103 lines
3.8 KiB
Bash
103 lines
3.8 KiB
Bash
#!/bin/bash
|
|
# THIS FILE IS ADDED FOR COMPATIBILITY PURPOSES
|
|
#
|
|
# It is highly advisable to create own systemd services or udev rules
|
|
# to run scripts during boot instead of using this file.
|
|
#
|
|
# In contrast to previous versions due to parallel execution during boot
|
|
# this script will NOT be run after all other services.
|
|
#
|
|
# Please note that you must run 'chmod +x /etc/rc.d/rc.local' to ensure
|
|
# that this script will be executed during boot.
|
|
iptables -F
|
|
iptables -X
|
|
iptables -t nat -F
|
|
iptables -t nat -X
|
|
iptables -P INPUT DROP
|
|
iptables -P FORWARD ACCEPT
|
|
iptables -P OUTPUT ACCEPT
|
|
|
|
iptables -A INPUT -i enp0s6 -p udp --dport 32101 -j ACCEPT
|
|
iptables -A INPUT -i enp0s6 -p udp --dport 32110 -j ACCEPT
|
|
iptables -A INPUT -i enp0s6 -p udp --dport 32100 -j ACCEPT
|
|
iptables -A INPUT -i enp0s6 -p udp --dport 32400 -j ACCEPT
|
|
iptables -A INPUT -i enp0s6 -p tcp --dport 8117 -j ACCEPT
|
|
iptables -A INPUT -i enp0s6 -p tcp --dport 80 -j ACCEPT
|
|
iptables -A INPUT -i enp0s6 -p tcp --dport 443 -j ACCEPT
|
|
iptables -A INPUT -i enp0s6 -j ACCEPT -m state --state ESTABLISHED,RELATED
|
|
iptables -A INPUT -i wg0 -j ACCEPT
|
|
|
|
# Permitir SIP (UDP/TCP 5060/5061), IAX2 (UDP 4569), RTP (UDP 18000:19000) para FreePBX
|
|
iptables -A INPUT -i enp0s6 -p udp --dport 5060 -j ACCEPT
|
|
iptables -A INPUT -i enp0s6 -p tcp --dport 5060 -j ACCEPT
|
|
iptables -A INPUT -i enp0s6 -p udp --dport 5061 -j ACCEPT
|
|
iptables -A INPUT -i enp0s6 -p tcp --dport 5061 -j ACCEPT
|
|
iptables -A INPUT -i enp0s6 -p udp --dport 5160 -j ACCEPT
|
|
iptables -A INPUT -i enp0s6 -p tcp --dport 5161 -j ACCEPT
|
|
iptables -A INPUT -i enp0s6 -p udp --dport 4569 -j ACCEPT
|
|
iptables -A INPUT -i enp0s6 -p udp --dport 18000:19000 -j ACCEPT
|
|
|
|
# Permitir tráfego de retorno (deve estar antes do DROP final)
|
|
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
iptables -t nat -A POSTROUTING -s 10.15.0.0/16 -j MASQUERADE
|
|
ip6tables -t nat -A POSTROUTING -s 2001:db8:15::/48 -j MASQUERADE
|
|
iptables -t nat -A POSTROUTING -s 172.17.0.0/16 -j MASQUERADE
|
|
|
|
|
|
# Habilitar redirecionamento de pacotes no kernel
|
|
echo 1 > /proc/sys/net/ipv4/ip_forward
|
|
# 1. DNAT APENAS para tráfego entrando na interface enp0s6 (WAN) com destino ao IP público
|
|
iptables -t nat -A PREROUTING -i enp0s6 -p tcp --dport 80 -j DNAT --to-destination 10.15.0.45:80
|
|
iptables -t nat -A PREROUTING -i enp0s6 -p tcp --dport 443 -j DNAT --to-destination 10.15.0.45:443
|
|
|
|
# 2. SNAT (Hairpinning) para clientes locais acessarem via IP público
|
|
iptables -t nat -A POSTROUTING -o enp0s6 -p tcp -d 10.15.0.45 --dport 80 -j MASQUERADE
|
|
iptables -t nat -A POSTROUTING -o enp0s6 -p tcp -d 10.15.0.45 --dport 443 -j MASQUERADE
|
|
|
|
|
|
|
|
# Permitir o tráfego na cadeia FORWARD
|
|
iptables -A FORWARD -p tcp -d 10.15.0.45 --dport 80 -j ACCEPT
|
|
iptables -A FORWARD -p tcp -d 10.15.0.45 --dport 443 -j ACCEPT
|
|
|
|
sh /root/test.sh
|
|
|
|
|
|
echo deadline > /sys/block/sda/queue/scheduler
|
|
|
|
touch /var/lock/subsys/local
|
|
#echo "bfq" > /sys/block/sda/queue/scheduler
|
|
#echo "1500" > /sys/block/sda/queue/iosched/read_expire
|
|
echo 64 > /sys/block/sda/queue/max_sectors_kb # Melhor para SSD virtual
|
|
echo deadline > /sys/block/sda/queue/scheduler # Alternativa ao BFQ
|
|
echo 0 > /proc/sys/vm/zone_reclaim_mode
|
|
|
|
tc qdisc add dev enp0s6 root cake bandwidth 1000mbit besteffort
|
|
tc qdisc add dev wg0 root cake bandwidth 500mbit besteffort dual-dsthost
|
|
|
|
echo f > /sys/class/net/enp0s6/queues/tx-0/xps_cpus
|
|
|
|
|
|
echo f > /sys/class/net/enp0s6/queues/rx-0/rps_cpus
|
|
|
|
# XPS para núcleos 4-7 (máscara 0xf0)
|
|
|
|
# Aumentar buffer de entrada/saída fixo
|
|
echo 4096 > /sys/class/net/enp0s6/queues/rx-0/rps_flow_cnt
|
|
echo 4096 > /proc/sys/net/core/rps_sock_flow_entries
|
|
|
|
sh /root/qos.sh
|
|
|
|
#cd /root/xdp_new && \
|
|
cd /home/rodrigo/xdp && \
|
|
ip link set enp0s6 mtu 1500
|
|
ip link set dev enp0s6 xdp obj xdp_ddos_filter.o sec xdp
|
|
|
|
sleep 20
|
|
|
|
ip link set dev br-02f7820020b4 xdp obj bridge_xdp.o sec xdp
|
|
|
|
ip link delete br-8b341d0f5c20
|
|
iptables -t nat -A POSTROUTING -o wg3 -j MASQUERADE
|