jv
/
my-homelab-configs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Install iptables if missing

This commit is contained in:
juvdiaz 2026-07-02 10:59:58 -06:00
parent 540ae7e486
commit cfcfc39f1f
4 changed files with 44 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
README.md
View File

@ -737,9 +737,10 @@ traffic. Static mode uses
`LAB_PIMOX_WORKER_DNS_SERVERS="192.168.100.89 1.1.1.1"`. `LAB_PIMOX_WORKER_DNS_SERVERS="192.168.100.89 1.1.1.1"`.
For static workers, Jeannie also adds targeted Pimox-host forwarding exceptions For static workers, Jeannie also adds targeted Pimox-host forwarding exceptions
for each worker IP in `DOCKER-USER` when that chain exists, or `FORWARD` for each worker IP in `DOCKER-USER` when that chain exists, or `FORWARD`
otherwise. Disable this with `LAB_PIMOX_WORKER_CONFIGURE_FORWARDING=false` only otherwise. If `iptables` is missing on the Pimox host, Jeannie installs it before
when the Pimox host firewall already permits bridged worker IP traffic. Before adding those rules. Disable this with `LAB_PIMOX_WORKER_CONFIGURE_FORWARDING=false`
adding rules, Jeannie saves `iptables-save` output on the Pimox host under only when the Pimox host firewall already permits bridged worker IP traffic.
Before adding rules, Jeannie saves `iptables-save` output on the Pimox host under
`${LAB_PIMOX_WORKER_IPTABLES_BACKUP_DIR:-~/iptables-backups}`. `${LAB_PIMOX_WORKER_IPTABLES_BACKUP_DIR:-~/iptables-backups}`.
Worker NIC MAC addresses default to the VMID-derived deterministic format used Worker NIC MAC addresses default to the VMID-derived deterministic format used
by the original working Pimox worker path. Set `LAB_PIMOX_WORKER_MAC_MODE=auto` by the original working Pimox worker path. Set `LAB_PIMOX_WORKER_MAC_MODE=auto`

7
README.md.tmpl
View File

@ -737,9 +737,10 @@ traffic. Static mode uses
`LAB_PIMOX_WORKER_DNS_SERVERS="192.168.100.89 1.1.1.1"`. `LAB_PIMOX_WORKER_DNS_SERVERS="192.168.100.89 1.1.1.1"`.
For static workers, Jeannie also adds targeted Pimox-host forwarding exceptions For static workers, Jeannie also adds targeted Pimox-host forwarding exceptions
for each worker IP in `DOCKER-USER` when that chain exists, or `FORWARD` for each worker IP in `DOCKER-USER` when that chain exists, or `FORWARD`
otherwise. Disable this with `LAB_PIMOX_WORKER_CONFIGURE_FORWARDING=false` only otherwise. If `iptables` is missing on the Pimox host, Jeannie installs it before
when the Pimox host firewall already permits bridged worker IP traffic. Before adding those rules. Disable this with `LAB_PIMOX_WORKER_CONFIGURE_FORWARDING=false`
adding rules, Jeannie saves `iptables-save` output on the Pimox host under only when the Pimox host firewall already permits bridged worker IP traffic.
Before adding rules, Jeannie saves `iptables-save` output on the Pimox host under
`${LAB_PIMOX_WORKER_IPTABLES_BACKUP_DIR:-~/iptables-backups}`. `${LAB_PIMOX_WORKER_IPTABLES_BACKUP_DIR:-~/iptables-backups}`.
Worker NIC MAC addresses default to the VMID-derived deterministic format used Worker NIC MAC addresses default to the VMID-derived deterministic format used
by the original working Pimox worker path. Set `LAB_PIMOX_WORKER_MAC_MODE=auto` by the original working Pimox worker path. Set `LAB_PIMOX_WORKER_MAC_MODE=auto`

7
bootstrap/provisioning/README.md
View File

@ -152,9 +152,10 @@ Static mode uses
and `LAB_PIMOX_WORKER_DNS_SERVERS="192.168.100.89 1.1.1.1"`. and `LAB_PIMOX_WORKER_DNS_SERVERS="192.168.100.89 1.1.1.1"`.
For static workers, Jeannie also adds targeted Pimox-host forwarding exceptions For static workers, Jeannie also adds targeted Pimox-host forwarding exceptions
for each worker IP in `DOCKER-USER` when that chain exists, or `FORWARD` for each worker IP in `DOCKER-USER` when that chain exists, or `FORWARD`
otherwise. Disable this with `LAB_PIMOX_WORKER_CONFIGURE_FORWARDING=false` only otherwise. If `iptables` is missing on the Pimox host, Jeannie installs it before
when the Pimox host firewall already permits bridged worker IP traffic. Before adding those rules. Disable this with `LAB_PIMOX_WORKER_CONFIGURE_FORWARDING=false`
adding rules, Jeannie saves `iptables-save` output on the Pimox host under only when the Pimox host firewall already permits bridged worker IP traffic.
Before adding rules, Jeannie saves `iptables-save` output on the Pimox host under
`${LAB_PIMOX_WORKER_IPTABLES_BACKUP_DIR:-~/iptables-backups}`. `${LAB_PIMOX_WORKER_IPTABLES_BACKUP_DIR:-~/iptables-backups}`.
Worker NIC MAC addresses default to the VMID-derived deterministic format used Worker NIC MAC addresses default to the VMID-derived deterministic format used
by the original working Pimox worker path. Set `LAB_PIMOX_WORKER_MAC_MODE=auto` by the original working Pimox worker path. Set `LAB_PIMOX_WORKER_MAC_MODE=auto`

