Automated debian deployment of ZEROTIER bidirection router

[daymr]

This script automates the setup process for configuring networking settings on a Linux machine to be a bidirectional router. This can be in a debian linux vm which uses minimal resouces. Use case is Hyper-V vm within site that does not support installing zerotier at the router level. Of course for this to work, you will also need static routes in place on both the controller as well as the router or the routing table of the other clients on the network. I hope someone finds this useful. Here's a breakdown of what the script does:

1. Dependency Check: It checks if curl is installed. If not, it installs it using apt package manager.
2. ZeroTier CLI Check: It verifies if the ZeroTier CLI (zerotier-cli) is installed. If not, it installs it using curl.
3. Join ZeroTier Network: It checks if the machine is already joined to the specified ZeroTier network. If not, it joins the network using zerotier-cli join.
4. Wait for ZeroTier Connection: It waits for 5 seconds for the ZeroTier connection to establish.
5. Retrieve Hostname and Node ID: It retrieves the fully qualified domain name (FQDN) hostname and the Node ID using ZeroTier CLI and hostname command.
6. Create JSON Payload: It creates a JSON payload with hostname and authorization status, posting the node name as the FQDN hostname and then authorizes the client.
7. Authorize Node in ZeroTier Network: It makes a POST request to authorize the node in the ZeroTier network using the provided API token and network information.
8. Enable IP Forwarding: It enables IP forwarding by updating the sysctl configuration.
9. Set Up iptables Rules: It sets up iptables rules for forwarding packets between physical and ZeroTier interfaces and enables masquerading from physical to ZeroTier and vice versa.
10. Save iptables Rules: It saves the iptables rules to /etc/iptables/rules-save.
11. Overall, the script ensures that the machine is properly connected to a ZeroTier network, configures networking settings for communication over ZeroTier, and sets up necessary firewall rules for forwarding traffic between physical and ZeroTier interfaces.

#!/bin/bash

# Define ZeroTier network and organization IDs
ZT_NETWORK_ID=""
ZT_ORGANIZATION=""
API_TOKEN=""
ZT_API_URL=""  # Define the ZeroTier API URL

# Check if curl is installed
if ! command -v curl &> /dev/null
then
    echo "curl is not installed. Installing..."
    # Update package index
    sudo apt update
    # Install curl
    sudo apt install -y curl
else
    echo "curl is already installed."
fi

# Check curl version
curl_version=$(curl --version | head -n 1 | awk '{print $2}')
echo "Installed curl version: $curl_version"

# Check if ZeroTier CLI is installed
if ! command -v zerotier-cli &> /dev/null; then
    echo "ZeroTier CLI is not installed. Installing..."
    curl -s https://install.zerotier.com | sudo bash
fi

# Check if the machine is already joined to the ZeroTier network
if sudo zerotier-cli listnetworks | grep -q "$ZT_NETWORK_ID"; then
    echo "Machine is already joined to the ZeroTier network $ZT_NETWORK_ID."
else
    # Join the ZeroTier network if the network ID is provided
    if [ -n "$ZT_NETWORK_ID" ]; then
        echo "Joining ZeroTier network $ZT_NETWORK_ID..."
        sudo zerotier-cli join "$ZT_NETWORK_ID"
    fi
fi

# Wait for ZeroTier to establish the connection
sleep 5

# Retrieve the FQDN hostname
FQDN_HOSTNAME=$(hostname -f)

# Retrieve the Node ID using zerotier-cli
NODE_ID=$(sudo cat /var/lib/zerotier-one/identity.public | cut -d ':' -f 1)

# Create a JSON payload with the specified structure
json_payload=$(jq -n --arg name "$FQDN_HOSTNAME" --arg authorized "true" '{name: $name, authorized: $authorized}')

# Make the POST request using cURL with verbose output and handle redirection
echo "Authorizing node in ZeroTier network..."
response=$(curl -L -X POST \
  -H "Content-Type: application/json" \
  -H "x-ztnet-auth: $API_TOKEN" \
  -H "Accept: application/json" \
  -d "$json_payload" \
  "$ZT_API_URL/org/$ZT_ORGANIZATION/network/$ZT_NETWORK_ID/member/$NODE_ID")

# Check for errors
if [[ $response != *"200"* ]]; then
    echo "SUCCESSFUL: HTTP $response"
    exit 1
fi

echo "Authorization successful."

# Enable IP forwarding
echo "Enabling IP forwarding..."
echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-ip-forward.conf
sysctl -p /etc/sysctl.d/99-ip-forward.conf
display_result $? "Enabling IP forwarding"
echo "IP forwarding enabled successfully."

# Add iptables rules for forwarding between physical and ZeroTier interfaces
echo "Adding iptables rules..."
iptables -A FORWARD -i eth0 -o zt+ -j ACCEPT
iptables -A FORWARD -i zt+ -o eth0 -j ACCEPT
display_result $? "Adding iptables rules"
echo "Iptables rules added successfully."

# Enable masquerading from physical to ZeroTier
echo "Enabling masquerading from physical to ZeroTier..."
iptables -t nat -A POSTROUTING -o zt+ -j MASQUERADE
display_result $? "Enabling masquerading from physical to ZeroTier"
echo "Masquerading from physical to ZeroTier enabled successfully."

# Enable masquerading from ZeroTier to physical
echo "Enabling masquerading from ZeroTier to physical..."
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
display_result $? "Enabling masquerading from ZeroTier to physical"
echo "Masquerading from ZeroTier to physical enabled successfully."

# Save iptables rules
echo "Saving iptables rules..."
iptables-save > /etc/iptables/rules-save
display_result $? "Saving iptables rules"
echo "Iptables rules saved successfully."

[sinamics]

Great, thank you for sharing. tested and works well.
Couple of notes:

• Check if jq is installed
• Add -w "%{http_code}" to the curl post.
• Script has to be run with sudo.
• display_result utility function is not in your code.