From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <mike@fly.osdn.org.ua>
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on sa.int.altlinux.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.7 required=5.0 tests=AWL,BAYES_00 autolearn=ham
	version=3.2.5
Date: Sun, 29 Mar 2009 00:07:27 +0200
From: Michael Shigorin <mike@osdn.org.ua>
To: sysadmins@lists.altlinux.org
Message-ID: <20090328220727.GA26250@osdn.org.ua>
Mail-Followup-To: sysadmins@lists.altlinux.org
References: <20090328164513.GV20208@osdn.org.ua>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="FL5UXtIhxfXey3p5"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20090328164513.GV20208@osdn.org.ua>
User-Agent: Mutt/1.4.2.1i
Subject: Re: [Sysadmins]
	=?koi8-r?b?08vSydDUycsgxMzRINDP0tTGz9LXwdLEwSDOwSDE?=
	=?koi8-r?b?z9PUydbJzdnKIElQIMnaIMHM2NTF0s7B1MnX?=
X-BeenThere: sysadmins@lists.altlinux.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: shigorin@gmail.com,
	ALT Linux sysadmin discuss <sysadmins@lists.altlinux.org>
List-Id: ALT Linux sysadmin discuss <sysadmins.lists.altlinux.org>
List-Unsubscribe: <https://lists.altlinux.org/mailman/options/sysadmins>,
	<mailto:sysadmins-request@lists.altlinux.org?subject=unsubscribe>
List-Archive: <http://lists.altlinux.org/pipermail/sysadmins>
List-Post: <mailto:sysadmins@lists.altlinux.org>
List-Help: <mailto:sysadmins-request@lists.altlinux.org?subject=help>
List-Subscribe: <https://lists.altlinux.org/mailman/listinfo/sysadmins>,
	<mailto:sysadmins-request@lists.altlinux.org?subject=subscribe>
X-List-Received-Date: Sat, 28 Mar 2009 22:07:43 -0000
Archived-At: <http://lore.altlinux.org/sysadmins/20090328220727.GA26250@osdn.org.ua/>
List-Archive: <http://lore.altlinux.org/sysadmins/>


--FL5UXtIhxfXey3p5
Content-Type: text/plain; charset=koi8-r
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

On Sat, Mar 28, 2009 at 06:45:13PM +0200, I bravely wrote:
> то был нарисован прицепленный скриптик, надеюсь, достаточно
> самодокументированный.  При необходимости его можно обобщить
> от двух альтернатив, но решил не усложнять без таковой.
> Также здесь:
> http://fly.osdn.org.ua/~mike/works/misc/notebook-portforward

Поправочка: как root cronjob оказался неэффективным:

++ iptables -L PREROUTING -t nat -n
/usr/local/sbin/notebook-portforward: line 43: iptables: command not found

Пришлось явно добавить /sbin в PATH, обновил.

-- 
 ---- WBR, Michael Shigorin <mike@altlinux.ru>
  ------ Linux.Kiev http://www.linux.kiev.ua/

--FL5UXtIhxfXey3p5
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=notebook-portforward

#!/bin/sh
# check which IP is reachable since the notebook can be
# connected via either Ethernet or WiFi, or both;
# adjust portforwarding (which must otherwise be
# already set up correctly -- like not forgetting
# -A INPUT -d $IP -p tcp -m tcp --dport $DPT -j ACCEPT
#
# try to ping an already existing portforward target;
# if unreachable or none, try to ping/add another one
#
# (c) 2009 Michael Shigorin <mike altlinux org>
# use, modify, distribute, cronjob this freely


PATH=/sbin:$PATH

IP=EX.TER.NAL.IP	# 123.45.67.8
IP_E=NOTE.BOOK.ETH.IP	# 192.168.1.2
IP_W=NOTE.BOOK.WIFI.IP	# 192.168.1.3
PORT=EXT_PORT		# 12345
DPT=DEST_PORT		# 22

COUNT=0
IFS=":"

ipt()
{
	iptables "$1" PREROUTING -t nat \
		-d "$IP" -p tcp -m tcp \
		--dport "$PORT" \
		-j DNAT --to-destination "$2:$DPT"
}

remove() { ipt -D "$1"; }
add() { ipt -A "$1"; }

try() { ping -w1 "$1" >&/dev/null; }

# is current one reachable?
COUNT="`iptables -L PREROUTING -t nat -n \
| fgrep "dpt:$port" \
| (
    while read header to dest rest; do
	try "$dest" && let COUNT=$COUNT+1 || remove "$dest"
    done; echo $COUNT
  )`"

# any job left?
[ "$COUNT" = 0 ] || exit

for ip in "$IP_W" "$IP_E"; do
	try "$ip" && let COUNT=$COUNT+1 && add "$ip" && break
done

# any job still left?
[ "$COUNT" = 0 ] || exit

# safety net: add via wifi if nothing else currently possible
add "$IP_W"

--FL5UXtIhxfXey3p5--