8da2dd6957
qubes_setup_dnat_to_ns script sets up DNAT rules for DNS traffic; it is triggered by dhclient or NetworkManager, and manually (in case there is a static resolv.conf). Put IP-dependent rules in qubes-core, after local ip is known. It could be further improved by introducing custom chains, to enable iptables save. Restrict FORWARD.
21 lines
490 B
Bash
Executable File
21 lines
490 B
Bash
Executable File
#!/bin/sh
|
|
addrule()
|
|
{
|
|
if [ $FIRSTONE = yes ] ; then
|
|
NS=$NS1
|
|
FIRSTONE=no
|
|
else
|
|
NS=$NS2
|
|
fi
|
|
iptables -A PREROUTING -t nat -d $NS -p udp --dport 53 -j DNAT \
|
|
--to "$1"
|
|
}
|
|
export PATH=$PATH:/sbin:/bin
|
|
source /var/run/qubes_ns
|
|
if [ "X"$NS1 = "X" ] ; then exit ; fi
|
|
iptables -t nat -F PREROUTING
|
|
FIRSTONE=yes
|
|
grep ^nameserver /etc/resolv.conf | head -2 | while read x y z ; do
|
|
addrule "$y"
|
|
done
|