mirror of
git://f0xx.org/ac/ac-ms-remote-access
synced 2026-07-29 01:39:35 +03:00
45 lines
1.7 KiB
Bash
45 lines
1.7 KiB
Bash
#!/bin/bash
|
|
# Raspberry Pi router (f0xx.org): WAN UDP 45340 → FE (10.7.0.10).
|
|
# Invoked at boot or from iodine_warmup_helper; also: router_wireguard_dnat.sh [start|stop]
|
|
set -euo pipefail
|
|
|
|
FE_IP="${FE_IP:-10.7.0.10}"
|
|
WG_PORT="${WG_PORT:-45340}"
|
|
WAN_IF="${WAN_IF:-eth0}"
|
|
|
|
function start() {
|
|
if iptables -t nat -C PREROUTING -i "$WAN_IF" -p udp --dport "$WG_PORT" -j DNAT --to-destination "${FE_IP}:${WG_PORT}" 2>/dev/null; then
|
|
echo "Router DNAT already present for udp/${WG_PORT}"
|
|
else
|
|
iptables -t nat -A PREROUTING -i "$WAN_IF" -p udp --dport "$WG_PORT" -j DNAT --to-destination "${FE_IP}:${WG_PORT}"
|
|
echo "Added router PREROUTING udp/${WG_PORT} -> ${FE_IP}:${WG_PORT}"
|
|
fi
|
|
|
|
if iptables -C FORWARD -p udp -d "${FE_IP}" --dport "$WG_PORT" -j ACCEPT 2>/dev/null; then
|
|
echo "Router FORWARD rule already present"
|
|
else
|
|
iptables -A FORWARD -p udp -d "${FE_IP}" --dport "$WG_PORT" -j ACCEPT
|
|
echo "Added router FORWARD udp -> ${FE_IP}:${WG_PORT}"
|
|
fi
|
|
}
|
|
|
|
function stop() {
|
|
if iptables -t nat -C PREROUTING -i "$WAN_IF" -p udp --dport "$WG_PORT" -j DNAT --to-destination "${FE_IP}:${WG_PORT}" 2>/dev/null; then
|
|
iptables -t nat -D PREROUTING -i "$WAN_IF" -p udp --dport "$WG_PORT" -j DNAT --to-destination "${FE_IP}:${WG_PORT}"
|
|
echo "Removed router PREROUTING DNAT udp/${WG_PORT}"
|
|
else
|
|
echo "Router DNAT rule not present for udp/${WG_PORT}"
|
|
fi
|
|
|
|
if iptables -C FORWARD -p udp -d "${FE_IP}" --dport "$WG_PORT" -j ACCEPT 2>/dev/null; then
|
|
iptables -D FORWARD -p udp -d "${FE_IP}" --dport "$WG_PORT" -j ACCEPT
|
|
echo "Removed router FORWARD udp -> ${FE_IP}:${WG_PORT}"
|
|
else
|
|
echo "Router FORWARD rule not present"
|
|
fi
|
|
}
|
|
|
|
cmd=$1
|
|
cmd=${cmd:-start}
|
|
[ "$cmd" = "start" ] && start || stop
|