fork 0k-charms
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

165 lines
3.5 KiB

  1. #!/bin/bash
  2. ## Depends lxc-scripts installed
  3. ##
  4. ## Install
  5. ##
  6. version_gt() { test "$(echo "$@" | tr " " "\n" | sort -V | head -n 1)" != "$1"; }
  7. shorewall_candidate_version=$(echo $(apt-cache policy shorewall | grep "Candidate:" | cut -f 2 -d :))
  8. ## Support for docker introduced in 5.0.6
  9. if version_gt "$shorewall_candidate_version" 5.0.5; then
  10. apt-get install -y shorewall
  11. else
  12. (
  13. VERSION="5.0.7.2-1"
  14. cd /tmp &&
  15. wget http://ftp.fr.debian.org/debian/pool/main/s/shorewall-core/shorewall-core_${VERSION}_all.deb &&
  16. wget http://ftp.fr.debian.org/debian/pool/main/s/shorewall/shorewall_${VERSION}_all.deb &&
  17. dpkg -i shorewall-core_${VERSION}_all.deb shorewall_${VERSION}_all.deb &&
  18. rm shorewall-core_${VERSION}_all.deb shorewall_${VERSION}_all.deb
  19. ) || {
  20. echo "Failed to install shorewall."
  21. exit 1
  22. }
  23. fi
  24. ##
  25. ## Configuration
  26. ##
  27. cat <<EOF > /etc/shorewall/zones
  28. fw firewall
  29. net ipv4
  30. lan ipv4
  31. EOF
  32. cat <<EOF > /etc/shorewall/interfaces
  33. #ZONE INTERFACE BROADCAST OPTIONS
  34. net eth0
  35. ## Uncomment to enable vpn setup
  36. #vpn tun0 detect
  37. lan lxcbr0 - routeback
  38. EOF
  39. cat <<EOF > /etc/shorewall/policy
  40. #SOURCE DEST RULE LOG
  41. fw all ACCEPT
  42. lan all ACCEPT
  43. net all DROP info
  44. all all DROP info
  45. EOF
  46. cat <<EOF > /etc/shorewall/rules
  47. SSH/ACCEPT net fw
  48. Ping/ACCEPT net fw
  49. BEGIN SHELL
  50. host_ip="\$(/sbin/ifconfig eth0 2> /dev/null | sed "s/^.*inet ad\+r://g" | grep ^[0-9] | sed "s/ .*$//g")"
  51. for name in \$(lxc-ls-running); do
  52. ip=\$(dig +short A "\$name")
  53. [ -e "/var/lib/lxc/\$name/shorewall" ] &&
  54. cat /var/lib/lxc/\$name/shorewall | sed -r "s/%%HOST_INTERNET_IP%%/\$host_ip/g" \
  55. | sed -r "s/%%IP%%/\$ip/g"
  56. done
  57. true
  58. END SHELL
  59. EOF
  60. cat <<EOF > /etc/shorewall/masq
  61. eth0 lxcbr0
  62. EOF
  63. cat <<EOF > /etc/shorewall/start
  64. ## correct a bug that prevent DHCP packet to be correctly sent between
  65. ## LXC, preventing them to receive an IP.
  66. . /etc/default/lxc
  67. if [ -d "/sys/class/net/\$LXC_BRIDGE" -a "\$(cat /sys/class/net/\$LXC_BRIDGE/operstate)" == "up" ]; then
  68. source_file=/etc/init/lxc-net.conf
  69. code=\$(egrep '^\s+iptables.*\s+-j\s+' /etc/init/lxc-net.conf | grep -v '\-D' | sed -r 's/^\s+[^-]+/run_iptables /g')
  70. echo "Adding LXC rules:"
  71. echo "\$code"
  72. eval "\$code"
  73. fi
  74. EOF
  75. ##
  76. ## lxc-scripts
  77. ##
  78. [ -d "/opt/apps/lxc-scripts" ] || {
  79. echo "Error: required 'lxc-scripts' not installed." >&2
  80. exit 1
  81. }
  82. apt-get install -y moreutils ## needed because ``ts`` is used in this script
  83. ln -sf /opt/apps/lxc-scripts/etc/cron.d/lxc-shorewall-repair /etc/cron.d/lxc-shorewall-repair
  84. ##
  85. ## Logs
  86. ##
  87. mkdir -p /var/log/shorewall
  88. chgrp syslog /var/log/shorewall
  89. chmod g+w /var/log/shorewall
  90. cat <<EOF > /etc/rsyslog.d/shorewall.conf
  91. :msg, contains, "Shorewall:" /var/log/shorewall/main.log
  92. & ~
  93. EOF
  94. cat <<EOF > /etc/logrotate.d/shorewall
  95. /var/log/shorewall/init.log {
  96. weekly
  97. rotate 4
  98. compress
  99. missingok
  100. create 0640 root adm
  101. }
  102. /var/log/shorewall/main.log
  103. {
  104. rotate 7
  105. weekly
  106. missingok
  107. notifempty
  108. compress
  109. delaycompress
  110. postrotate
  111. reload rsyslog >/dev/null 2>&1 || true
  112. endscript
  113. }
  114. EOF
  115. ## Init logs
  116. sed -ri 's%^(STARTUP_LOG=).*$%\1/var/log/shorewall/init.log%g' /etc/shorewall/shorewall.conf
  117. service rsyslog restart
  118. ##
  119. ##
  120. ##
  121. ## Activate support for docker
  122. sed -ri 's/^DOCKER=No$/DOCKER=Yes/g' /etc/shorewall/shorewall.conf