28 @@
#!/bin/bash
set -euo pipefail
MASQ_TARGET_NET4=$(echo "$(</etc/dsnetconfig.json )" | awk '/^ {4}"Network":/ { print $2 }' | sed 's/[",]//g;s/\/[0-9]*//g')
# @WARNING below may not grab public IP of interface
ETH_INTF_IP4=($(ip addr show | grep inet | awk '/enp[0-9]+s[0-9]+|eth[0-9]+$/{print$2}' | sed 's/\/[0-9]*//'))
ETH_INTF=($(ip link show | awk '/^[0-9]+: [a-z]/ { print $2 }' | grep -E "enp[0-9]+s[0-9]+|eth[0-9]+" | sed 's/://g'))
{% if (vpn.server.forwards is defined and vpn.server.forwards != None) and (vpn.server.forwards | length) > 0 %}
PORT_DESTS=(<% vpn.server.forwards | map('string') | join(" ") %>)
{% endif %}
# sudo sysctl -w net.ipv4.ip_forward=1
# sudo sysctl -w net.ipv4.conf.all.src_valid_mark=1
sudo sysctl -p
if [[ "$1" == "up" ]]; then
CLIENT_IP4=<% vpn_client_ip.stdout %>
for portdest in ${PORT_DESTS[@]}; do
sudo iptables -t nat -A PREROUTING -d <% ipify_public_ip %> -p tcp --dport "$portdest" -j DNAT --to-destination "${CLIENT_IP4}:${portdest}"
done
sudo iptables -t nat -A POSTROUTING -s <% masq_target_net_ip.stdout %> -j MASQUERADE
elif [[ "$1" == "down" ]]; then
CLIENT_IP4=<% vpn_client_ip.stdout %>
for portdest in ${PORT_DESTS[@]}; do
sudo iptables -t nat -D PREROUTING -d <% ipify_public_ip %> -p tcp --dport "$portdest" -j DNAT --to-destination "${CLIENT_IP4}:${portdest}"
done
sudo iptables -t nat -D POSTROUTING -s <% masq_target_net_ip.stdout %> -j MASQUERADE
fi
roles/init-server/templates/usr/local/bin/dsnet-routing6.sh.j2
Executable
+37
View File
@@ -0,0 +1,37 @@
#!/bin/bash
set -euo pipefail
MASQ_TARGET_NET4=$(echo "$(</etc/dsnetconfig.json )" | awk '/^ {4}"Network":/ { print $2 }' | sed 's/[",]//g;s/\/[0-9]*//g')
MASQ_TARGET_NET6=$(echo "$(</etc/dsnetconfig.json )" | awk '/^ {4}"Network6":/ { print $2 }' | sed 's/[",]//g;s/\/[0-9]*//g')
# @WARNING below may not grab public IP of interface
ETH_INTF_IP4=($(ip addr show | grep inet | awk '/enp[0-9]+s[0-9]+|eth[0-9]+$/{print$2}' | sed 's/\/[0-9]*//'))
ETH_INTF_IP6=($(ip addr show | grep -A5 -E "enp[0-9]+s[0-9]+|eth[0-9]+" | awk '/^ {4}inet6 .* global/ { print $2 }' | sed 's/\/[0-9]*//g'))
ETH_INTF=($(ip link show | awk '/^[0-9]+: [a-z]/ { print $2 }' | grep -E "enp[0-9]+s[0-9]+|eth[0-9]+" | sed 's/://g'))
{% if (vpn.server.forwards is defined and vpn.server.forwards != None) and (vpn.server.forwards | length) > 0 %}
PORT_DESTS=(<% vpn.server.forwards | map('string') | join(" ") %>)
{% endif %}
# sudo sysctl -w net.ipv4.ip_forward=1
# sudo sysctl -w net.ipv6.conf.all.forwarding=1
# sudo sysctl -w net.ipv4.conf.all.src_valid_mark=1
sudo sysctl -p
if [[ "$1" == "up" ]]; then
CLIENT_IP4=<% vpn_client_ip.stdout %>
CLIENT_IP6=<% vpn_client_ip.stdout %>
for portdest in ${PORT_DESTS[@]}; do
sudo iptables -t nat -A PREROUTING -d <% ipify_public_ip %> -p tcp --dport "$portdest" -j DNAT --to-destination "${CLIENT_IP4}:${portdest}"
sudo ip6tables -t nat -A PREROUTING -d <% ipify_public_ip6.stdout %> -p tcp --dport "$portdest" -j DNAT --to-destination "${CLIENT_IP6}:${portdest}"
done
sudo iptables -t nat -A POSTROUTING -s <% masq_target_net_ip.stdout %> -j MASQUERADE
sudo ip6tables -t nat -A POSTROUTING -s <% masq_target_net_ip6.stdout %> -j MASQUERADE
elif [[ "$1" == "down" ]]; then
CLIENT_IP4=<% vpn_client_ip.stdout %>
CLIENT_IP6=<% vpn_client_ip.stdout %>
for portdest in ${PORT_DESTS[@]}; do
sudo iptables -t nat -D PREROUTING -d <% ipify_public_ip %> -p tcp --dport "$portdest" -j DNAT --to-destination "${CLIENT_IP4}:${portdest}"
sudo ip6tables -t nat -D PREROUTING -d <% ipify_public_ip6.stdout %> -p tcp --dport "$portdest" -j DNAT --to-destination "${CLIENT_IP6}:${portdest}"
done
sudo iptables -t nat -D POSTROUTING -s <% masq_target_net_ip.stdout %> -j MASQUERADE
sudo ip6tables -t nat -D POSTROUTING -s <% masq_target_net_ip6.stdout %> -j MASQUERADE
fi