1
127.0.0.1       localhost
2
211.154.[CENSORED] localhost
3
::1             localhost ip6-localhost ip6-loopback
4
ff02::1         ip6-allnodes
5
ff02::2         ip6-allrouters

1
192.168.128.250:3260,1 iqn.2024-12.com.ceph:iscsi
2
192.168.128.252:3260,2 iqn.2024-12.com.ceph:iscsi

1
# /etc/iscsi/nodes/iqn.2024-12.com.ceph:iscsi/192.168.128.250,3260,1/default
2
# BEGIN RECORD 2.1.5
3
node.name = iqn.2024-12.com.ceph:iscsi
4
... # Some unimportant configurations omitted
5
node.session.auth.authmethod = CHAP
6
node.session.auth.username = [CENSORED]
7
node.session.auth.password = [CENSORED]
8
node.session.auth.chap_algs = MD5
9
... # Some unimportant configurations omitted

1
# /etc/iscsi/nodes/iqn.2024-12.com.ceph:iscsi/192.168.128.252,3260,2/default
2
# BEGIN RECORD 2.1.5
3
node.name = iqn.2024-12.com.ceph:iscsi
4
... # Some unimportant configurations omitted
5
node.session.auth.authmethod = CHAP
6
node.session.auth.username = [CENSORED]
7
node.session.auth.password = [CENSORED]
8
node.session.auth.chap_algs = MD5
9
... # Some unimportant configurations omitted

1
defaults {
2
    user_friendly_names yes
3
    find_multipaths yes
4
}

1
mpatha(360014056229953ef442476e85501bfd7)dm-0LIO-ORG,TCMU device
2
size=500G features='1 queue_if_no_path' hwhandler='1 alua'wp=rw
3
|-+- policy='service-time 0' prio=50 status=active
4
| `- 14:0:0:152 sdb 8:16 active ready running
5
`-+- policy='service-time 0' prio=50 status=active
6
  `- 14:0:0:152 sdc 8:16 active ready running

1
auto vmbr0
2
iface vmbr0 inet static
3
    address   192.168.100.1
4
    netmask   255.255.255.0
5
    bridge_ports none
6
    bridge_stp off
7
    bridge_fd 0
8

9
    post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
10
    post-up   iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -o ens6f0 -j MASQUERADE
11
    post-up   iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
12
    post-up   iptables -A FORWARD -i vmbr0 -j ACCEPT
13
    post-down iptables -t nat -D POSTROUTING -s 192.168.100.0/24 -o ens6f0 -j MASQUERADE
14
    post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1
15
    post-down iptables -D FORWARD -i vmbr0 -j ACCEPT

1
#!/bin/bash
2

3
# =================Configuration Area=================
4
# Public network interface name (Please modify according to your actual situation)
5
PUB_IF="ens6f0"
6
# ====================================================
7

8
ACTION=$1
9
ARG1=$2
10
ARG2=$3
11
ARG3=$4
12
ARG4=$5
13

14
# Check if running as root
15
if [ "$EUID" -ne 0 ]; then
16
  echo "Please run this script with root privileges"
17
  exit 1
18
fi
19

20
# Generate random ID (6 characters)
21
generate_id() {
22
    # Introduce nanoseconds and random salt to ensure ID uniqueness even if the script runs quickly
23
    echo "$RANDOM $(date +%s%N)" | md5sum | head -c 6
24
}
25

26
# Show help information
27
usage() {
28
    echo "Usage: $0 {add|del|list|save} [parameters]"
29
    echo ""
30
    echo "Commands:"
31
    echo "  add <Public Port> <Internal IP> <Internal Port> [Protocol]   Add forwarding rule"
32
    echo "      [Protocol] optional: tcp, udp, both (default: both)"
33
    echo "  del <ID>                                   Delete forwarding rule by ID"
34
    echo "  list                                       View all current forwarding rules"
35
    echo "  save                                       Save current rules to persist after reboot (Must run!)"
36
    echo ""
37
    echo "Examples:"
38
    echo "  $0 add 8080 192.168.100.101 80 both"
39
    echo "  $0 save"
40
    echo ""
41
}
42

43
# Internal function: add single protocol rule
44
_add_single_rule() {
45
    local PROTO=$1
46
    local L_PORT=$2
47
    local T_IP=$3
48
    local T_PORT=$4
49

50
    local RULE_ID=$(generate_id)
51
    local COMMENT="NAT_ID:${RULE_ID}"
52

53
    # 1. Add DNAT rule (PREROUTING chain)
54
    iptables -t nat -A PREROUTING -i $PUB_IF -p $PROTO --dport $L_PORT -j DNAT --to-destination $T_IP:$T_PORT -m comment --comment "$COMMENT"
55

56
    # 2. Add FORWARD rule (Allow packet passage)
57
    iptables -A FORWARD -p $PROTO -d $T_IP --dport $T_PORT -m comment --comment "$COMMENT" -j ACCEPT
58

59
    # Output result
60
    printf "%-10s %-10s %-10s %-20s %-10s\n" "$RULE_ID" "$PROTO" "$L_PORT" "$T_IP:$T_PORT" "Success"
61

62
    # Remind user to save
63
    echo "Please run '$0 save' to ensure rules persist after reboot."
64
}
65

66
# Main add function
67
add_rule() {
68
    local L_PORT=$1
69
    local T_IP=$2
70
    local T_PORT=$3
71
    local PROTO_REQ=${4:-both} # Default to both
72

