73 lines
2.3 KiB
Bash
Executable File
73 lines
2.3 KiB
Bash
Executable File
#!/bin/bash
|
|
# ==============================================================================
|
|
# 07-route-appvms.sh
|
|
#
|
|
# Configure IPv6 forwarding and ip6tables rules in sys-fips so AppVMs routed
|
|
# through sys-fips can reach FIPS fd00::/8 addresses via fips0.
|
|
#
|
|
# Usage:
|
|
# sudo bash 07-route-appvms.sh
|
|
# ==============================================================================
|
|
set -euo pipefail
|
|
|
|
echo "=== sys-fips AppVM Routing Configuration ==="
|
|
echo ""
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "✗ This script must be run as root (sudo)"
|
|
exit 1
|
|
fi
|
|
|
|
sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null
|
|
sysctl -w net.ipv6.conf.all.proxy_ndp=1 >/dev/null 2>&1 || true
|
|
sysctl -w net.ipv6.conf.all.disable_ipv6=0 >/dev/null 2>&1 || true
|
|
echo " IPv6 forwarding enabled"
|
|
|
|
if ! ip link show fips0 >/dev/null 2>&1; then
|
|
echo " WARNING: fips0 not found (start fips first)"
|
|
fi
|
|
|
|
ip -6 route replace fd00::/8 dev fips0 2>/dev/null || true
|
|
echo " route: fd00::/8 -> fips0"
|
|
|
|
# idempotent rule refresh
|
|
ip6tables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true
|
|
ip6tables -D FORWARD -d fd00::/8 -o fips0 -j ACCEPT 2>/dev/null || true
|
|
ip6tables -D FORWARD -s fd00::/8 -i fips0 -j ACCEPT 2>/dev/null || true
|
|
|
|
ip6tables -I FORWARD 1 -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
ip6tables -I FORWARD 2 -d fd00::/8 -o fips0 -j ACCEPT
|
|
ip6tables -I FORWARD 3 -s fd00::/8 -i fips0 -j ACCEPT
|
|
|
|
echo " ip6tables forwarding rules installed"
|
|
|
|
RCLOCAL="/rw/config/rc.local"
|
|
MARK_START="# === SYS-FIPS ROUTING START ==="
|
|
MARK_END="# === SYS-FIPS ROUTING END ==="
|
|
|
|
if [ -f "$RCLOCAL" ]; then
|
|
sed -i "/$MARK_START/,/$MARK_END/d" "$RCLOCAL"
|
|
fi
|
|
|
|
cat >> "$RCLOCAL" << 'EOF'
|
|
# === SYS-FIPS ROUTING START ===
|
|
sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null 2>&1
|
|
sysctl -w net.ipv6.conf.all.disable_ipv6=0 >/dev/null 2>&1
|
|
ip6tables -I FORWARD 1 -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null
|
|
ip6tables -I FORWARD 2 -d fd00::/8 -o fips0 -j ACCEPT 2>/dev/null
|
|
ip6tables -I FORWARD 3 -s fd00::/8 -i fips0 -j ACCEPT 2>/dev/null
|
|
# === SYS-FIPS ROUTING END ===
|
|
EOF
|
|
|
|
chmod +x "$RCLOCAL"
|
|
|
|
echo ""
|
|
echo "Current fd00 routes:"
|
|
ip -6 route show | grep fd00 || true
|
|
|
|
echo ""
|
|
echo "✓ AppVM routing configured"
|
|
echo ""
|
|
echo "In dom0, point an AppVM at sys-fips:"
|
|
echo " qvm-prefs <appvm-name> netvm sys-fips"
|