Hermes/fnos-iptables-forward
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add virtual subnet forwarding rules

Browse Source
This commit is contained in:
chick
2026-06-02 23:10:58 +08:00
parent de87a8085b
commit e0d715a593
2 changed files with 39 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+20 -1
View File
@@ -6,6 +6,9 @@
- 开启 IPv4 转发：`/proc/sys/net/ipv4/ip_forward = 1`
- 允许 `192.168.2.0/24` 与 `192.168.3.0/24` 双向转发
- 允许 `192.168.2.0/24`、`192.168.3.0/24` 主动访问虚拟组网 `192.168.4.0/24`
- 允许 `192.168.4.0/24` 到 `192.168.2.0/24`、`192.168.3.0/24` 的 RELATED/ESTABLISHED 回包
- 禁止 `192.168.4.0/24` 主动访问 `192.168.2.0/24`、`192.168.3.0/24`，实现安全隔离
- 允许 `tun0` 入站/出站 FORWARD
- 开机延迟 `20s` 执行
@@ -25,7 +28,7 @@ curl -fsSL https://gitea.chickliu.fun/Hermes/fnos-iptables-forward/raw/branch/ma
## 自定义网段 / 网卡 / 延迟
```bash
sudo LAN_A=192.168.2.0/24 LAN_B=192.168.3.0/24 TUN_IF=tun0 DELAY=20s bash install.sh install
sudo LAN_A=192.168.2.0/24 LAN_B=192.168.3.0/24 VIRTUAL_LAN=192.168.4.0/24 TUN_IF=tun0 DELAY=20s bash install.sh install
```
## 查看状态
@@ -66,8 +69,24 @@ set -Eeuo pipefail
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -F FORWARD
iptables -P FORWARD ACCEPT
# 放行 192.168.3.0/24 <-> 192.168.2.0/24
iptables -A FORWARD -s 192.168.2.0/24 -d 192.168.3.0/24 -j ACCEPT
iptables -A FORWARD -s 192.168.3.0/24 -d 192.168.2.0/24 -j ACCEPT
# 放行 192.168.3.0/24、192.168.2.0/24 -> 192.168.4.0/24（虚拟组网）
iptables -A FORWARD -s 192.168.3.0/24 -d 192.168.4.0/24 -j ACCEPT
iptables -A FORWARD -s 192.168.2.0/24 -d 192.168.4.0/24 -j ACCEPT
# 放行 192.168.4.0/24 -> 192.168.3.0/24、192.168.2.0/24 的回包（必须）
iptables -A FORWARD -s 192.168.4.0/24 -d 192.168.3.0/24 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 192.168.4.0/24 -d 192.168.2.0/24 -m state --state RELATED,ESTABLISHED -j ACCEPT
# 禁止 192.168.4.0/24 主动访问 192.168.3.0/24、192.168.2.0/24（安全隔离）
iptables -A FORWARD -s 192.168.4.0/24 -d 192.168.3.0/24 -j DROP
iptables -A FORWARD -s 192.168.4.0/24 -d 192.168.2.0/24 -j DROP
# 放行 EasyTier 虚拟网卡 tun0
iptables -A FORWARD -i tun0 -j ACCEPT
iptables -A FORWARD -o tun0 -j ACCEPT
```
install.sh
+19 -1
View File
@@ -9,6 +9,7 @@ TIMER_FILE="${TIMER_FILE:-/etc/systemd/system/${SERVICE_NAME}.timer}"
DELAY="${DELAY:-20s}"
LAN_A="${LAN_A:-192.168.2.0/24}"
LAN_B="${LAN_B:-192.168.3.0/24}"
VIRTUAL_LAN="${VIRTUAL_LAN:-192.168.4.0/24}"
TUN_IF="${TUN_IF:-tun0}"
MODE="${1:-install}"
@@ -28,8 +29,24 @@ echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -F FORWARD
iptables -P FORWARD ACCEPT
# 放行 ${LAN_B} <-> ${LAN_A}
iptables -A FORWARD -s ${LAN_A} -d ${LAN_B} -j ACCEPT
iptables -A FORWARD -s ${LAN_B} -d ${LAN_A} -j ACCEPT
# 放行 ${LAN_B}/${LAN_A} -> ${VIRTUAL_LAN}（虚拟组网）
iptables -A FORWARD -s ${LAN_B} -d ${VIRTUAL_LAN} -j ACCEPT
iptables -A FORWARD -s ${LAN_A} -d ${VIRTUAL_LAN} -j ACCEPT
# 放行 ${VIRTUAL_LAN} -> ${LAN_B}/${LAN_A} 的回包（必须）
iptables -A FORWARD -s ${VIRTUAL_LAN} -d ${LAN_B} -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s ${VIRTUAL_LAN} -d ${LAN_A} -m state --state RELATED,ESTABLISHED -j ACCEPT
# 禁止 ${VIRTUAL_LAN} 主动访问 ${LAN_B}/${LAN_A}（安全隔离）
iptables -A FORWARD -s ${VIRTUAL_LAN} -d ${LAN_B} -j DROP
iptables -A FORWARD -s ${VIRTUAL_LAN} -d ${LAN_A} -j DROP
# 放行 EasyTier 虚拟网卡 ${TUN_IF}
iptables -A FORWARD -i ${TUN_IF} -j ACCEPT
iptables -A FORWARD -o ${TUN_IF} -j ACCEPT
EOF
@@ -113,6 +130,7 @@ Usage: sudo bash install.sh [install|status|uninstall]
Environment overrides:
LAN_A=$LAN_A
LAN_B=$LAN_B
VIRTUAL_LAN=$VIRTUAL_LAN
TUN_IF=$TUN_IF
DELAY=$DELAY
SERVICE_NAME=$SERVICE_NAME
@@ -120,7 +138,7 @@ Environment overrides:
Examples:
sudo bash install.sh install
sudo LAN_A=192.168.2.0/24 LAN_B=192.168.3.0/24 TUN_IF=tun0 bash install.sh install
sudo LAN_A=192.168.2.0/24 LAN_B=192.168.3.0/24 VIRTUAL_LAN=192.168.4.0/24 TUN_IF=tun0 bash install.sh install
sudo DELAY=30s bash install.sh install
sudo bash install.sh status
sudo bash install.sh uninstall