Neuradni T-2 forum

Koda: Izberi vse

#!/bin/sh
# Start/stop/restart the bridge.
#
# Written for Slackware Linux by Patrick J. Volkerding <volkerdi@slackware.com>.

BRCTL=brctl
IPTABLES=iptables
EBTABLES=ebtables
IFCONFIG=ifconfig

BRIF="br0"
INTIF="vlan1"
OUTIF="vlan0"

check_bridge() {
  return `$IFCONFIG | grep $BRIF -c`
}

bridge_start() {

    echo "  Starting bridge.."
    echo "   - Setting ebtables rules.."

    # Clear any rules
    $EBTABLES -t broute -F
    $EBTABLES -F

    # Default is bridging
    $EBTABLES -t broute -P BROUTING ACCEPT

    # IGMP bridging is needed
    #$EBTABLES -t broute -A BROUTING -p 0x800 --ip-proto igmp --log --log-level=info --log-prefix="igmp-bridge: "
    $EBTABLES -t broute -A BROUTING -p 0x800 --logical-in $BRIF --ip-proto igmp -j ACCEPT

    # UDP multicast bridging
    $EBTABLES -t broute -A BROUTING -d 01:00:00:00:00:00/01:00:00:00:00:00 -p 0x800 --logical-in $BRIF \
      --ip-proto udp --ip-dst 239.1.0.0/22 --ip-dport 5000 -j ACCEPT

    # All other bridging on br0 is denied
    $EBTABLES -t broute -A BROUTING --logical-in $BRIF -j DROP
}

bridge_stop() {
  check_bridge
  if [ $? -gt 0 ]; then
    echo "  Stopping bridge.."

    $EBTABLES -t broute -F
    $EBTABLES -t broute -P BROUTING ACCEPT
  fi
}

bridge_restart() {
  echo "Restarting bridge:  "
  bridge_stop
  bridge_start
}

bridge_status() {
  check_bridge
  if [ $? -eq 0 ]; then
    echo "  Bridge ($BRIF) status: inactive"
    exit 2
  else
    echo "  Bridge ($BRIF) status: active"
    exit 1
  fi
}

case "$1" in
'start')
  bridge_start
  ;;
'stop')
  bridge_stop
  ;;
'restart')
  bridge_restart
  ;;
'status')
  ;;
*)
  echo "usage $0 start|stop|restart|status"
esac

bridge_status

Koda: Izberi vse

### Bridge forwarding
## -- Connections forwarded on $TV bridge
iptables -A bridge_rule -p udp -d 239.1.0.0/22 --dport 5000 -j ACCEPT
iptables -A bridge_rule -p igmp -s 192.168.0.0/24 -d 224.0.0.2 -m physdev \
    --physdev-in vlan1 --physdev-out vlan0 -j ACCEPT
iptables -A bridge_rule -p igmp -s 192.168.0.0/24 -d 224.0.0.22 -m physdev \
    --physdev-in vlan1 --physdev-out vlan0 -j ACCEPT
iptables -A bridge_rule -p igmp -s 192.168.0.0/24 -d 239.1.0.0/22 -m physdev \
    --physdev-in vlan1 --physdev-out vlan0 -j ACCEPT

iptables -A bridge_rule -p igmp -s 10.0.1.3 -d 239.1.0.0/22 -m physdev \
    --physdev-in vlan0 --physdev-out vlan1 -j ACCEPT
iptables -A bridge_rule -p igmp -s 10.0.1.3 -d 224.0.0.1 -m physdev \
    --physdev-in vlan0 --physdev-out vlan1 -j ACCEPT

# All other forwarding on $TV is denied
iptables -A bridge_rule -j DROP

Koda: Izberi vse

### FORWARDING
### (connections routed through the router)

  # base case
  iptables -P FORWARD DROP
  iptables -A FORWARD -m state --state INVALID -j DROP
  iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

  # bridge rules
  TV="$(nvram get tv_ifname)"
  iptables -N bridge_rule
  iptables -A FORWARD -i $TV -o $TV -j bridge_rule

Koda: Izberi vse

tv_ifnames=vlan0 vlan1
ifup_interfaces=tv lan wan wifi
tv_ipaddr=0.0.0.0
tv_proto=static
tv_ifname=br0
tv_netmask=255.255.255.0