Все фрагменты

nuno / gistfile1.txt

0 лайк(-ов)

0 форк(-ов)

1 файл(-ов)

Последняя активность 2 months ago

1	iptables -L FORWARD -n \| grep "10.1.103\\|10.0.0.102"
2	ACCEPT 6 -- 10.1.103.3 10.0.0.103 tcp dpt:53
3	ACCEPT 17 -- 10.1.103.3 10.0.0.103 udp dpt:53
4	DROP 6 -- 10.1.103.3 10.0.0.210 tcp dpt:9000
5	DROP 0 -- 10.1.103.3 10.0.0.101
6	DROP 0 -- 10.1.103.3 10.0.0.200
7	DROP 0 -- 10.1.103.3 10.0.0.103
8	DROP 0 -- 10.1.103.3 10.0.0.102
9	DROP 0 -- 10.1.103.3 10.0.0.105
10	DROP 0 -- 10.1.103.3 10.0.0.100

nuno / gistfile1.txt

0 лайк(-ов)

0 форк(-ов)

1 файл(-ов)

Последняя активность 2 months ago

1	root@wireguard:/# iptables -L FORWARD -n
2	Chain FORWARD (policy ACCEPT)
3	target prot opt source destination
4	DROP 6 -- 10.1.2.1 10.0.0.210 tcp dpt:9000
5	DROP 6 -- 10.1.2.1 10.0.0.105 tcp dpt:8007
6	DROP 6 -- 10.1.2.1 10.0.0.100 tcp dpt:8006
7	ACCEPT 6 -- 10.1.103.3 10.0.0.103 tcp dpt:53
8	ACCEPT 17 -- 10.1.103.3 10.0.0.103 udp dpt:53
9	DROP 6 -- 10.1.103.3 10.0.0.210 tcp dpt:9000
10	DROP 0 -- 10.1.103.3 10.0.0.101

nuno / gistfile1.txt

0 лайк(-ов)

0 форк(-ов)

1 файл(-ов)

Последняя активность 2 months ago

1	function rule::apply() {
2	local rule_name="$1"
3	local client_ip="$2"
4
5	rule::require_exists "$rule_name" \|\| return 1
6
7	# Check if already applied
8	local peer_name
9	peer_name=$(peers::find_by_ip "$client_ip")
10	if [[ -n "$peer_name" ]]; then

nuno / gistfile1.txt

0 лайк(-ов)

0 форк(-ов)

1 файл(-ов)

Последняя активность 2 months ago

1	root@wireguard:/# iptables -F FORWARD
2	root@wireguard:/# iptables -t nat -F PREROUTING
3	root@wireguard:/# wgctl restart
4	=> INFO: 🟢 🔒 Restarting WireGuard...
5	=> INFO: 🔒 Restoring rules from peer meta files...
6	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.100
7	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.105
8	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.102
9	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.103
10	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.200

nuno / gistfile1.txt

0 лайк(-ов)

0 форк(-ов)

1 файл(-ов)

Последняя активность 2 months ago

1	root@wireguard:/# wgctl restart
2	=> INFO: 🟢 🔒 Restarting WireGuard...
3	=> INFO: 🔒 Restoring rules from peer meta files...
4	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.100:8006/tcp
5	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.100:22/tcp
6	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.105:8007/tcp
7	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.102:22/tcp
8	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.200:80/tcp
9	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.200:443/tcp
10	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.103:80/tcp

nuno / gistfile1.txt

0 лайк(-ов)

0 форк(-ов)

1 файл(-ов)

Последняя активность 2 months ago

1	function rule::apply() {
2	local rule_name="$1"
3	local client_ip="$2"
4
5	rule::require_exists "$rule_name" \|\| return 1
6
7	# Check if already applied
8	local peer_name
9	peer_name=$(peers::find_by_ip "$client_ip")
10	if [[ -n "$peer_name" ]]; then

nuno / gistfile1.txt

0 лайк(-ов)

0 форк(-ов)

1 файл(-ов)

Последняя активность 2 months ago

1	oot@wireguard:/# wgctl restart
2	=> INFO: 🟢 🔒 Restarting WireGuard...
3	=> INFO: 🔒 Restoring rules from peer meta files...
4	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.100/32
5	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.105/32
6	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.102/32
7	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.103/32
8	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.101/32
9	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.200/32
10	=> INFO: 🚫 🔒 Blocked 10.1.103.1 → 10.0.0.100:8006/tcp

nuno / gistfile1.txt

0 лайк(-ов)

0 форк(-ов)

1 файл(-ов)

Последняя активность 2 months ago

1	root@wireguard:~# wgctl restart
2	=> INFO: 🟢 🔒 Restarting WireGuard...
3	=> INFO: 🔒 Restoring rules from peer meta files...
4	=> INFO: 🔒 Rule 'guest' already applied to: 10.1.103.1
5	=> INFO: 🔒 Restored rule 'guest' for: guest-test (10.1.103.1)
6	=> INFO: 🔒 Rule 'guest' already applied to: 10.1.103.2
7	=> INFO: 🔒 Restored rule 'guest' for: guest-test2 (10.1.103.2)
8	=> INFO: 🔒 Rule 'guest' already applied to: 10.1.103.3
9	=> INFO: 🔒 Restored rule 'guest' for: guest-test3 (10.1.103.3)
10	=> INFO: 🔒 Rule 'user' already applied to: 10.1.2.1

nuno / firewall.module

0 лайк(-ов)

0 форк(-ов)

1 файл(-ов)

Последняя активность 2 months ago

1	function firewall::restore_blocks() {
2	local blocks_dir
3	blocks_dir="$(ctx::blocks)"
4
5	# Restore rules from meta files (new system)
6	rule::restore_all
7
8	# Restore per-client full-blocks (wgctl block/unblock system)
9	for block_file in "${blocks_dir}"/*.block; do
10	[[ -f "$block_file" ]] \|\| continue

nuno / gistfile1.txt

0 лайк(-ов)

0 форк(-ов)

1 файл(-ов)

Последняя активность 2 months ago

1	"function firewall::restore_blocks" /etc/wireguard/wgctl/modules/firewall.module.sh
2	function firewall::restore_blocks() {
3	local blocks_dir
4	blocks_dir="$(ctx::blocks)"
5
6	# Restore guest rules if marker exists
7	local marker="${blocks_dir}/_guest_rules.active"
8	if [[ -f "$marker" ]]; then
9	firewall::apply_guest_rules
10	log::wg "Restored guest firewall rules"