57 lines
2.1 KiB
Bash
57 lines
2.1 KiB
Bash
#!/bin/bash
|
|
# Setup TAP/Bridge networking for QEMU VM
|
|
# Bridge: 100.100.0.1/24
|
|
# VM will be: 100.100.0.2/24
|
|
|
|
set -e
|
|
|
|
# Pick the outbound interface based on the container's default route.
|
|
# (In Docker, this is not always eth1 when multiple networks are attached.)
|
|
WAN_IF="$(ip route show default 0.0.0.0/0 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="dev"){print $(i+1); exit}}')"
|
|
if [ -z "${WAN_IF}" ]; then
|
|
WAN_IF="eth1"
|
|
fi
|
|
|
|
# Create bridge if not exists
|
|
if ! ip link show br0 &>/dev/null; then
|
|
ip link add br0 type bridge
|
|
ip addr add 100.100.0.1/24 dev br0
|
|
ip link set br0 up
|
|
echo "Bridge br0 created with IP 100.100.0.1/24"
|
|
fi
|
|
|
|
# Create TAP device if not exists
|
|
if ! ip link show tap0 &>/dev/null; then
|
|
ip tuntap add tap0 mode tap
|
|
ip link set tap0 master br0
|
|
ip link set tap0 up
|
|
echo "TAP device tap0 created and attached to br0"
|
|
fi
|
|
|
|
# Enable IP forwarding
|
|
echo 1 > /proc/sys/net/ipv4/ip_forward
|
|
|
|
# Setup NAT/masquerade for outbound traffic from VM
|
|
iptables -t nat -C POSTROUTING -s 100.100.0.0/24 -o "$WAN_IF" -j MASQUERADE 2>/dev/null || \
|
|
iptables -t nat -A POSTROUTING -s 100.100.0.0/24 -o "$WAN_IF" -j MASQUERADE
|
|
|
|
# Ensure forwarding between the VM bridge and outbound interface
|
|
iptables -C FORWARD -i br0 -o "$WAN_IF" -j ACCEPT 2>/dev/null || \
|
|
iptables -A FORWARD -i br0 -o "$WAN_IF" -j ACCEPT
|
|
iptables -C FORWARD -i "$WAN_IF" -o br0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \
|
|
iptables -A FORWARD -i "$WAN_IF" -o br0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
|
|
# Forward traffic destined for VPN networks to VM (10.35.33.230 = IBM i)
|
|
# The VM will route this through its VPN tunnel
|
|
iptables -C FORWARD -d 10.35.33.230 -j ACCEPT 2>/dev/null || iptables -A FORWARD -d 10.35.33.230 -j ACCEPT
|
|
iptables -C FORWARD -s 10.35.33.230 -j ACCEPT 2>/dev/null || iptables -A FORWARD -s 10.35.33.230 -j ACCEPT
|
|
|
|
# Route to IBM i through VM
|
|
ip route add 10.35.33.230 via 100.100.0.2 2>/dev/null || true
|
|
|
|
echo "Network setup complete"
|
|
echo "Bridge: br0 = 100.100.0.1/24"
|
|
echo "TAP: tap0 attached to br0"
|
|
echo "Route: 10.35.33.230 via 100.100.0.2 (VM)"
|
|
echo "Outbound interface: ${WAN_IF}"
|