alexz/runtipi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rego-tunnel: parameterize net + add DHCP static lease
Some checks failed
Test / test (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Alex Zaw
2025-12-28 22:56:51 +00:00
parent 919f5904f8
commit 2d98ca843f
7 changed files with 169 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

63
apps/rego-tunnel/build/setup-network.sh
View File

@@ -1,10 +1,21 @@
#!/bin/bash
# Setup TAP/Bridge networking for QEMU VM
# Bridge: 100.100.0.1/24
# VM will be: 100.100.0.2/24
# Defaults:
# BRIDGE_NAME=br-rego-vpn
# TAP_NAME=tap0
# BRIDGE_CIDR=100.100.0.1/24
# VM_NET_IP=100.100.0.2
# VM_SUBNET=100.100.0.0/24
set -e
BRIDGE_NAME="${BRIDGE_NAME:-br-rego-vpn}"
TAP_NAME="${TAP_NAME:-tap0}"
BRIDGE_CIDR="${BRIDGE_CIDR:-100.100.0.1/24}"
VM_NET_IP="${VM_NET_IP:-100.100.0.2}"
VM_SUBNET="${VM_SUBNET:-100.100.0.0/24}"
TARGET_IP="${TARGET_IP:-10.35.33.230}"
# Pick the outbound interface based on the container's default route.
# (In Docker, this is not always eth1 when multiple networks are attached.)
WAN_IF="$(ip route show default 0.0.0.0/0 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="dev"){print $(i+1); exit}}')"
@@ -13,44 +24,44 @@ if [ -z "${WAN_IF}" ]; then
fi
# Create bridge if not exists
if ! ip link show br0 &>/dev/null; then
ip link add br0 type bridge
ip addr add 100.100.0.1/24 dev br0
ip link set br0 up
echo "Bridge br0 created with IP 100.100.0.1/24"
if ! ip link show "$BRIDGE_NAME" &>/dev/null; then
ip link add "$BRIDGE_NAME" type bridge
ip addr add "$BRIDGE_CIDR" dev "$BRIDGE_NAME"
ip link set "$BRIDGE_NAME" up
echo "Bridge $BRIDGE_NAME created with IP $BRIDGE_CIDR"
fi
# Create TAP device if not exists
if ! ip link show tap0 &>/dev/null; then
ip tuntap add tap0 mode tap
ip link set tap0 master br0
ip link set tap0 up
echo "TAP device tap0 created and attached to br0"
if ! ip link show "$TAP_NAME" &>/dev/null; then
ip tuntap add "$TAP_NAME" mode tap
ip link set "$TAP_NAME" master "$BRIDGE_NAME"
ip link set "$TAP_NAME" up
echo "TAP device $TAP_NAME created and attached to $BRIDGE_NAME"
fi
# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Setup NAT/masquerade for outbound traffic from VM
iptables -t nat -C POSTROUTING -s 100.100.0.0/24 -o "$WAN_IF" -j MASQUERADE 2>/dev/null || \
iptables -t nat -A POSTROUTING -s 100.100.0.0/24 -o "$WAN_IF" -j MASQUERADE
iptables -t nat -C POSTROUTING -s "$VM_SUBNET" -o "$WAN_IF" -j MASQUERADE 2>/dev/null || \
iptables -t nat -A POSTROUTING -s "$VM_SUBNET" -o "$WAN_IF" -j MASQUERADE
# Ensure forwarding between the VM bridge and outbound interface
iptables -C FORWARD -i br0 -o "$WAN_IF" -j ACCEPT 2>/dev/null || \
iptables -A FORWARD -i br0 -o "$WAN_IF" -j ACCEPT
iptables -C FORWARD -i "$WAN_IF" -o br0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \
iptables -A FORWARD -i "$WAN_IF" -o br0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -C FORWARD -i "$BRIDGE_NAME" -o "$WAN_IF" -j ACCEPT 2>/dev/null || \
iptables -A FORWARD -i "$BRIDGE_NAME" -o "$WAN_IF" -j ACCEPT
iptables -C FORWARD -i "$WAN_IF" -o "$BRIDGE_NAME" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \
iptables -A FORWARD -i "$WAN_IF" -o "$BRIDGE_NAME" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# Forward traffic destined for VPN networks to VM (10.35.33.230 = IBM i)
# Forward traffic destined for VPN networks to VM (TARGET_IP defaults to IBM i)
# The VM will route this through its VPN tunnel
iptables -C FORWARD -d 10.35.33.230 -j ACCEPT 2>/dev/null || iptables -A FORWARD -d 10.35.33.230 -j ACCEPT
iptables -C FORWARD -s 10.35.33.230 -j ACCEPT 2>/dev/null || iptables -A FORWARD -s 10.35.33.230 -j ACCEPT
iptables -C FORWARD -d "$TARGET_IP" -j ACCEPT 2>/dev/null || iptables -A FORWARD -d "$TARGET_IP" -j ACCEPT
iptables -C FORWARD -s "$TARGET_IP" -j ACCEPT 2>/dev/null || iptables -A FORWARD -s "$TARGET_IP" -j ACCEPT
# Route to IBM i through VM
ip route add 10.35.33.230 via 100.100.0.2 2>/dev/null || true
# Route to TARGET_IP through VM
ip route add "$TARGET_IP" via "$VM_NET_IP" 2>/dev/null || true
echo "Network setup complete"
echo "Bridge: br0 = 100.100.0.1/24"
echo "TAP: tap0 attached to br0"
echo "Route: 10.35.33.230 via 100.100.0.2 (VM)"
echo "Bridge: $BRIDGE_NAME = $BRIDGE_CIDR"
echo "TAP: $TAP_NAME attached to $BRIDGE_NAME"
echo "Route: $TARGET_IP via $VM_NET_IP (VM)"
echo "Outbound interface: ${WAN_IF}"