gistfile1.txt
· 2.5 KiB · Text
Surowy
sed -n '98,170p' /etc/wireguard/wgctl/modules/rule.module.sh
# ============================================
# Rule Application
# ============================================
function rule::apply() {
local rule_name="${1:?rule_name required}"
local client_ip="${2:?client_ip required}"
local peer_name="${3:-}"
rule::require_exists "$rule_name" || return 1
if [[ -z "$peer_name" ]]; then
peer_name=$(peers::find_by_ip "$client_ip")
fi
log::debug "rule::apply: peer_name=$peer_name ip=$client_ip"
# Check if already applied
if rule::is_applied "$rule_name" "$client_ip"; then
log::wg "Rule '${rule_name}' already applied to: ${client_ip}"
[[ -n "$peer_name" ]] && peers::set_meta "$peer_name" "rule" "$rule_name"
return 0
fi
# Process block_ips
while IFS= read -r block_ip; do
[[ -z "$block_ip" ]] && continue
fw::block_ip "$client_ip" "$block_ip"
done < <(rule::get "$rule_name" "block_ips")
# Process block_ports
while IFS= read -r entry; do
[[ -z "$entry" ]] && continue
local target port proto
IFS=":" read -r target port proto <<< "$entry"
proto="${proto:-tcp}"
fw::block_port "$client_ip" "$target" "$port" "$proto"
done < <(rule::get "$rule_name" "block_ports")
# Process allow_ips (inserted before blocks)
while IFS= read -r allow_ip; do
[[ -z "$allow_ip" ]] && continue
fw::allow_ip "$client_ip" "$allow_ip"
done < <(rule::get "$rule_name" "allow_ips")
# Process allow_ports (highest priority)
while IFS= read -r entry; do
[[ -z "$entry" ]] && continue
local target port proto
IFS=":" read -r target port proto <<< "$entry"
proto="${proto:-tcp}"
fw::allow_port "$client_ip" "$target" "$port" "$proto"
done < <(rule::get "$rule_name" "allow_ports")
# Persist rule assignment
[[ -n "$peer_name" ]] && peers::set_meta "$peer_name" "rule" "$rule_name"
# DNS redirect
local dns_redirect
dns_redirect=$(rule::get "$rule_name" "dns_redirect")
if [[ "$dns_redirect" == "true" ]]; then
local peer_subnet
peer_subnet=$(peers::get_ip "$peer_name" | cut -d'.' -f1-3)
if ! fw::_nat_exists -i wg0 -s "${peer_subnet}.0/24" \
-p udp --dport 53 -j DNAT \
--to-destination "$(config::dns):53" 2>/dev/null; then
rule::apply_dns_redirect "${peer_subnet}.0/24"
log::debug "dns_redirect: applied for ${peer_subnet}.0/24"
else
log::debug "dns_redirect: already applied for ${peer_subnet}.0/24"
fi
fi
root@wireguard:/etc/wireguard/wgctl#
| 1 | sed -n '98,170p' /etc/wireguard/wgctl/modules/rule.module.sh |
| 2 | |
| 3 | # ============================================ |
| 4 | # Rule Application |
| 5 | # ============================================ |
| 6 | |
| 7 | function rule::apply() { |
| 8 | local rule_name="${1:?rule_name required}" |
| 9 | local client_ip="${2:?client_ip required}" |
| 10 | local peer_name="${3:-}" |
| 11 | |
| 12 | rule::require_exists "$rule_name" || return 1 |
| 13 | |
| 14 | if [[ -z "$peer_name" ]]; then |
| 15 | peer_name=$(peers::find_by_ip "$client_ip") |
| 16 | fi |
| 17 | |
| 18 | log::debug "rule::apply: peer_name=$peer_name ip=$client_ip" |
| 19 | |
| 20 | # Check if already applied |
| 21 | if rule::is_applied "$rule_name" "$client_ip"; then |
| 22 | log::wg "Rule '${rule_name}' already applied to: ${client_ip}" |
| 23 | [[ -n "$peer_name" ]] && peers::set_meta "$peer_name" "rule" "$rule_name" |
| 24 | return 0 |
| 25 | fi |
| 26 | |
| 27 | # Process block_ips |
| 28 | while IFS= read -r block_ip; do |
| 29 | [[ -z "$block_ip" ]] && continue |
| 30 | fw::block_ip "$client_ip" "$block_ip" |
| 31 | done < <(rule::get "$rule_name" "block_ips") |
| 32 | |
| 33 | # Process block_ports |
| 34 | while IFS= read -r entry; do |
| 35 | [[ -z "$entry" ]] && continue |
| 36 | local target port proto |
| 37 | IFS=":" read -r target port proto <<< "$entry" |
| 38 | proto="${proto:-tcp}" |
| 39 | fw::block_port "$client_ip" "$target" "$port" "$proto" |
| 40 | done < <(rule::get "$rule_name" "block_ports") |
| 41 | |
| 42 | # Process allow_ips (inserted before blocks) |
| 43 | while IFS= read -r allow_ip; do |
| 44 | [[ -z "$allow_ip" ]] && continue |
| 45 | fw::allow_ip "$client_ip" "$allow_ip" |
| 46 | done < <(rule::get "$rule_name" "allow_ips") |
| 47 | |
| 48 | # Process allow_ports (highest priority) |
| 49 | while IFS= read -r entry; do |
| 50 | [[ -z "$entry" ]] && continue |
| 51 | local target port proto |
| 52 | IFS=":" read -r target port proto <<< "$entry" |
| 53 | proto="${proto:-tcp}" |
| 54 | fw::allow_port "$client_ip" "$target" "$port" "$proto" |
| 55 | done < <(rule::get "$rule_name" "allow_ports") |
| 56 | |
| 57 | # Persist rule assignment |
| 58 | [[ -n "$peer_name" ]] && peers::set_meta "$peer_name" "rule" "$rule_name" |
| 59 | |
| 60 | # DNS redirect |
| 61 | local dns_redirect |
| 62 | dns_redirect=$(rule::get "$rule_name" "dns_redirect") |
| 63 | if [[ "$dns_redirect" == "true" ]]; then |
| 64 | local peer_subnet |
| 65 | peer_subnet=$(peers::get_ip "$peer_name" | cut -d'.' -f1-3) |
| 66 | if ! fw::_nat_exists -i wg0 -s "${peer_subnet}.0/24" \ |
| 67 | -p udp --dport 53 -j DNAT \ |
| 68 | --to-destination "$(config::dns):53" 2>/dev/null; then |
| 69 | rule::apply_dns_redirect "${peer_subnet}.0/24" |
| 70 | log::debug "dns_redirect: applied for ${peer_subnet}.0/24" |
| 71 | else |
| 72 | log::debug "dns_redirect: already applied for ${peer_subnet}.0/24" |
| 73 | fi |
| 74 | fi |
| 75 | root@wireguard:/etc/wireguard/wgctl# |