diff options
Diffstat (limited to 'wg-netns-exec')
| -rwxr-xr-x | wg-netns-exec | 91 |
1 files changed, 51 insertions, 40 deletions
diff --git a/wg-netns-exec b/wg-netns-exec index 38667bd..0259e07 100755 --- a/wg-netns-exec +++ b/wg-netns-exec @@ -60,16 +60,16 @@ echo "config: $wg_conf" wg_if="wg-${netns}" ((!${#tap_addrs[@]})) && tap_addrs=(10.0.0.1/32 fd00::1/64) -def_daddr= -def_daddr6= +def_taddr= +def_taddr6= for addr in "${tap_addrs[@]}"; do addr="${addr%%/*}" if [[ "${addr}" == *:* ]]; then - [[ -z "${def_daddr6}" ]] && def_daddr6="${addr%:1}:2" && - [[ -n "${def_daddr}" ]] && break + [[ -z "${def_taddr6}" ]] && def_taddr6="${addr%:1}:2" && + [[ -n "${def_taddr}" ]] && break else - [[ -z "${def_daddr}" ]] && def_daddr="${addr%.1}.2" && - [[ -n "${def_daddr6}" ]] && break + [[ -z "${def_taddr}" ]] && def_taddr="${addr%.1}.2" && + [[ -n "${def_taddr6}" ]] && break fi done @@ -107,52 +107,63 @@ if ((enable_tap)); then pre= if ((${#dnat_rules[@]})); then - pre='chain prerouting { - type nat hook prerouting priority dstnat - policy accept' - for saddr in "${dnat_rules[@]}"; do - sport= proto= daddr= dport= - if [[ "${saddr}" =~ ^((.*)\ +)?to\ +(.*) ]]; then - saddr="${BASH_REMATCH[2]}" - daddr="${BASH_REMATCH[3]}" + printf -v pre '%s\n' 'chain prerouting {' \ + 'type nat hook prerouting priority dstnat' \ + 'policy accept' + for daddr in "${dnat_rules[@]}"; do + saddr= sport= dport= proto= taddr= tport= + + if [[ "${daddr}" =~ ^((.*)\ +)?to\ +(.*) ]]; then + daddr="${BASH_REMATCH[2]}" + taddr="${BASH_REMATCH[3]}" + fi + if [[ "${daddr}" =~ ^\ *from\ +(.*)\ +for\ +(.*) || + "${daddr}" =~ ^\ *from\ +(.*)() + ]]; then + saddr="${BASH_REMATCH[1]}" + daddr="${BASH_REMATCH[2]}" fi + [[ "${daddr}" =~ ^\ *any\ *(/.*)?$ ]] && + daddr=":${BASH_REMATCH[1]}" ip_re='(([^:]*\[[^]]*\]([^:]*\[[^]]*\])*)?[^:]*)' - [[ "${saddr}" =~ ^\ *any\ *(/.*)?$ ]] && - saddr=":${BASH_REMATCH[1]}" - [[ "${saddr}" =~ ^${ip_re}:?([^/]*)/?(.*) ]] - saddr="${BASH_REMATCH[1]}" - sport="${BASH_REMATCH[4]}" + [[ "${daddr}" =~ ^${ip_re}:?([^/]*)/?(.*) ]] + daddr="${BASH_REMATCH[1]}" + dport="${BASH_REMATCH[4]}" proto="${BASH_REMATCH[5]}" - - if [[ -n "${daddr}" ]]; then - [[ "${daddr}" =~ ^${ip_re}:?(.*) ]] - daddr="${BASH_REMATCH[1]}" - dport="${BASH_REMATCH[4]}" + if [[ -n "${saddr}" ]]; then + [[ "${saddr}" =~ ^${ip_re}:?(.*) ]] + saddr="${BASH_REMATCH[1]}" + sport="${BASH_REMATCH[4]}" + fi + if [[ -n "${taddr}" ]]; then + [[ "${taddr}" =~ ^${ip_re}:?(.*) ]] + taddr="${BASH_REMATCH[1]}" + tport="${BASH_REMATCH[4]}" fi - [[ "${saddr}" == *:* || "${daddr}" == *:* ]] && + [[ "${saddr}${daddr}${taddr}" == *:* ]] && ip6=1 || ip6= + [[ -n "${sport}${dport}${tport}" ]] && + : "${proto:=tcp}" + printf -v r '%s' "iifname ${wg_if}" \ + "${saddr:+ ip${ip6:+6} saddr ${saddr}}" \ + "${daddr:+ ip${ip6:+6} daddr ${daddr}}" \ + "${proto:+ meta l4proto {${proto}\}}" \ + "${sport:+ th sport ${sport}}" \ + "${dport:+ th dport ${dport}}" - r="iifname ${wg_if}" - [[ -n "${saddr}" ]] && r+=" ip${ip6:+6} saddr ${saddr}" - [[ -n "${sport}" || -n "${dport}" || - -n "${proto}" ]] && - r+=" meta l4proto {${proto:-tcp}}" - [[ -n "${sport}" ]] && r+=" th dport ${sport}" - dport="${dport:+:${dport}}" - + tport="${tport:+:${tport}}" ((!ip6)) && - d="${daddr:-${def_daddr}}" && + d="${taddr:-${def_taddr}}" && [[ -n "${d}" ]] && - pre+=$'\n'"${r} dnat ip to ${d}${dport}" - - ((ip6)) || [[ -z "${saddr}" && -z "${daddr}" ]] && - d="${daddr:-${def_daddr6}}" && + pre+="${r} dnat ip to ${d}${tport}"$'\n' + ((ip6)) || [[ -z "${saddr}${daddr}${taddr}" ]] && + d="${taddr:-[${def_taddr6}]}" && [[ -n "${d}" ]] && - pre+=$'\n'"${r} dnat ip6 to ${d}${dport}" + pre+="${r} dnat ip6 to ${d}${tport}"$'\n' done - pre+=$'\n}' + pre+='}' fi run ip netns exec "${netns}" nft -f - <<-EOF table inet nat { |