Подобається 0
Створити форк 0

Остання активність 1 month ago

nuno ревизій цього gist 1 month ago. До ревизії

1 file changed, 130 insertions

gistfile1.txt(файл створено)

@@ -0,0 +1,130 @@
1 +
2 + # ============================================
3 + # Rule Management
4 + # ============================================
5 +
6 + function fw::block_ip() {
7 + local client_ip="$1" target_ip="$2"
8 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -j DROP \
9 + || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j DROP
10 +
11 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
12 + || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"
13 + }
14 +
15 + function fw::unblock_ip() {
16 + local client_ip="$1" target_ip="$2"
17 +
18 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -j LOG --log-prefix "wgctl-dropped:" \
19 + && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j LOG --log-prefix "wgctl-dropped: " --log-level 4 2>/dev/null || true
20 +
21 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -j DROP \
22 + && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j DROP 2>/dev/null || true
23 + }
24 +
25 + function fw::block_port() {
26 + local client_ip="$1" target_ip="$2" port="$3" proto="${4:-tcp}"
27 +
28 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP \
29 + || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP
30 +
31 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
32 + || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"
33 + }
34 +
35 + function fw::unblock_port() {
36 + local client_ip="$1" target_ip="$2" port="$3" proto="${4:-tcp}"
37 +
38 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP \
39 + && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP 2>/dev/null || true
40 + }
41 +
42 + function fw::block_all() {
43 + local client_ip="$1" client_name="$2"
44 +
45 + iptables -A FORWARD -s "$client_ip" -j DROP
46 +
47 + log::debug "Blocked all traffic from: ${client_ip}"
48 + }
49 +
50 + function fw::unblock_all() {
51 + local client_ip="$1"
52 +
53 + iptables -D FORWARD -s "$client_ip" -j DROP 2>/dev/null || true
54 +
55 + monitor::unwatch "$client_ip"
56 + log::debug "Unblocked all traffic from: ${client_ip}"
57 + }
58 +
59 + function fw::block_subnet() {
60 + local client_ip="$1" target_subnet="$2"
61 +
62 + fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j DROP \
63 + || iptables -A FORWARD -s "$client_ip" -d "$target_subnet" -j DROP
64 +
65 + fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
66 + || iptables -A FORWARD -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"
67 +
68 + log::wg_block "Blocked ${client_ip} → subnet ${target_subnet}"
69 + }
70 +
71 + function fw::unblock_subnet() {
72 + local client_ip="$1" target_subnet="$2"
73 +
74 + fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
75 + && iptables -D FORWARD -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" 2>/dev/null || true
76 +
77 + fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
78 + && iptables -D FORWARD -s "$client_ip" -d "$target_subnet" -j DROP 2>/dev/null || true
79 +
80 + log::wg_unblock "Unblocked ${client_ip} → subnet ${target_subnet}"
81 + }
82 +
83 + function fw::allow_ip() {
84 + local client_ip="$1" target_ip="$2"
85 +
86 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -j ACCEPT \
87 + || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j ACCEPT
88 + }
89 +
90 + function fw::unallow_ip() {
91 + local client_ip="$1" target_ip="$2"
92 +
93 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -j ACCEPT \
94 + && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j ACCEPT 2>/dev/null || true
95 + }
96 +
97 + function fw::allow_port() {
98 + local client_ip="$1" target_ip="$2" port="$3" proto="${4:-tcp}"
99 +
100 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT \
101 + || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT
102 + }
103 +
104 + function fw::unallow_port() {
105 + local client_ip="$1" target_ip="$2" port="$3" proto="${4:-tcp}"
106 +
107 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT \
108 + && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT 2>/dev/null || true
109 + }
110 +
111 + function fw::flush_peer() {
112 + local client_ip="${1:?client_ip required}"
113 + log::debug "flush_peer: starting for $client_ip"
114 +
115 + # Collect line numbers into array
116 + local linenums=()
117 + while IFS= read -r linenum; do
118 + [[ -n "$linenum" ]] && linenums+=("$linenum")
119 + done < <(iptables -L FORWARD -n --line-numbers | grep -F "$client_ip" | awk '{print $1}')
120 +
121 + # Delete in reverse order (highest number first)
122 + local count=0
123 + local i
124 + for (( i=${#linenums[@]}-1; i>=0; i-- )); do
125 + iptables -D FORWARD "${linenums[$i]}" 2>/dev/null || true
126 + (( count++ )) || true
127 + done
128 +
129 + log::debug "flush_peer: removed $count FORWARD rules for: $client_ip"
130 + }
Новіше Пізніше

Працює на Opengist ⋅ Load: 8ms⋅

Українська
⋅ KrilHub