44
jeannie
View File

@ -1070,16 +1070,15 @@ pimox_worker_vm_debug() {
local key_path="$3" local key_path="$3"
local vmid="$4" local vmid="$4"
local qm_bin="$5" local qm_bin="$5"
local script
local encoded_script
pimox_ssh "${host}" "${user}" "${key_path}" "set +e script="$(cat <<'EOF'
echo 'Pimox VM ${vmid} status:' set +e
sudo '${qm_bin}' status '${vmid}' echo "-- addresses --"
echo 'Pimox VM ${vmid} config summary:' ip -br addr
sudo '${qm_bin}' config '${vmid}' | grep -E '^(agent|boot|net0|scsi0|virtio0|sata0|ide0|ide2|efidisk0):' || true echo "-- routes --"
echo 'Pimox VM ${vmid} guest-agent network-get-interfaces:' ip route
sudo '${qm_bin}' guest cmd '${vmid}' network-get-interfaces || true
echo 'Pimox VM ${vmid} guest SSH diagnostics:'
sudo '${qm_bin}' guest exec '${vmid}' -- bash -lc 'set +e
echo "-- units --" echo "-- units --"
systemctl is-active ssh sshd 2>/dev/null || true systemctl is-active ssh sshd 2>/dev/null || true
echo "-- listeners --" echo "-- listeners --"
@ -1088,7 +1087,18 @@ echo "-- sshd config test --"
sudo sshd -t 2>&1 || true sudo sshd -t 2>&1 || true
echo "-- recent ssh logs --" echo "-- recent ssh logs --"
journalctl -u ssh -u sshd --no-pager -n 40 2>/dev/null || true journalctl -u ssh -u sshd --no-pager -n 40 2>/dev/null || true
' || true" >&2 || true EOF
)"
encoded_script="$(printf '%s' "${script}" | base64 | tr -d '\n')"
pimox_ssh "${host}" "${user}" "${key_path}" "set +e
echo 'Pimox VM ${vmid} status:'
sudo '${qm_bin}' status '${vmid}'
echo 'Pimox VM ${vmid} config summary:'
sudo '${qm_bin}' config '${vmid}' | grep -E '^(agent|boot|net0|scsi0|virtio0|sata0|ide0|ide2|efidisk0):' || true
echo 'Pimox VM ${vmid} guest-agent network-get-interfaces:'
sudo '${qm_bin}' guest cmd '${vmid}' network-get-interfaces || true
echo 'Pimox VM ${vmid} guest SSH diagnostics:'
sudo '${qm_bin}' guest exec '${vmid}' -- bash -lc \"printf '%s' '${encoded_script}' | base64 -d | sudo bash\" || true" >&2 || true
} }
pimox_worker_guest_agent_recovery_hint() { pimox_worker_guest_agent_recovery_hint() {
@ -1575,8 +1585,15 @@ configure_pimox_worker_forwarding() {
pimox_ssh "${pimox_host}" "${pimox_user}" "${pimox_key}" "set -eu pimox_ssh "${pimox_host}" "${pimox_user}" "${pimox_key}" "set -eu
if ! command -v iptables >/dev/null 2>&1; then if ! command -v iptables >/dev/null 2>&1; then
echo 'iptables not found on Pimox host; skipping worker forwarding rules.' if command -v apt-get >/dev/null 2>&1; then
exit 0 echo 'iptables not found on Pimox host; installing iptables for worker forwarding rules.'
sudo apt-get update
sudo apt-get install -y --no-install-recommends iptables
fi
fi
if ! command -v iptables >/dev/null 2>&1; then
echo 'iptables not found on Pimox host and could not be installed; cannot configure worker forwarding rules.' >&2
exit 1
fi fi
backup_dir='${backup_dir}' backup_dir='${backup_dir}'
case \"\$backup_dir\" in case \"\$backup_dir\" in
@ -1589,6 +1606,9 @@ if command -v iptables-save >/dev/null 2>&1; then
sudo iptables-save >\"\$backup_file\" sudo iptables-save >\"\$backup_file\"
echo \"Saved Pimox iptables backup: \$backup_file\" echo \"Saved Pimox iptables backup: \$backup_file\"
fi fi
sudo mkdir -p /etc/sysctl.d
printf '%s\n' 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-homelab-pimox-worker-forwarding.conf >/dev/null
sudo sysctl -w net.ipv4.ip_forward=1 >/dev/null
chain=FORWARD chain=FORWARD
if sudo iptables -S DOCKER-USER >/dev/null 2>&1; then if sudo iptables -S DOCKER-USER >/dev/null 2>&1; then
chain=DOCKER-USER chain=DOCKER-USER