Created
August 25, 2014 10:16
-
-
Save breiter/122b70203df6e29ebe22 to your computer and use it in GitHub Desktop.
Linux NAT instance script for EC2 invoked from rc.local.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/bash | |
# Configure the instance to run as a Port Address Translator (PAT) to provide | |
# Internet connectivity to private instances. | |
function log { logger -t "vpc" -- $1; } | |
function die { | |
[ -n "$1" ] && log "$1" | |
log "Configuration of PAT failed!" | |
exit 1 | |
} | |
# Sanitize PATH | |
PATH="/usr/sbin:/sbin:/usr/bin:/bin" | |
log "Determining the MAC address on eth0..." | |
ETH0_MAC=$(cat /sys/class/net/eth0/address) || | |
die "Unable to determine MAC address on eth0." | |
log "Found MAC ${ETH0_MAC} for eth0." | |
VPC_CIDR_URI="http://169.254.169.254/latest/meta-data/network/interfaces/macs/${ETH0_MAC}/vpc-ipv4-cidr-block" | |
log "Metadata location for vpc ipv4 range: ${VPC_CIDR_URI}" | |
VPC_CIDR_RANGE=$(curl --retry 3 --silent --fail ${VPC_CIDR_URI}) | |
if [ $? -ne 0 ]; then | |
log "Unable to retrive VPC CIDR range from meta-data, using 0.0.0.0/0 instead. PAT may be insecure!" | |
VPC_CIDR_RANGE="0.0.0.0/0" | |
else | |
log "Retrieved VPC CIDR range ${VPC_CIDR_RANGE} from meta-data." | |
fi | |
log "Enabling PAT..." | |
sysctl -q -w net.ipv4.ip_forward=1 net.ipv4.conf.eth0.send_redirects=0 && ( | |
iptables -t nat -C POSTROUTING -o eth0 -s ${VPC_CIDR_RANGE} -j MASQUERADE 2> /dev/null || | |
iptables -t nat -A POSTROUTING -o eth0 -s ${VPC_CIDR_RANGE} -j MASQUERADE ) || | |
die | |
sysctl net.ipv4.ip_forward net.ipv4.conf.eth0.send_redirects | log | |
iptables -n -t nat -L POSTROUTING | log | |
log "Configuration of PAT complete." | |
exit 0 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Note this script requires
curl
, which is not installed on a Debian 7 (Wheezy) EC2 base image, so also need to do sudo apt-get install curl.