-
Notifications
You must be signed in to change notification settings - Fork 97
/
nf6-setup
executable file
·53 lines (37 loc) · 1.44 KB
/
nf6-setup
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
#!/bin/sh
# sshttp netfilter rules
#
# If you mux SSH/SMTP (rather than HTTP), then HTTP_PORT is your
# alternate SMTP port. e.g. 2525 and sshttp needs to be started with
# '-L 25 -H 2525'
DEV=eth0
# The ports you want to mux:
# -S <port> -H <port> and any other -N SNI:<ports> (in case of HTTPS)
# do NOT add the -L port here
# standard SSH / HTTP mux looks like this (sshttpd -S 22 -H 8080 -L 80)
PORTS="22 8080"
# a SSH / HTTPS mux with https server on port 4433 and a drops
# on port 7350 looks like this (sshttpd -S 22 -H 4433 -L 443 -N drops.v2:7350)
#PORTS="22 4433 7350"
# SNI-only mux without SSH (sshttpd -S 0 -H 4433 -L 443 -N drops.v2:7350)
#PORTS="4433 7350"
#if it clashes with complex NATing rules, try this
#ip6tables -t mangle -F
#ip6tables -t nat -F
#ip6tables -t raw -F
modprobe nf_conntrack_ipv6 || true
ip6tables -t mangle -N DIVERT || true
echo "Using network device $DEV"
for p in $PORTS; do
echo "Setting up port $p ..."
# block HTTP/SSH direct access from outside
ip6tables -A INPUT -i $DEV -p tcp --dport $p -j DROP
# and divert anything back to sshttpd that comes from the muxed services
# so sshttpd can see it
ip6tables -t mangle -A OUTPUT -p tcp -o $DEV --sport $p -j DIVERT
done
ip6tables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
ip6tables -t mangle -A DIVERT -j MARK --set-mark 1
ip6tables -t mangle -A DIVERT -j ACCEPT
ip -6 rule add fwmark 1 lookup 123 || true
ip -6 route add local ::/0 dev lo table 123