Skip to content

Commit 820d95d

Browse files
zhangzujianzhangzujian
committed
vpc-nat-gateway: use iptables-legacy for centos 7 (#4428)
Signed-off-by: zhangzujian <[email protected]>
1 parent b2b55a1 commit 820d95d

File tree

2 files changed

+38
-30
lines changed

2 files changed

+38
-30
lines changed

‎dist/images/vpcnatgateway/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ RUN set -ex \
66
&& apk add --no-cache \
77
bash \
88
iproute2 \
9-
iptables \
9+
iptables iptables-legacy \
1010
iputils \
1111
tcpdump \
1212
conntrack-tools

‎dist/images/vpcnatgateway/nat-gateway.sh‎

Lines changed: 37 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,13 @@
11
#!/usr/bin/env bash
22

3+
iptables_cmd=$(which iptables)
4+
iptables_save_cmd=$(which iptables-save)
5+
if iptables-legacy -t nat -S INPUT 1 2>/dev/null; then
6+
# use iptables-legacy for centos 7
7+
iptables_cmd=$(which iptables-legacy)
8+
iptables_save_cmd=$(which iptables-legacy-save)
9+
fi
10+
311
function exec_cmd() {
412
cmd=${@:1:${#}}
513
$cmd
@@ -11,7 +19,7 @@ function exec_cmd() {
1119
}
1220

1321
function check_inited() {
14-
iptables-save -t nat | grep SNAT_FILTER | grep SHARED_SNAT
22+
$iptables_save_cmd -t nat | grep SNAT_FILTER | grep SHARED_SNAT
1523
if [ $? -ne 0 ]; then
1624
>&2 echo "nat gateway not initialized"
1725
exit 1
@@ -20,27 +28,27 @@ function check_inited() {
2028

2129
function init() {
2230
# run once is enough
23-
iptables-save | grep DNAT_FILTER && exit 0
31+
$iptables_save_cmd | grep DNAT_FILTER && exit 0
2432
# add static chain
2533
# this also a flag to make sure init once
26-
iptables -t nat -N DNAT_FILTER
34+
$iptables_cmd -t nat -N DNAT_FILTER
2735
ip link set net1 up
2836
ip link set dev net1 arp off
2937

3038
# add static chain
31-
iptables -t nat -N SNAT_FILTER
32-
iptables -t nat -N EXCLUSIVE_DNAT # floatingIp DNAT
33-
iptables -t nat -N EXCLUSIVE_SNAT # floatingIp SNAT
34-
iptables -t nat -N SHARED_DNAT
35-
iptables -t nat -N SHARED_SNAT
39+
$iptables_cmd -t nat -N SNAT_FILTER
40+
$iptables_cmd -t nat -N EXCLUSIVE_DNAT # floatingIp DNAT
41+
$iptables_cmd -t nat -N EXCLUSIVE_SNAT # floatingIp SNAT
42+
$iptables_cmd -t nat -N SHARED_DNAT
43+
$iptables_cmd -t nat -N SHARED_SNAT
3644

37-
iptables -t nat -A PREROUTING -j DNAT_FILTER
38-
iptables -t nat -A DNAT_FILTER -j EXCLUSIVE_DNAT
39-
iptables -t nat -A DNAT_FILTER -j SHARED_DNAT
45+
$iptables_cmd -t nat -A PREROUTING -j DNAT_FILTER
46+
$iptables_cmd -t nat -A DNAT_FILTER -j EXCLUSIVE_DNAT
47+
$iptables_cmd -t nat -A DNAT_FILTER -j SHARED_DNAT
4048

41-
iptables -t nat -A POSTROUTING -j SNAT_FILTER
42-
iptables -t nat -A SNAT_FILTER -j EXCLUSIVE_SNAT
43-
iptables -t nat -A SNAT_FILTER -j SHARED_SNAT
49+
$iptables_cmd -t nat -A POSTROUTING -j SNAT_FILTER
50+
$iptables_cmd -t nat -A SNAT_FILTER -j EXCLUSIVE_SNAT
51+
$iptables_cmd -t nat -A SNAT_FILTER -j SHARED_SNAT
4452

4553
for rule in $@
4654
do
@@ -54,7 +62,7 @@ function init() {
5462

5563

5664
function get_iptables_version() {
57-
exec_cmd "iptables --version"
65+
exec_cmd "$iptables_cmd --version"
5866
}
5967

6068
function add_vpc_internal_route() {
@@ -162,9 +170,9 @@ function add_floating_ip() {
162170
eip=(${arr[0]//\// })
163171
internalIp=${arr[1]}
164172
# check if already exist
165-
iptables-save | grep "EXCLUSIVE_DNAT" | grep -w "\-d $eip/32" | grep "destination" && exit 0
166-
exec_cmd "iptables -t nat -A EXCLUSIVE_DNAT -d $eip -j DNAT --to-destination $internalIp"
167-
exec_cmd "iptables -t nat -A EXCLUSIVE_SNAT -s $internalIp -j SNAT --to-source $eip"
173+
$iptables_save_cmd | grep EXCLUSIVE_DNAT | grep -w "\-d $eip/32" | grep destination && exit 0
174+
exec_cmd "$iptables_cmd -t nat -A EXCLUSIVE_DNAT -d $eip -j DNAT --to-destination $internalIp"
175+
exec_cmd "$iptables_cmd -t nat -A EXCLUSIVE_SNAT -s $internalIp -j SNAT --to-source $eip"
168176
done
169177
}
170178

