Last active
March 23, 2023 06:24
-
-
Save LuisPalacios/c57eec842bf72c27674206ebc7bb51d2 to your computer and use it in GitHub Desktop.
Norte: /etc/openvpn/server/norte_bridge_ethernet_server_UP.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/bash | |
# Script que se ejecuta al hacer un `start` del servicio Bridge Ethernet | |
# Interfaces, rutas + IP y MACs asociaré a las interfaces tap y bridge | |
. /etc/openvpn/server/norte_bridge_ethernet_server_CONFIG.sh | |
# Activo el tunel IPSec | |
ip link set ${EB_TAP} address ${mac_tap} | |
ip link set ${EB_TAP} up | |
# SETUP BRIDGE | |
brctl addbr ${EB_BRIDGE} | |
brctl stp ${EB_BRIDGE} off # HUB: no uso STP | |
brctl setageing ${EB_BRIDGE} 0 # HUB: olvidar MAC addresses, be a HUB | |
brctl setfd ${EB_BRIDGE} 0 # HUB: elimino el forward delay | |
#ip link set ${EB_BRIDGE} promisc on # entregar el paquete en local | |
ip link set ${EB_BRIDGE} address ${mac_bridge} # Cada nodo debe tener una distinta | |
ip link set ${EB_BRIDGE} arp on | |
ip link set ${EB_BRIDGE} mtu ${mtu} | |
ip link set ${EB_BRIDGE} up | |
# Añadir interfaces al bridge | |
brctl addif ${EB_BRIDGE} ${EB_TAP} # Añado tunel ipsec al bridge | |
# Asignar una IP al Bridge si queremos que vaya todo por el bridge | |
# IMPORTANTÍSIMO poner /24 o asignará una /32 (no funcionará) | |
ip addr add ${bridge_ip_local} brd + dev ${EB_BRIDGE} | |
# Interfaz que se conecta al router Movistar y dedico al bridge | |
# ethernet para el tráfico IPTV | |
ip link set ${IF_IPTV} up | |
ip link set ${IF_IPTV} mtu ${mtu} | |
# Añado una IP a la interfaz hacia movistar y las rutas de IPTV | |
# pero con una métrica distinta, para que no se haga un lío con eth0 | |
ip addr add dev ${IF_IPTV} ${ip_local_iptv} metric 300 | |
# Activo MASQUERADE en esta interaz, todo lo que salga por ella | |
# que venga desd el tunel bridge ethernet llevará mi IP. | |
iptables -t nat -I POSTROUTING -o ${IF_IPTV} -j MASQUERADE | |
# Me aseguro de configurar bien el rp_filter | |
echo -n 0 > /proc/sys/net/ipv4/conf/${EB_BRIDGE}/rp_filter | |
echo -n 1 > /proc/sys/net/ipv4/conf/${EB_TAP}/rp_filter | |
# Importante: Desactivar RPF en la opción “All” y además en la interfaz | |
# upstream por donde viene el tráfico desde las fuentes Multicast | |
echo -n 0 > /proc/sys/net/ipv4/conf/all/rp_filter | |
echo -n 0 > /proc/sys/net/ipv4/conf/${IF_IPTV}/rp_filter | |
# Me aseguro de que el forwarding está funcionando | |
echo -n 1 > /proc/sys/net/ipv4/ip_forward | |
# Activo filtros L2 y L3 | |
/etc/openvpn/server/norte_bridge_ethernet_server_FW_SET.sh | |
# Asociamos flujos RTSP al helper de conntrack | |
# - Automática, para Kernel's <= 5.x: | |
# sysctl -q -w net.netfilter.nf_conntrack_helper=1 | |
# - Manual para cualquier Kernel's, incluido 6.x: | |
iptables -t raw -A PREROUTING -p tcp --dport 554 -j CT --helper rtsp | |
# Tabla de routing para los Decos | |
grep -i "^206 Decos" /etc/iproute2/rt_tables > /dev/null 2>&1 | |
if [ "$?" = 1 ]; then | |
sudo echo "206 Decos" >> /etc/iproute2/rt_tables | |
fi | |
ip route add ${bridge_ip_rango} dev ${EB_BRIDGE} table Decos | |
ip route add default via ${ip_router_iptv} dev ${IF_IPTV} table Decos | |
ip rule add from ${bridge_ip_rango} table Decos | |
# Por último rearranco igmpproxy para que empiece a usar el interfaz BE_BRIDGE | |
sudo systemctl restart igmpproxy |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment