IPC

Dazu habe ich die Linux Firewall an tap0 meine Ports für das CS Weitergeleitet.

# Generated by iptables-save v1.4.8 on Sun Aug 21 09:26:13 2011
*filter
:FORWARD ACCEPT [0:0]
:INPUT DROP [0:0]
:OUTPUT ACCEPT [0:0]
# Accept traffic from internal interfaces
-A INPUT ! -i tap0 -j ACCEPT
# Accept traffic with the ACK flag set
-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
# Allow incoming data that is part of a connection we established
-A INPUT -m state --state ESTABLISHED -j ACCEPT
# Allow data that is related to existing connections
-A INPUT -m state --state RELATED -j ACCEPT
# Accept responses to DNS queries
-A INPUT -p udp -m udp --dport 1024:65535 --sport 53 -j ACCEPT
# Accept responses to our pings
-A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT
# Accept notifications of unreachable hosts
-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -j ACCEPT
# Accept notifications to reduce sending speed
-A INPUT -p icmp -m icmp --icmp-type source-quench -j ACCEPT
# Accept notifications of lost packets
-A INPUT -p icmp -m icmp --icmp-type time-exceeded -j ACCEPT
# Accept notifications of protocol problems
-A INPUT -p icmp -m icmp --icmp-type parameter-problem -j ACCEPT
# Allow connections to our SSH server
-A INPUT -p tcp -m tcp --dport 12003-j ACCEPT
# Allow connections to our IDENT server
-A INPUT -p tcp -m tcp --dport auth -j ACCEPT
# Respond to pings
-A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT
# Allow DNS zone transfers
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
# Allow DNS queries
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
# Allow connections to webserver
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
# Allow SSL connections to webserver
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
# Allow connections to mail server
-A INPUT -p tcp -m tcp -m multiport -j ACCEPT --dports 25,587
# Allow connections to FTP server
-A INPUT -p tcp -m tcp --dport 20:21 -j REJECT
# Allow connections to POP3 server
-A INPUT -p tcp -m tcp -m multiport -j ACCEPT --dports 110,995
# Allow connections to IMAP server
-A INPUT -p tcp -m tcp -m multiport -j ACCEPT --dports 143,220,993
# Allow connections to Webmin
-A INPUT -p tcp -m tcp --dport 10000:10010 -j ACCEPT
# Allow connections to Usermin
-A INPUT -p tcp -m tcp --dport 20000 -j ACCEPT
# Debian-VPN-UDP
-A INPUT -p udp -m udp --dport 12001 -j ACCEPT
# Debian-VPN-TCP
-A INPUT -p tcp -m tcp --dport 12002 -j ACCEPT
# OScam-Webif
-A INPUT -p tcp -m tcp --dport 85 -j ACCEPT

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug eth0
iface eth0 inet static
        address 192.168.178.26
        netmask 255.255.255.0
        broadcast 192.168.178.255
        gateway 192.168.178.1
        post-up iptables-restore < /etc/iptables.up.rules

#!/bin/bash
./openvpn --daemon --config client.ovpn
while true
do
 if !(ping -c 1 192.168.179.10) # IP aus fremdem Netz anpingen
 then
  killall -9 openvpn
  sleep 5
  cd /var/tmp/
  ./openvpn --daemon --config client.ovpn
  cd /
 fi
sleep 300
done

#! /bin/sh

#uncomment the line for debug_out you want to use
#use /dev/stdout only when not calling from cron
debug_out=/dev/null
#debug_out=/dev/stdout
#NEXTHOP is a host at the other site of the VPN
NEXTHOP=star_pc.xxxtech.com
OPEN_VPN_CMD="/etc/init.d/openvpn restart"
PING=/bin/ping

logger_opts="-t $0"
if [ "$debug_out" = "/dev/stdout" ]
then
        logger_opts="$logger_opts -s"
fi

pckts_rcvd=`$PING -c 8 -q -W 2 $NEXTHOP | grep transm | awk '{print $4}'`
echo "host: $NEXTHOP, pckts_rcvd: $pckts_rcvd" >$debug_out
if [ $pckts_rcvd -eq 0 ]
then
        echo "Connection with $NEXTHOP lost, resetting" | logger $logopts
        $OPEN_VPN_CMD > $debug_out
else
        echo "Connection with $NEXTHOP up, no action" | logger $logopts
fi

--ping n Falls der OpenVPN-Tunnel n-Sekunden lang nicht benutzt wird, wird ein ping an den VPN-Partner gesendet.
--ping-restart n Falls innerhalb von n Sekunden kein Ping oder Datenpaket vom VPN-Partner empfangen wurde, wird der OpenVPN-Tunnel neu gestartet.
--keepalive n m ist eine Abkürzung für “--ping n --ping-restart m”