View difference between Paste ID: SqReWZnB and 5FRyD55w

 #!/bin/sh
-# version: 1.0.0, 22-sep-2021, by eibgrad
+#DEBUG= # uncomment/comment to enable/disable debug mode
-# href: https://tinyurl.com/3ebyzyyu
+
 #          name: merlin-ovpn-port-forward.sh
 #       version: 2.0.0, 22-jul-2022, by eibgrad
-SCRIPT="$SCRIPTS_DIR/nat-start"
+#       purpose: openvpn client firewall-based killswitch
 #       type(s): nat-start
 #          href: https://tinyurl.com/3ebyzyyu
 #  installation:
 #    1. enable jffs custom scripts and configs (administration->system)
-cat << "EOF" > $SCRIPT
+#    2. ssh to router and copy/paste the following command:
 #         curl -kLs bit.ly/merlin-installer|tr -d '\r'|sh -s SqReWZnB
-set -x # uncomment/comment to enable/disable debug mode
+#    3. modify script w/ your preferred options using nano editor:
 #         nano /jffs/scripts/merlin-ovpn-port-forward.sh
 #    4. reboot
 
-# network-interface source-ip/network protocol external-port internal-ip internal-port
+
-PORT_FORWARDS='
+SCRIPT1="$SCRIPTS_DIR/merlin-ovpn-port-forward.sh"
-tun11 0.0.0.0/0 tcp 5022 192.168.1.1 22 # router ssh server
+SCRIPT2="$SCRIPTS_DIR/nat-start"
-tun11 0.0.0.0/0 tcp 5222 192.168.1.100 22 # desktop ssh server
+
-tun12 0.0.0.0/0 tcp 5080 192.168.1.200 80 # laptop webserver
+
-tun12 0.0.0.0/0 tcp 5443 192.168.1.200 443 # laptop webserver
+
-#tun12 188.188.188.188 tcp 5088 192.168.1.210 8088
+# ---------------------- begin merlin-ovpn-port-forward ---------------------- #
-tun+ 199.199.199.0/24 udp 5999 192.168.1.210 999 # all vpn network interfaces
+cat << 'EOF' > $SCRIPT1
-'
+
 #set -x # comment/uncomment to disable/enable debug mode
 {
 # ------------------------------ BEGIN OPTIONS ------------------------------- #
 
 # interface source-ip/net proto extern-port intern-ip intern-port [comments...]
 PORT_FORWARDS="
 tun11 0.0.0.0/0 tcp 10022 $(nvram get lan_ipaddr) 22 router ssh server
 tun12 0.0.0.0/0 tcp 10080 192.168.1.200 80
 tun12 0.0.0.0/0 tcp 10443 192.168.1.200 443
 #tun12 188.188.188.188 tcp 10088 192.168.1.210 8088
-         dev="$(echo $pf | awk '{print $1}')"
+tun+ 199.199.199.0/24 udp 10999 192.168.1.210 999 all vpn network interfaces
-         src="$(echo $pf | awk '{print $2}')"
+"
-       proto="$(echo $pf | awk '{print $3}')"
+
-    ext_port="$(echo $pf | awk '{print $4}')"
+
-      int_ip="$(echo $pf | awk '{print $5}')"
+
-    int_port="$(echo $pf | awk '{print $6}')"
+
 ipt() { iptables ${@/-[IA]/-D} 2>/dev/null; iptables $@; }
 
-    iptables -t nat -D PREROUTING -i $dev -s $src -p $proto --dport $ext_port \
+
-        -j DNAT --to $int_ip:$int_port 2>/dev/null
+
-    iptables -t nat -I PREROUTING -i $dev -s $src -p $proto --dport $ext_port \
+
-        -j DNAT --to $int_ip:$int_port
+
     echo $pf | grep -Eq '^[[:space:]]*(#|$)' && continue
 
     # parse port forward into separate fields
     for i in 1 2 3 4 5 6; do eval f$i="$(echo $pf | cut -d' ' -f$i)"; done
-# allow forwarding from vpn to router internal port
+
-iptables -D INPUT   -i tun+ -m conntrack --ctstate DNAT -j ACCEPT 2>/dev/null
+
-iptables -I INPUT   -i tun+ -m conntrack --ctstate DNAT -j ACCEPT
+    ipt -t nat -I PREROUTING -i $f1 -s $f2 -p $f3 --dport $f4 \
         -j DNAT --to $f5:$f6
-# allow forwarding from vpn to internal ip+port
+
-iptables -D FORWARD -i tun+ -m conntrack --ctstate DNAT -j ACCEPT 2>/dev/null
+
-iptables -I FORWARD -i tun+ -m conntrack --ctstate DNAT -j ACCEPT
+
 
 # allow routing from vpn to router internal port
 ipt -I INPUT -i tun+ -m conntrack --ctstate DNAT -j ACCEPT
-chmod +x $SCRIPT
+
 # allow routing from vpn to lan internal ip+port
 ipt -I FORWARD -i tun+ -m conntrack --ctstate DNAT -j ACCEPT
-if [ -f $SCRIPT ]; then
+
-    echo "error: $SCRIPT already exists; requires manual installation"
+exit 0
 } 2>&1 | logger -t $(basename $0 .sh)[$$]
 EOF
-    echo 'Done.'
+[ ${DEBUG+x} ] && sed -ri '2 s/^#(set -x)/\1/' $SCRIPT1
-fi
+chmod +x $SCRIPT1
 echo "installed: $SCRIPT1"
 # ----------------------- end merlin-ovpn-port-forward ----------------------- #
 
 # ----------------------------- begin nat-start ------------------------------ #
 create_script() {
 cat << 'EOF' > $SCRIPT2
 #!/bin/sh
 #set -x # comment/uncomment to disable/enable debug mode
 {
 $SCRIPT1
 } 2>&1 | logger -t $(basename $0)[$$]
 EOF
 [ ${DEBUG+x} ] && sed -ri '2 s/^#(set -x)/\1/' $SCRIPT2
 sed -i "s:\$SCRIPT1:$SCRIPT1:g" $SCRIPT2
 chmod +x $SCRIPT2
 }
 
 if [ -f $SCRIPT2 ]; then
     echo "error: $SCRIPT2 already exists; requires manual installation"
 else
     create_script
     echo "installed: $SCRIPT2"
 fi
 # ------------------------------ end nat-start ------------------------------- #