uli/limitator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

--wait in all iptables calls

Browse Source
This commit is contained in:
Eneko Nieto
2021-07-09 11:33:59 +02:00
parent 7fcb2d09f6
commit 33eaaa5b28
1 changed files with 18 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
limitator
View File

@@ -52,7 +52,7 @@ get_iptables_quota_rule_num(){
} }
get_current_used_bytes(){ get_current_used_bytes(){
local used_bytes=$(iptables -vnxL $IPTABLES_CHAIN $(get_iptables_quota_rule_num) | awk '{print $2}') local used_bytes=$(iptables --wait -vnxL $IPTABLES_CHAIN $(get_iptables_quota_rule_num) | awk '{print $2}')
if [ -n "$used_bytes" ];then if [ -n "$used_bytes" ];then
echo -n $used_bytes echo -n $used_bytes
else else
@@ -100,45 +100,45 @@ get_json(){
} }
reset_quota(){ reset_quota(){
iptables -Z $IPTABLES_CHAIN $(get_iptables_quota_rule_num) iptables --wait -Z $IPTABLES_CHAIN $(get_iptables_quota_rule_num)
echo -n 0 > ${USED_BYTES_FILE} echo -n 0 > ${USED_BYTES_FILE}
} }
del_iptables_rule(){ del_iptables_rule(){
iptables -F $IPTABLES_CHAIN iptables --wait -F $IPTABLES_CHAIN
for chain_name in $IPTABLES_FORWARD $IPTABLES_INPUT $IPTABLES_OUTPUT for chain_name in $IPTABLES_FORWARD $IPTABLES_INPUT $IPTABLES_OUTPUT
do do
while true while true
do do
line=$(iptables -L $chain_name|sed -e '1,2d'|grep -n $IPTABLES_CHAIN|head -1|cut -d : -f 1 2>/dev/null) line=$(iptables --wait -L $chain_name|sed -e '1,2d'|grep -n $IPTABLES_CHAIN|head -1|cut -d : -f 1 2>/dev/null)
[ -n "$(echo $line|grep -E ^[[:digit:]]+$)" ] && iptables -D $chain_name $line || break [ -n "$(echo $line|grep -E ^[[:digit:]]+$)" ] && iptables --wait -D $chain_name $line || break
done done
done done
iptables -D $IPTABLES_FORWARD 1 iptables --wait -D $IPTABLES_FORWARD 1
iptables -X $IPTABLES_CHAIN iptables --wait -X $IPTABLES_CHAIN
} }
set_iptables_rule(){ set_iptables_rule(){
iptables -N $IPTABLES_CHAIN iptables --wait -N $IPTABLES_CHAIN
if [ -n "$EXCLUDE_NETWORK" ];then if [ -n "$EXCLUDE_NETWORK" ];then
iptables -I $IPTABLES_CHAIN 1 -s $EXCLUDE_NETWORK -j ACCEPT iptables --wait -I $IPTABLES_CHAIN 1 -s $EXCLUDE_NETWORK -j ACCEPT
iptables -I $IPTABLES_CHAIN 2 -d $EXCLUDE_NETWORK -j ACCEPT iptables --wait -I $IPTABLES_CHAIN 2 -d $EXCLUDE_NETWORK -j ACCEPT
fi fi
if [ -n "$EXCLUDE_NETWORK2" ];then if [ -n "$EXCLUDE_NETWORK2" ];then
iptables -I $IPTABLES_CHAIN 3 -s $EXCLUDE_NETWORK2 -j ACCEPT iptables --wait -I $IPTABLES_CHAIN 3 -s $EXCLUDE_NETWORK2 -j ACCEPT
iptables -I $IPTABLES_CHAIN 4 -d $EXCLUDE_NETWORK2 -j ACCEPT iptables --wait -I $IPTABLES_CHAIN 4 -d $EXCLUDE_NETWORK2 -j ACCEPT
fi fi
if [ -n "$EXCLUDE_NETWORK3" ];then if [ -n "$EXCLUDE_NETWORK3" ];then
iptables -I $IPTABLES_CHAIN 5 -s $EXCLUDE_NETWORK3 -j ACCEPT iptables --wait -I $IPTABLES_CHAIN 5 -s $EXCLUDE_NETWORK3 -j ACCEPT
iptables -I $IPTABLES_CHAIN 6 -d $EXCLUDE_NETWORK3 -j ACCEPT iptables --wait -I $IPTABLES_CHAIN 6 -d $EXCLUDE_NETWORK3 -j ACCEPT
fi fi
iptables --wait -I $IPTABLES_CHAIN $(get_iptables_quota_rule_num) -c 0 $(get_saved_used_bytes) -m quota --quota $(get_remaining_quota) -j ACCEPT 2>> $LOG_FILE iptables --wait -I $IPTABLES_CHAIN $(get_iptables_quota_rule_num) -c 0 $(get_saved_used_bytes) -m quota --quota $(get_remaining_quota) -j ACCEPT 2>> $LOG_FILE
iptables --wait -I $IPTABLES_CHAIN $(($(get_iptables_quota_rule_num) + 1)) -j REJECT 2>> $LOG_FILE iptables --wait -I $IPTABLES_CHAIN $(($(get_iptables_quota_rule_num) + 1)) -j REJECT 2>> $LOG_FILE
iptables -I $IPTABLES_FORWARD 1 -d $INTRANET -s $INTRANET -j ACCEPT iptables --wait -I $IPTABLES_FORWARD 1 -d $INTRANET -s $INTRANET -j ACCEPT
iptables -I $IPTABLES_FORWARD 2 -j $IPTABLES_CHAIN iptables --wait -I $IPTABLES_FORWARD 2 -j $IPTABLES_CHAIN
iptables -I $IPTABLES_INPUT -i $WAN_DEV ! -s $INTRANET -j $IPTABLES_CHAIN iptables --wait -I $IPTABLES_INPUT -i $WAN_DEV ! -s $INTRANET -j $IPTABLES_CHAIN
iptables -I $IPTABLES_OUTPUT -o $WAN_DEV ! -d $INTRANET -j $IPTABLES_CHAIN iptables --wait -I $IPTABLES_OUTPUT -o $WAN_DEV ! -d $INTRANET -j $IPTABLES_CHAIN
} }
start() { start() {