@@ -177,10 +185,10 @@ function del_floating_ip() {
177185
eip=(${arr[0]//\// })
178186
internalIp=${arr[1]}
179187
# check if already exist
180-
iptables-save | grep "EXCLUSIVE_DNAT" | grep -w "\-d $eip/32" | grep "destination"
188+
$iptables_save_cmd | grep EXCLUSIVE_DNAT | grep -w "\-d $eip/32" | grep destination
181189
if [ "$?" -eq 0 ];then
182-
exec_cmd "iptables -t nat -D EXCLUSIVE_DNAT -d $eip -j DNAT --to-destination $internalIp"
183-
exec_cmd "iptables -t nat -D EXCLUSIVE_SNAT -s $internalIp -j SNAT --to-source $eip"
190+
exec_cmd "$iptables_cmd -t nat -D EXCLUSIVE_DNAT -d $eip -j DNAT --to-destination $internalIp"
191+
exec_cmd "$iptables_cmd -t nat -D EXCLUSIVE_SNAT -s $internalIp -j SNAT --to-source $eip"
184192
conntrack -D -d $eip 2>/dev/nul || true
185193
fi
186194
done
@@ -197,8 +205,8 @@ function add_snat() {
197205
internalCIDR=${arr[1]}
198206
randomFullyOption=${arr[2]}
199207
# check if already exist
200-
iptables-save | grep "SHARED_SNAT" | grep "\-s $internalCIDR" | grep "source $eip" && exit 0
201-
exec_cmd "iptables -t nat -A SHARED_SNAT -o net1 -s $internalCIDR -j SNAT --to-source $eip $randomFullyOption"
208+
$iptables_save_cmd | grep SHARED_SNAT | grep "\-s $internalCIDR" | grep "source $eip" && exit 0
209+
exec_cmd "$iptables_cmd -t nat -A SHARED_SNAT -o net1 -s $internalCIDR -j SNAT --to-source $eip $randomFullyOption"
202210
done
203211
}
204212
function del_snat() {
@@ -211,10 +219,10 @@ function del_snat() {
211219
eip=(${arr[0]//\// })
212220
internalCIDR=${arr[1]}
213221
# check if already exist
214-
ruleMatch=$(iptables-save | grep "SHARED_SNAT" | grep "\-s $internalCIDR" | grep "source $eip")
222+
ruleMatch=$($iptables_save_cmd | grep SHARED_SNAT | grep "\-s $internalCIDR" | grep "source $eip")
215223
if [ "$?" -eq 0 ];then
216224
ruleMatch=$(echo $ruleMatch | sed 's/-A //')
217-
exec_cmd "iptables -t nat -D $ruleMatch"
225+
exec_cmd "$iptables_cmd -t nat -D $ruleMatch"
218226
fi
219227
done
220228
}
@@ -232,8 +240,8 @@ function add_dnat() {
232240
internalIp=${arr[3]}
233241
internalPort=${arr[4]}
234242
# check if already exist
235-
iptables-save | grep "SHARED_DNAT" | grep -w "\-d $eip/32" | grep "p $protocol" | grep -w "dport $dport"| grep -w "destination $internalIp:$internalPort" && exit 0
236-
exec_cmd "iptables -t nat -A SHARED_DNAT -p $protocol -d $eip --dport $dport -j DNAT --to-destination $internalIp:$internalPort"
243+
$iptables_save_cmd | grep SHARED_DNAT | grep -w "\-d $eip/32" | grep "p $protocol" | grep -w "dport $dport"| grep -w "destination $internalIp:$internalPort" && exit 0
244+
exec_cmd "$iptables_cmd -t nat -A SHARED_DNAT -p $protocol -d $eip --dport $dport -j DNAT --to-destination $internalIp:$internalPort"
237245
done
238246
}
239247

@@ -250,9 +258,9 @@ function del_dnat() {
250258
internalIp=${arr[3]}
251259
internalPort=${arr[4]}
252260
# check if already exist
253-
iptables-save | grep "SHARED_DNAT" | grep -w "\-d $eip/32" | grep "p $protocol" | grep -w "dport $dport"| grep -w "destination $internalIp:$internalPort"
261+
$iptables_save_cmd | grep SHARED_DNAT | grep -w "\-d $eip/32" | grep "p $protocol" | grep -w "dport $dport"| grep -w "destination $internalIp:$internalPort"
254262
if [ "$?" -eq 0 ];then
255-
exec_cmd "iptables -t nat -D SHARED_DNAT -p $protocol -d $eip --dport $dport -j DNAT --to-destination $internalIp:$internalPort"
263+
exec_cmd "$iptables_cmd -t nat -D SHARED_DNAT -p $protocol -d $eip --dport $dport -j DNAT --to-destination $internalIp:$internalPort"
256264
fi
257265
done
258266
}

0 commit comments

Comments
 (0)