73
    if [[ -z "$L_PORT" || -z "$T_IP" || -z "$T_PORT" ]]; then
74
        echo "Error: Missing parameters"
75
        usage
76
        exit 1
77
    fi
78

79
    # Convert to lowercase
80
    PROTO_REQ=$(echo "$PROTO_REQ" | tr '[:upper:]' '[:lower:]')
81

82
    echo "Adding rule..."
83
    printf "%-10s %-10s %-10s %-20s %-10s\n" "ID" "Protocol" "Public Port" "Target Address" "Status"
84
    echo "------------------------------------------------------------------"
85

86
    if [[ "$PROTO_REQ" == "tcp" ]]; then
87
        _add_single_rule "tcp" "$L_PORT" "$T_IP" "$T_PORT"
88
    elif [[ "$PROTO_REQ" == "udp" ]]; then
89
        _add_single_rule "udp" "$L_PORT" "$T_IP" "$T_PORT"
90
    elif [[ "$PROTO_REQ" == "both" ]]; then
91
        _add_single_rule "tcp" "$L_PORT" "$T_IP" "$T_PORT"
92
        _add_single_rule "udp" "$L_PORT" "$T_IP" "$T_PORT"
93
    else
94
        echo "Error: Unsupported protocol '$PROTO_REQ'. Please use tcp, udp, or both."
95
        exit 1
96
    fi
97
    echo "------------------------------------------------------------------"
98
}
99

100
# Delete rule (Delete in reverse line number order)
101
del_rule() {
102
    local RULE_ID=$1
103

104
    if [[ -z "$RULE_ID" ]]; then
105
        echo "Error: Please provide rule ID"
106
        usage
107
        exit 1
108
    fi
109

110
    echo "Searching for rule with ID [${RULE_ID}]..."
111

112
    local FOUND=0
113

114
    # --- Clean NAT table (PREROUTING) ---
115
    LINES=$(iptables -t nat -nL PREROUTING --line-numbers | grep "NAT_ID:${RULE_ID}" | awk '{print $1}' | sort -rn)
116
    if [[ ! -z "$LINES" ]]; then
117
        for line in $LINES; do
118
            iptables -t nat -D PREROUTING $line
119
            echo "Deleted NAT table PREROUTING chain line $line"
120
            FOUND=1
121
        done
122
    fi
123

124
    # --- Clean Filter table (FORWARD) ---
125
    LINES=$(iptables -t filter -nL FORWARD --line-numbers | grep "NAT_ID:${RULE_ID}" | awk '{print $1}' | sort -rn)
126
    if [[ ! -z "$LINES" ]]; then
127
        for line in $LINES; do
128
            iptables -t filter -D FORWARD $line
129
            echo "Deleted Filter table FORWARD chain line $line"
130
            FOUND=1
131
        done
132
    fi
133

134
    if [[ $FOUND -eq 0 ]]; then
135
        echo "No rule found with ID $RULE_ID."
136
    else
137
        echo "Delete operation completed."
138
        echo "Please run '$0 save' to update the persistent configuration file."
139
    fi
140
}
141

142
# Save rules to disk (New feature)
143
save_rules() {
144
    echo "Saving current iptables rules..."
145
    # netfilter-persistent is the service managing iptables-persistent in Debian/Proxmox
146
    if command -v netfilter-persistent &> /dev/null; then
147
        netfilter-persistent save
148
        if [ $? -eq 0 ]; then
149
            echo "✅ Rules successfully saved to /etc/iptables/rules.v4, will be automatically restored after system reboot."
150
        else
151
            echo "❌ Failed to save rules. Please check the status of the 'netfilter-persistent' service."
152
        fi
153
    else
154
        echo "Warning: 'netfilter-persistent' command not found."
155
        echo "Please ensure the 'iptables-persistent' package is installed."
156
        echo "Install command: apt update && apt install iptables-persistent"
157
    fi
158
}
159

160
# List rules
161
list_rules() {
162
    echo "Current Port Forwarding Rules List:"
163
    printf "%-10s %-10s %-10s %-20s %-10s\n" "ID" "Protocol" "Public Port" "Target Address" "Target Port"
164
    echo "------------------------------------------------------------------"
165

166
    # Parse iptables output
167
    iptables -t nat -nL PREROUTING -v | grep "NAT_ID:" | while read line; do
168
        id=$(echo "$line" | grep -oP '(?<=NAT_ID:)[^ ]*')
169

170
        # Extract protocol
171
        if echo "$line" | grep -q "tcp"; then proto="tcp"; else proto="udp"; fi
172

173
        # Extract port after dpt:
174
        l_port=$(echo "$line" | grep -oP '(?<=dpt:)[0-9]+')
175

176
        # Extract IP:Port after to:
177
        target=$(echo "$line" | grep -oP '(?<=to:).*')
178
        t_ip=${target%:*}
179
        t_port=${target#*:}
180

181
        printf "%-10s %-10s %-10s %-20s %-10s\n" "$id" "$proto" "$l_port" "$t_ip" "$t_port"
182
    done
183
}
184

185
# Main logic
186
case "$ACTION" in
187
    add)
188
        add_rule "$ARG1" "$ARG2" "$ARG3" "$ARG4"
189
        ;;
190
    del)
191
        del_rule "$ARG1"
192
        ;;
193
    list)
194
        list_rules
195
        exit 0
196
        ;;
197
    save)
198
        save_rules
199
        ;;
200
    *)
201
        usage
202
        exit 1
203
        ;;
204
esac
205
save_rules