# make sure tcp/113 is rejected
function runIptables
{
- # something keeps answering all tftp requests with auth requests (SYN
- # packets to the client tcp/113). Since the PXE client doesn't answer with
- # RST, the auth query has to wait until it times out. Forbidding the
- # terminalserver to send out packets to tcp/113 via iptables _greatly_
- # speeds up the process. But of course the real fix would be to have grml
- # stop sending out auth queries to tftp clients. according to netstat, it
- # is in.tftpd itself sending out the auth queries.
- # Thanks to Marc Haber and Wolfgang Karall for noticing and current fix.
if [ -x /sbin/iptables ] ; then
- if iptables -L | grep -q '^REJECT.*tcp-reset' ; then
+ # something keeps answering all tftp requests with auth requests (SYN
+ # packets to the client tcp/113). Since the PXE client doesn't answer with
+ # RST, the auth query has to wait until it times out. Forbidding the
+ # terminalserver to send out packets to tcp/113 via iptables _greatly_
+ # speeds up the process. But of course the real fix would be to have grml
+ # stop sending out auth queries to tftp clients. according to netstat, it
+ # is in.tftpd itself sending out the auth queries.
+ # Thanks to Marc Haber and Wolfgang Karall for noticing and current fix.
+ if iptables -L | grep -q '^REJECT.*tcp dpt:auth reject-with tcp-reset' ; then
echo "Rule for tcp/113 already present, nothing to be done."
else
- echo -n "Rejecting tcp/113 via iptables to speed up speed up booting via PXE:"
+ echo "Rejecting tcp/113 via iptables to speed up booting via PXE, running:"
+ echo -n '* iptables -A OUTPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset ... '
iptables -A OUTPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset && echo done || echo failed
fi
+ # deactivate Multicast-DNS
+ if iptables -L | grep -q '^REJECT.*dpt:mdns reject-with icmp-port-unreachable' ; then
+ echo "Rule for udp/5353 already present, nothing to be done."
+ else
+ echo "Rejecting udp/5353 via iptables for deactivating Multicast-DNS, running:"
+ echo -n '* iptables -A OUTPUT -p udp -d 224.0.0.0/8 --dport 5353 -j REJECT ... '
+ iptables -A OUTPUT -p udp -d 224.0.0.0/8 --dport 5353 -j REJECT && echo done || echo failed
+ fi
+ if [ "$NAT_INTERFACE_" != "none" ]; then
+ local nat_source_ip_=`netGetIp "$NAT_INTERFACE_" warn`
+
+ if iptables -t nat -vnL POSTROUTING | grep -q "SNAT.*${NAT_INTERFACE_}.*to:${nat_source_ip_}" ; then
+ echo "Rule for SNAT already present, nothing to be done."
+ else
+ echo "Setting up SNAT for terminalserver clients on ${NAT_INTERFACE_}:"
+ echo "* iptables -t nat -F POSTROUTING"
+ echo -n "* iptables -t nat -A POSTROUTING -o $NAT_INTERFACE_ -j SNAT --to-source $nat_source_ip_ ... "
+ { iptables -t nat -F POSTROUTING && \
+ iptables -t nat -A POSTROUTING -o "$NAT_INTERFACE_" -j SNAT --to-source "$nat_source_ip_" ; } && \
+ echo done || echo failed
+ fi
+ if [ `cat /proc/sys/net/ipv4/ip_forward` -eq 1 ]; then
+ echo "IP-Forwarding already enabled, nothing to be done."
+ else
+ echo -n "Enabling IP-Forwarding: "
+ echo 1 > /proc/sys/net/ipv4/ip_forward && echo done || echo failed
+ fi
+ fi
else
warn "iptables executable not avilable"
fi
{
removeTftpConf
- execute "mkdir $TFTPD_DATA_DIR_/pxelinux.cfg" die
+ execute "mkdir -p $TFTPD_DATA_DIR_/pxelinux.cfg" die
execute "install -m 644 /usr/lib/syslinux/pxelinux.0 $TFTPD_DATA_DIR_" die
execute "install -m 644 $PATH_/minirt26.gz $TFTPD_DATA_DIR_" die
execute "install -m 644 $KERNEL_IMAGE_ $TFTPD_DATA_DIR_/linux26" die
function stopTftp
{
- start-stop-daemon --stop --quiet --name "${TFTPD_BIN_##*/}"
+ start-stop-daemon --stop --quiet -p "$TFTPD_PID_"
}
function startTftp
{
test -f $TFTPD_BIN_ || die "could not find \"$TFTPD_BIN_\""
- start-stop-daemon --start --quiet --exec "$TFTPD_BIN_" -- -l -a "$IP_" -s "$TFTPD_DATA_DIR_" || \
+ start-stop-daemon --start --quiet --exec "$TFTPD_BIN_" -- --daemon --no-multicast --pidfile "$TFTPD_PID_" --bind-address "$IP_" "$TFTPD_DATA_DIR_" || \
warn "problems starting tftpd server"
}
function runTftp
echo -n "Starting dhcpd: "
runDhcp && echo done || echo failed
- runIptables
+ #runIptables
- echo "Starting nfs: "
+ echo "Finally starting nfs services..."
startNfs && echo "Sucessfully finished startup of grml-terminalserver." || echo 'Startup of grml-terminalserver-config failed!'
}