Polub 0
Zforkuj 0

Ostatnio aktywny 1 month ago

gistfile1.txt Surowy
1
2# ============================================
3# Rule Management
4# ============================================
5
6function fw::block_ip() {
7 local client_ip="$1" target_ip="$2"
8 fw::_forward_exists -s "$client_ip" -d "$target_ip" -j DROP \
9 || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j DROP
10
11 fw::_forward_exists -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
12 || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"
13}
14
15function fw::unblock_ip() {
16 local client_ip="$1" target_ip="$2"
17
18 fw::_forward_exists -s "$client_ip" -d "$target_ip" -j LOG --log-prefix "wgctl-dropped:" \
19 && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j LOG --log-prefix "wgctl-dropped: " --log-level 4 2>/dev/null || true
20
21 fw::_forward_exists -s "$client_ip" -d "$target_ip" -j DROP \
22 && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j DROP 2>/dev/null || true
23}
24
25function fw::block_port() {
26 local client_ip="$1" target_ip="$2" port="$3" proto="${4:-tcp}"
27
28 fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP \
29 || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP
30
31 fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
32 || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"
33}
34
35function fw::unblock_port() {
36 local client_ip="$1" target_ip="$2" port="$3" proto="${4:-tcp}"
37
38 fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP \
39 && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP 2>/dev/null || true
40}
41
42function fw::block_all() {
43 local client_ip="$1" client_name="$2"
44
45 iptables -A FORWARD -s "$client_ip" -j DROP
46
47 log::debug "Blocked all traffic from: ${client_ip}"
48}
49
50function fw::unblock_all() {
51 local client_ip="$1"
52
53 iptables -D FORWARD -s "$client_ip" -j DROP 2>/dev/null || true
54
55 monitor::unwatch "$client_ip"
56 log::debug "Unblocked all traffic from: ${client_ip}"
57}
58
59function fw::block_subnet() {
60 local client_ip="$1" target_subnet="$2"
61
62 fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j DROP \
63 || iptables -A FORWARD -s "$client_ip" -d "$target_subnet" -j DROP
64
65 fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
66 || iptables -A FORWARD -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"
67
68 log::wg_block "Blocked ${client_ip} → subnet ${target_subnet}"
69}
70
71function fw::unblock_subnet() {
72 local client_ip="$1" target_subnet="$2"
73
74 fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
75 && iptables -D FORWARD -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" 2>/dev/null || true
76
77 fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
78 && iptables -D FORWARD -s "$client_ip" -d "$target_subnet" -j DROP 2>/dev/null || true
79
80 log::wg_unblock "Unblocked ${client_ip} → subnet ${target_subnet}"
81}
82
83function fw::allow_ip() {
84 local client_ip="$1" target_ip="$2"
85
86 fw::_forward_exists -s "$client_ip" -d "$target_ip" -j ACCEPT \
87 || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j ACCEPT
88}
89
90function fw::unallow_ip() {
91 local client_ip="$1" target_ip="$2"
92
93 fw::_forward_exists -s "$client_ip" -d "$target_ip" -j ACCEPT \
94 && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j ACCEPT 2>/dev/null || true
95}
96
97function fw::allow_port() {
98 local client_ip="$1" target_ip="$2" port="$3" proto="${4:-tcp}"
99
100 fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT \
101 || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT
102}
103
104function fw::unallow_port() {
105 local client_ip="$1" target_ip="$2" port="$3" proto="${4:-tcp}"
106
107 fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT \
108 && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT 2>/dev/null || true
109}
110
111function fw::flush_peer() {
112 local client_ip="${1:?client_ip required}"
113 log::debug "flush_peer: starting for $client_ip"
114
115 # Collect line numbers into array
116 local linenums=()
117 while IFS= read -r linenum; do
118 [[ -n "$linenum" ]] && linenums+=("$linenum")
119 done < <(iptables -L FORWARD -n --line-numbers | grep -F "$client_ip" | awk '{print $1}')
120
121 # Delete in reverse order (highest number first)
122 local count=0
123 local i
124 for (( i=${#linenums[@]}-1; i>=0; i-- )); do
125 iptables -D FORWARD "${linenums[$i]}" 2>/dev/null || true
126 (( count++ )) || true
127 done
128
129 log::debug "flush_peer: removed $count FORWARD rules for: $client_ip"
130}

Obsługiwane przez Opengist ⋅ Load: 16ms⋅

Polski
⋅ KrilHub