994dee8891
Alle uebrigen Skripte in scripts/ sind 755; die neuen lagen als 644 im Index, obwohl sie Shebangs tragen. Aendert den Store-Pfad von update-mango-dns.sh, daher wird pinix neu aktiviert. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Aw4viUJyXGP8ANocHiF15q
62 lines
2.4 KiB
Bash
Executable file
62 lines
2.4 KiB
Bash
Executable file
#!/bin/sh
|
|
# Auf Mango nach configure-mango-ipv6-web.sh ausfuehren:
|
|
# ssh root@192.168.8.1 'sh -s' < scripts/configure-mango-ipv6-ssh.sh
|
|
# Stabile SLAAC-Ziele, ohne statische NixOS-Adresse (RA bleibt aktiv).
|
|
# Nur Host-SSH; keine Freigabe der Routerverwaltung.
|
|
# HOSTS=tnix aktualisiert nur tnix; Standard bleibt pinix und tnix.
|
|
set -eu
|
|
[ "$(uci -q get firewall.wan6.name)" = wan6 ]
|
|
[ -z "$(uci changes firewall)" ] || {
|
|
echo 'Unsaved firewall changes; refusing to overwrite.' >&2
|
|
exit 1
|
|
}
|
|
backup_dir=$(mktemp -d /root/ipv6-ssh-firewall-backup.XXXXXX)
|
|
cp /etc/config/firewall "$backup_dir/firewall"
|
|
echo "Firewall backup: $backup_dir/firewall"
|
|
trap 'uci revert firewall' EXIT
|
|
for host in ${HOSTS:-pinix tnix}; do
|
|
case "$host" in
|
|
pinix) port=2222; target=fdee:3c40:44f0:0:dea6:32ff:fe48:c6c8 ;;
|
|
tnix) port=2223; target=fdee:3c40:44f0:0:ca5b:76ff:fe96:e24 ;;
|
|
*) echo "Unknown host: $host" >&2; exit 1 ;;
|
|
esac
|
|
rule="firewall.${host}_ssh"
|
|
uci -q delete "$rule" || true
|
|
uci set "$rule=redirect"
|
|
uci set "$rule.name=IPv6 SSH $host"
|
|
uci set "$rule.family=ipv6"
|
|
uci set "$rule.src=wan6"
|
|
uci set "$rule.src_dport=$port"
|
|
uci set "$rule.dest=lan"
|
|
uci set "$rule.dest_ip=$target"
|
|
uci set "$rule.dest_port=22"
|
|
uci set "$rule.proto=tcp"
|
|
uci set "$rule.target=DNAT"
|
|
uci set "$rule.reflection=0"
|
|
if [ "$host" = tnix ]; then
|
|
# tnix behaelt den iPhone-Hotspot als Default-Route. Oeffentliche
|
|
# SSH-Clients erscheinen daher als Mango-LAN-Adresse, damit Antworten
|
|
# ueber Ethernet zum Mango zurueckgehen. Nur TCP 22 zu diesem Host.
|
|
uci -q delete firewall.tnix_ssh_return || true
|
|
uci set firewall.tnix_ssh_return=nat
|
|
uci set firewall.tnix_ssh_return.name='IPv6 SSH tnix return via Mango'
|
|
uci set firewall.tnix_ssh_return.family=ipv6
|
|
uci set firewall.tnix_ssh_return.src=lan
|
|
uci set firewall.tnix_ssh_return.src_ip='2000::/3'
|
|
uci set firewall.tnix_ssh_return.dest_ip="$target"
|
|
uci set firewall.tnix_ssh_return.dest_port=22
|
|
uci set firewall.tnix_ssh_return.proto=tcp
|
|
uci set firewall.tnix_ssh_return.target=SNAT
|
|
uci set firewall.tnix_ssh_return.snat_ip='fdee:3c40:44f0::1'
|
|
fi
|
|
done
|
|
fw4 check
|
|
uci commit firewall
|
|
trap - EXIT
|
|
if ! /etc/init.d/firewall reload; then
|
|
cp "$backup_dir/firewall" /etc/config/firewall
|
|
/etc/init.d/firewall reload
|
|
echo 'Firewall reload failed; restored backup.' >&2
|
|
exit 1
|
|
fi
|
|
echo 'Persistent IPv6 SSH forwarding installed.'
|