Gan, Jimmy
43 lines
1.5 KiB
Bash
43 lines
1.5 KiB
Bash
#!/bin/bash
|
|
|
|
# Tailscale Exit Node Setup Script
|
|
# Automates UFW and IP forwarding requirements
|
|
|
|
set -e
|
|
|
|
echo "Setting up Tailscale exit node requirements..."
|
|
|
|
# 1. Enable IP Forwarding in sysctl
|
|
if ! grep -q "^net.ipv4.ip_forward=1" /etc/sysctl.conf; then
|
|
echo "Enabling IPv4 forwarding in sysctl..."
|
|
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
|
|
echo "net.ipv6.conf.all.forwarding=1" | sudo tee -a /etc/sysctl.conf
|
|
sudo sysctl -p
|
|
else
|
|
echo "IPv4 forwarding already enabled."
|
|
fi
|
|
|
|
# 2. Update UFW default forward policy
|
|
UFW_DEFAULT="/etc/default/ufw"
|
|
if grep -q 'DEFAULT_FORWARD_POLICY="DROP"' "$UFW_DEFAULT"; then
|
|
echo "Updating UFW default forward policy to ACCEPT..."
|
|
sudo sed -i 's/DEFAULT_FORWARD_POLICY="DROP"/DEFAULT_FORWARD_POLICY="ACCEPT"/' "$UFW_DEFAULT"
|
|
sudo ufw reload
|
|
else
|
|
echo "UFW default forward policy is already ACCEPT."
|
|
fi
|
|
|
|
# 3. Add NAT MASQUERADE to UFW before.rules
|
|
UFW_BEFORE="/etc/ufw/before.rules"
|
|
if ! grep -q "POSTROUTING -s 100.64.0.0/10 -o ens3 -j MASQUERADE" "$UFW_BEFORE"; then
|
|
echo "Adding NAT MASQUERADE rule to $UFW_BEFORE..."
|
|
# This is a bit tricky to automate safely without ruining the file.
|
|
# We look for the *filter line and insert before it.
|
|
sudo sed -i '/\*filter/i # NAT rules\n*nat\n:POSTROUTING ACCEPT [0:0]\n-A POSTROUTING -s 100.64.0.0/10 -o ens3 -j MASQUERADE\nCOMMIT\n' "$UFW_BEFORE"
|
|
sudo ufw reload
|
|
else
|
|
echo "NAT MASQUERADE rule already exists in $UFW_BEFORE."
|
|
fi
|
|
|
|
echo "Tailscale exit node setup complete."
|