#!/bin/bash
_script_type=$script_type
_common_name=$common_name
_dev=$dev
_remote_ip=$ifconfig_pool_remote_ip
_local_ip=$ifconfig_local
_timestamp=$time_unix
_time=$time_ascii
_username=$username
_username=$(echo $_username | tr [:upper:] [:lower:])
_out_dev=br0
_lan_ip="192.168.20.0/22"
VPN_CHAIN="OPENVPN"
DEBUG=0
function log(){
echo "$_time [CONNECT_SCRIPT] $*"
}
function debug(){
if [ "${DEBUG}" == "1" ]; then
log "debug $*"
fi
}
function in_users(){
local user=$1
local in_arr=1
local i
for i in ${Users[@]}; do
if [ "$i" = "${user}" ]; then
in_arr=0
break
fi
done
return ${in_arr}
}
function in_admins(){
local user=$1
local in_arr=1
local i
for i in ${Admins[@]}; do
if [ "$i" = "${user}" ]; then
in_arr=0
break
fi
done
return ${in_arr}
}
function check_chain(){
[ -z "$1" ] && return 1
iptables -L $1 >/dev/null 2>&1
return $?
}
function add_user_rules(){
debug "iptables -N ${_username}"
iptables -N ${_username}
debug "iptables -A ${_username} -i ${_out_dev} -o ${_dev} -m state --state ESTABLISHED,RELATED -j ACCEPT"
iptables -A ${_username} -i ${_out_dev} -o ${_dev} -m state --state ESTABLISHED,RELATED -j ACCEPT
debug "iptables -A ${_username} -i ${_dev} -o ${_out_dev} -p tcp -s ${_remote_ip} -d ${_lan_ip} --dport 3389 -j ACCEPT"
iptables -A ${_username} -i ${_dev} -o ${_out_dev} -p tcp -s ${_remote_ip} -d ${_lan_ip} --dport 3389 -j ACCEPT
debug "iptables -A ${VPN_CHAIN} -i ${_dev} -s ${_remote_ip} -j ${_username}"
iptables -A ${VPN_CHAIN} -i ${_dev} -s ${_remote_ip} -j ${_username}
debug "iptables -A ${VPN_CHAIN} -o ${_dev} -d ${_remote_ip} -j ${_username}"
iptables -A ${VPN_CHAIN} -o ${_dev} -d ${_remote_ip} -j ${_username}
}
function add_admin_rules(){
debug "iptables -N ${_username}"
iptables -N ${_username}
debu "iptables -A ${_username} -i ${_out_dev} -o ${_dev} -m state --state ESTABLISHED,RELATED -j ACCEPT"
iptables -A ${_username} -i ${_out_dev} -o ${_dev} -m state --state ESTABLISHED,RELATED -j ACCEPT
debug "iptables -A ${_username} -i ${_dev} -o ${_out_dev} -s ${_remote_ip} -d ${_lan_ip} -j ACCEPT"
iptables -A ${_username} -i ${_dev} -o ${_out_dev} -s ${_remote_ip} -d ${_lan_ip} -j ACCEPT
debug "iptables -A ${VPN_CHAIN} -i ${_dev} -s ${_remote_ip} -j ${_username}"
iptables -A ${VPN_CHAIN} -i ${_dev} -s ${_remote_ip} -j ${_username}
debug "iptables -A ${VPN_CHAIN} -o ${_dev} -d ${_remote_ip} -j ${_username}"
iptables -A ${VPN_CHAIN} -o ${_dev} -d ${_remote_ip} -j ${_username}
}
function add_user_test1(){
debug "iptables -N ${_username}"
iptables -N ${_username}
debug "iptables -A ${_username} -i ${_out_dev} -o ${_dev} -d ${_remote_ip} -m state --state ESTABLISHED,RELATED -j ACCEPT"
iptables -A ${_username} -i ${_out_dev} -o ${_dev} -d ${_remote_ip} -m state --state ESTABLISHED,RELATED -j ACCEPT
debug "iptables -A ${_username} -i ${_dev} -o ${_out_dev} -p tcp -s ${_remote_ip} -d 192.168.20.20 --dport 3389 -j ACCEPT"
iptables -A ${_username} -i ${_dev} -o ${_out_dev} -p tcp -s ${_remote_ip} -d 192.168.20.20 --dport 3389 -j ACCEPT
debug "iptables -A ${_username} -i ${_dev} -o ${_out_dev} -p tcp -s ${_remote_ip} -d 192.168.20.18 --dport 3389 -j ACCEPT"
iptables -A ${_username} -i ${_dev} -o ${_out_dev} -p tcp -s ${_remote_ip} -d 192.168.20.18 --dport 3389 -j ACCEPT
debug "iptables -A ${VPN_CHAIN} -i ${_dev} -s ${_remote_ip} -j ${_username}"
iptables -A ${VPN_CHAIN} -i ${_dev} -s ${_remote_ip} -j ${_username}
debug "iptables -A ${VPN_CHAIN} -o ${_dev} -d ${_remote_ip} -j ${_username}"
iptables -A ${VPN_CHAIN} -o ${_dev} -d ${_remote_ip} -j ${_username}
}
function add_user_test2(){
iptables -N ${_username}
iptables -A ${_username} -i ${_out_dev} -o ${_dev} -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A ${_username} -i ${_dev} -o ${_out_dev} -s ${_remote_ip} -d ${_lan_ip} -j ACCEPT
iptables -A ${VPN_CHAIN} -i ${_dev} -s ${_remote_ip} -j ${_username}
iptables -A ${VPN_CHAIN} -o ${_dev} -d ${_remote_ip} -j ${_username}
}
function del_rules(){
debug "iptables -D ${VPN_CHAIN} -i ${_dev} -s ${_remote_ip} -j ${_username}"
iptables -D ${VPN_CHAIN} -i ${_dev} -s ${_remote_ip} -j ${_username}
debug "iptables -D ${VPN_CHAIN} -o ${_dev} -d ${_remote_ip} -j ${_username}"
iptables -D ${VPN_CHAIN} -o ${_dev} -d ${_remote_ip} -j ${_username}
debug "iptables -F ${_username}"
iptables -F ${_username}
debug "iptables -X ${_username}"
iptables -X ${_username}
}
# Ограниченные пользователи
Users=(
test1
)
# Администраторы
Admins=(
test2
)
debug $_username
debug $_remote_ip
debug $_dev
debug $VPN_CHAIN
case $_script_type in
client-connect)
log "Connect user=$_username with remote vpn ip=$_remote_ip"
if check_chain ${_username}; then
log "Rules for user ${_username} exists. Delete it before create"
del_rules
fi
if in_admins ${_username}; then
log "Add admins rules for user $_username"
add_admin_rules
elif in_users ${_username}; then
log "Add user $_username rules for user $_username"
eval add_user_${_username}
else
log "Add users rules for user $_username"
add_user_rules
fi
;;
client-disconnect)
log "Disconnect user=$_username with remote vpn ip=$_remote_ip"
del_rules
;;
*)
log "Unknow parameters"
;;
esac
Вариант для распечатки
(ok) on 11-Июл-13, 12:02 
