iptables.sh.tftpl

#!/bin/bash
set -x

sleep 60

echo -e "nat conf start"

# Enable ip forwarding
echo "1" > /proc/sys/net/ipv4/ip_forward

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
sysctl -p

# Flush existing iptables rules
iptables -t nat -F
iptables -F

# Looping over vnets
for vnet in ${FW_VNET_CIDRS}
do
   iptables -t nat -A POSTROUTING -s "$vnet" -o eth0 -j MASQUERADE
   iptables -A FORWARD -s "$vnet" -o eth0 -j ACCEPT
   iptables -A FORWARD -d "$vnet" -m state --state ESTABLISHED,RELATED -i eth0 -j ACCEPT
   iptables -A INPUT -s "$vnet" -j ACCEPT
done
iptables -A INPUT -m state --state INVALID -j DROP

echo -e "nat conf end"

echo -e "install iptables persistent"

iptables_path="/etc/iptables"
if [ ! -d "$iptables_path" ]; then
    mkdir -p "$iptables_path"
    echo "Directory created: $iptables_path"
else
    echo "Directory already exists: $iptables_path"
fi

/sbin/iptables-save > /etc/iptables/rules.v4

cat /etc/iptables/rules.v4

apt update
echo iptables-persistent iptables-persistent/autosave_v4 boolean true | debconf-set-selections
echo iptables-persistent iptables-persistent/autosave_v6 boolean true | debconf-set-selections
apt install -y iptables-persistent

echo "/sbin/iptables-restore < /etc/iptables/rules.v4" >> /etc/rc.local


iptables -L
iptables -L -t nat

echo -e "nat Config done"

# DNS
echo -e "DNS Config start"
apt install -y bind9

cat << 'EOF' > /etc/bind/named.conf.options
options {
        directory "/var/cache/bind";
        listen-on port 53 { any; };
        auth-nxdomain no;
        recursion yes;
        allow-query-cache { localhost; 127.0.0.1; ${DNS_VNET_CIDRS};};
        allow-recursion { localhost; 127.0.0.1; ${DNS_VNET_CIDRS};};
        allow-query { 127.0.0.1; ${DNS_VNET_CIDRS};};
        forwarders {
                ${DEFAULT_DNS};
                        };
        forward first;
        dnssec-validation ${DNSSEC_VALIDATION};
};
EOF

cat << 'EOF' > /etc/bind/named.conf.local
%{ for k,v in DNS_ZONES }
zone "${k}" IN {
        type forward;
        forward only;
        forwarders { ${v}; };
};
%{ endfor ~}
EOF

service bind9 restart
echo $(systemctl status bind9)

echo -e "DNS Config done"

echo -e "Done!"