first commit

2026-09-13 20:49:33 -03:00
commit 01d7cb1a80
@@ -0,0 +1,102 @@
+#!/bin/bash
+# THIS FILE IS ADDED FOR COMPATIBILITY PURPOSES
+#
+# It is highly advisable to create own systemd services or udev rules
+# to run scripts during boot instead of using this file.
+#
+# In contrast to previous versions due to parallel execution during boot
+# this script will NOT be run after all other services.
+#
+# Please note that you must run 'chmod +x /etc/rc.d/rc.local' to ensure
+# that this script will be executed during boot.
+iptables -F
+iptables -X
+iptables -t nat -F
+iptables -t nat -X
+iptables -P INPUT DROP
+iptables -P FORWARD ACCEPT
+iptables -P OUTPUT ACCEPT
+
+iptables -A INPUT -i enp0s6 -p udp --dport 32101 -j ACCEPT
+iptables -A INPUT -i enp0s6 -p udp --dport 32110 -j ACCEPT
+iptables -A INPUT -i enp0s6 -p udp --dport 32100 -j ACCEPT
+iptables -A INPUT -i enp0s6 -p udp --dport 32400 -j ACCEPT
+iptables -A INPUT -i enp0s6 -p tcp --dport 8117 -j ACCEPT
+iptables -A INPUT -i enp0s6 -p tcp --dport 80 -j ACCEPT
+iptables -A INPUT -i enp0s6 -p tcp --dport 443 -j ACCEPT
+iptables -A INPUT -i enp0s6 -j ACCEPT -m state --state ESTABLISHED,RELATED
+iptables -A INPUT -i wg0 -j ACCEPT
+
+# Permitir SIP (UDP/TCP 5060/5061), IAX2 (UDP 4569), RTP (UDP 18000:19000) para FreePBX
+iptables -A INPUT -i enp0s6 -p udp --dport 5060 -j ACCEPT
+iptables -A INPUT -i enp0s6 -p tcp --dport 5060 -j ACCEPT
+iptables -A INPUT -i enp0s6 -p udp --dport 5061 -j ACCEPT
+iptables -A INPUT -i enp0s6 -p tcp --dport 5061 -j ACCEPT
+iptables -A INPUT -i enp0s6 -p udp --dport 5160 -j ACCEPT
+iptables -A INPUT -i enp0s6 -p tcp --dport 5161 -j ACCEPT
+iptables -A INPUT -i enp0s6 -p udp --dport 4569 -j ACCEPT
+iptables -A INPUT -i enp0s6 -p udp --dport 18000:19000 -j ACCEPT
+
+# Permitir tráfego de retorno (deve estar antes do DROP final)
+iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+iptables -t nat -A POSTROUTING -s 10.15.0.0/16 -j MASQUERADE
+ip6tables -t nat -A POSTROUTING -s 2001:db8:15::/48 -j MASQUERADE
+iptables -t nat -A POSTROUTING -s 172.17.0.0/16 -j MASQUERADE
+
+
+# Habilitar redirecionamento de pacotes no kernel
+echo 1 > /proc/sys/net/ipv4/ip_forward
+# 1. DNAT APENAS para tráfego entrando na interface enp0s6 (WAN) com destino ao IP público
+iptables -t nat -A PREROUTING -i enp0s6 -p tcp --dport 80 -j DNAT --to-destination 10.15.0.45:80
+iptables -t nat -A PREROUTING -i enp0s6 -p tcp --dport 443 -j DNAT --to-destination 10.15.0.45:443
+
+# 2. SNAT (Hairpinning) para clientes locais acessarem via IP público
+iptables -t nat -A POSTROUTING -o enp0s6 -p tcp -d 10.15.0.45 --dport 80 -j MASQUERADE
+iptables -t nat -A POSTROUTING -o enp0s6 -p tcp -d 10.15.0.45 --dport 443 -j MASQUERADE
+
+
+
+# Permitir o tráfego na cadeia FORWARD
+iptables -A FORWARD -p tcp -d 10.15.0.45 --dport 80 -j ACCEPT
+iptables -A FORWARD -p tcp -d 10.15.0.45 --dport 443 -j ACCEPT
+
+sh /root/test.sh
+
+
+echo deadline > /sys/block/sda/queue/scheduler
+
+touch /var/lock/subsys/local
+#echo "bfq" > /sys/block/sda/queue/scheduler
+#echo "1500" > /sys/block/sda/queue/iosched/read_expire
+echo 64 > /sys/block/sda/queue/max_sectors_kb # Melhor para SSD virtual
+echo deadline > /sys/block/sda/queue/scheduler # Alternativa ao BFQ
+echo 0 > /proc/sys/vm/zone_reclaim_mode
+
+tc qdisc add dev enp0s6 root cake bandwidth 1000mbit besteffort
+tc qdisc add dev wg0 root cake bandwidth 500mbit besteffort dual-dsthost
+
+echo f > /sys/class/net/enp0s6/queues/tx-0/xps_cpus
+
+
+echo f > /sys/class/net/enp0s6/queues/rx-0/rps_cpus
+
+# XPS para núcleos 4-7 (máscara 0xf0)
+
+# Aumentar buffer de entrada/saída fixo
+echo 4096 > /sys/class/net/enp0s6/queues/rx-0/rps_flow_cnt
+echo 4096 > /proc/sys/net/core/rps_sock_flow_entries
+
+sh /root/qos.sh
+
+#cd /root/xdp_new && \
+cd /home/rodrigo/xdp && \
+ip link set enp0s6 mtu 1500
+ip link set dev enp0s6 xdp obj xdp_ddos_filter.o sec xdp
+
+sleep 20
+
+ip link set dev br-02f7820020b4 xdp obj bridge_xdp.o sec xdp
+
+ip link delete br-8b341d0f5c20
+iptables -t nat -A POSTROUTING -o wg3 -j MASQUERADE