Annotation of embedaddon/strongswan/testing/tests/ikev2/nat-virtual-ip/hosts/moon/etc/nat_updown, revision 1.1.1.1
1.1 misho 1: #!/bin/sh
2: # NAT updown script
3: #
4: # Copyright (C) 2010 Andreas Steffen <andreas.steffen@strongswan.org>
5: #
6: # This program is free software; you can redistribute it and/or modify it
7: # under the terms of the GNU General Public License as published by the
8: # Free Software Foundation; either version 2 of the License, or (at your
9: # option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10: #
11: # This program is distributed in the hope that it will be useful, but
12: # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13: # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14: # for more details.
15:
16: # PLUTO_VERSION
17: # indicates what version of this interface is being
18: # used. This document describes version 1.1. This
19: # is upwardly compatible with version 1.0.
20: #
21: # PLUTO_VERB
22: # specifies the name of the operation to be performed
23: # (prepare-host, prepare-client, up-host, up-client,
24: # down-host, or down-client). If the address family
25: # for security gateway to security gateway communica-
26: # tions is IPv6, then a suffix of -v6 is added to the
27: # verb.
28: #
29: # PLUTO_CONNECTION
30: # is the name of the connection for which we are
31: # routing.
32: #
33: # PLUTO_INTERFACE
34: # is the name of the ipsec interface to be used.
35: #
36: # PLUTO_REQID
37: # is the requid of the AH|ESP policy
38: #
39: # PLUTO_PROTO
40: # is the negotiated IPsec protocol, ah|esp
41: #
42: # PLUTO_IPCOMP
43: # is not empty if IPComp was negotiated
44: #
45: # PLUTO_UNIQUEID
46: # is the unique identifier of the associated IKE_SA
47: #
48: # PLUTO_ME
49: # is the IP address of our host.
50: #
51: # PLUTO_MY_ID
52: # is the ID of our host.
53: #
54: # PLUTO_MY_CLIENT
55: # is the IP address / count of our client subnet. If
56: # the client is just the host, this will be the
57: # host's own IP address / max (where max is 32 for
58: # IPv4 and 128 for IPv6).
59: #
60: # PLUTO_MY_SOURCEIP
61: # PLUTO_MY_SOURCEIP4_$i
62: # PLUTO_MY_SOURCEIP6_$i
63: # contains IPv4/IPv6 virtual IP received from a responder,
64: # $i enumerates from 1 to the number of IP per address family.
65: # PLUTO_MY_SOURCEIP is a legacy variable and equal to the first
66: # virtual IP, IPv4 or IPv6.
67: #
68: # PLUTO_MY_PROTOCOL
69: # is the IP protocol that will be transported.
70: #
71: # PLUTO_MY_PORT
72: # is the UDP/TCP port to which the IPsec SA is
73: # restricted on our side. For ICMP/ICMPv6 this contains the
74: # message type, and PLUTO_PEER_PORT the message code.
75: #
76: # PLUTO_PEER
77: # is the IP address of our peer.
78: #
79: # PLUTO_PEER_ID
80: # is the ID of our peer.
81: #
82: # PLUTO_PEER_CLIENT
83: # is the IP address / count of the peer's client sub-
84: # net. If the client is just the peer, this will be
85: # the peer's own IP address / max (where max is 32
86: # for IPv4 and 128 for IPv6).
87: #
88: # PLUTO_PEER_SOURCEIP
89: # PLUTO_PEER_SOURCEIP4_$i
90: # PLUTO_PEER_SOURCEIP6_$i
91: # contains IPv4/IPv6 virtual IP sent to an initiator,
92: # $i enumerates from 1 to the number of IP per address family.
93: # PLUTO_PEER_SOURCEIP is a legacy variable and equal to the first
94: # virtual IP, IPv4 or IPv6.
95: #
96: # PLUTO_PEER_PROTOCOL
97: # is the IP protocol that will be transported.
98: #
99: # PLUTO_PEER_PORT
100: # is the UDP/TCP port to which the IPsec SA is
101: # restricted on the peer side. For ICMP/ICMPv6 this contains the
102: # message code, and PLUTO_MY_PORT the message type.
103: #
104: # PLUTO_XAUTH_ID
105: # is an optional user ID employed by the XAUTH protocol
106: #
107: # PLUTO_MARK_IN
108: # is an optional XFRM mark set on the inbound IPsec SA
109: #
110: # PLUTO_MARK_OUT
111: # is an optional XFRM mark set on the outbound IPsec SA
112: #
113: # PLUTO_IF_ID_IN
114: # is an optional XFRM interface ID set on the inbound IPsec SA
115: #
116: # PLUTO_IF_ID_OUT
117: # is an optional XFRM interface ID set on the outbound IPsec SA
118: #
119: # PLUTO_UDP_ENC
120: # contains the remote UDP port in the case of ESP_IN_UDP
121: # encapsulation
122: #
123: # PLUTO_DNS4_$i
124: # PLUTO_DNS6_$i
125: # contains IPv4/IPv6 DNS server attribute received from a
126: # responder, $i enumerates from 1 to the number of servers per
127: # address family.
128: #
129:
130: # define a minimum PATH environment in case it is not set
131: PATH="/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin"
132: export PATH
133:
134: # resolve octal escape sequences
135: PLUTO_MY_ID=`printf "$PLUTO_MY_ID"`
136: PLUTO_PEER_ID=`printf "$PLUTO_PEER_ID"`
137:
138: case "$PLUTO_VERB:$1" in
139: up-host:)
140: # connection to me coming up
141: # If you are doing a custom version, firewall commands go here.
142: ;;
143: down-host:)
144: # connection to me going down
145: # If you are doing a custom version, firewall commands go here.
146: ;;
147: up-client:)
148: # connection to my client subnet coming up
149: # If you are doing a custom version, firewall commands go here.
150: iptables -A FORWARD -i eth1 -o $PLUTO_INTERFACE -s PH_IP_ALICE \
151: -d $PLUTO_PEER_CLIENT -j ACCEPT
152: iptables -A FORWARD -o eth1 -i $PLUTO_INTERFACE -d PH_IP_ALICE \
153: -s $PLUTO_PEER_CLIENT -j ACCEPT
154: iptables -t nat -A POSTROUTING -o $PLUTO_INTERFACE -s PH_IP_ALICE \
155: -d $PLUTO_PEER_CLIENT -j SNAT --to-source $PLUTO_MY_SOURCEIP
156: echo "inserted NAT rule mapping PH_IP_ALICE to virtual IP $PLUTO_MY_SOURCEIP" >&2
157: ;;
158: down-client:)
159: # connection to my client subnet going down
160: # If you are doing a custom version, firewall commands go here.
161: iptables -D FORWARD -i eth1 -o $PLUTO_INTERFACE -s PH_IP_ALICE \
162: -d $PLUTO_PEER_CLIENT -j ACCEPT
163: iptables -D FORWARD -o eth1 -i $PLUTO_INTERFACE -d PH_IP_ALICE \
164: -s $PLUTO_PEER_CLIENT -j ACCEPT
165: iptables -t nat -D POSTROUTING -o $PLUTO_INTERFACE -s PH_IP_ALICE \
166: -d $PLUTO_PEER_CLIENT -j SNAT --to-source $PLUTO_MY_SOURCEIP
167: echo "deleted NAT rule mapping PH_IP_ALICE to virtual IP $PLUTO_MY_SOURCEIP" >&2
168: ;;
169: *) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2
170: exit 1
171: ;;
172: esac
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to nat_updown CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / testing / tests / ikev2 / nat-virtual-ip / hosts / moon / etc