Tetszik 0
Fork 0

Utoljára aktív 1 month ago

nuno gist felülvizsgálása 1 month ago. Revízióhoz ugrás

1 file changed, 212 insertions

gistfile1.txt(fájl létrehozva)

@@ -0,0 +1,212 @@
1 + function fw::block_ip() {
2 + local client_ip="${1:-}" target_ip="${2:-}"
3 +
4 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -j DROP \
5 + || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j DROP
6 +
7 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
8 + || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"
9 + }
10 +
11 + function fw::unblock_ip() {
12 + local client_ip="${1:-}" target_ip="${2:-}"
13 +
14 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
15 + && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" 2>/dev/null || true
16 +
17 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -j DROP \
18 + && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j DROP 2>/dev/null || true
19 + }
20 +
21 + function fw::block_port() {
22 + local client_ip="${1:-}" target_ip="${2:-}" port="${3:-}" proto="${4:-tcp}"
23 +
24 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP \
25 + || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP
26 +
27 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
28 + || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"
29 +
30 + }
31 +
32 + function fw::unblock_port() {
33 + local client_ip="${1:-}" target_ip="${2:-}" port="${3:-}" proto="${4:-tcp}"
34 +
35 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
36 + && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" 2>/dev/null || true
37 +
38 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP \
39 + && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP 2>/dev/null || true
40 + }
41 +
42 + function fw::block_all() {
43 + local client_ip="${1:-}" client_name="${2:-}"
44 +
45 + fw::_forward_exists -s "$client_ip" -j DROP \
46 + || iptables -A FORWARD -s "$client_ip" -j DROP
47 +
48 + log::debug "Blocked all traffic from: ${client_ip}"
49 + }
50 +
51 + function fw::unblock_all() {
52 + local client_ip="${1:-}"
53 +
54 + fw::_forward_exists -s "$client_ip" -j DROP \
55 + && iptables -D FORWARD -s "$client_ip" -j DROP 2>/dev/null || true
56 +
57 + monitor::unwatch "$client_ip"
58 + log::debug "Unblocked all traffic from: ${client_ip}"
59 + }
60 +
61 + function fw::block_subnet() {
62 + local client_ip="${1:-}" target_subnet="${2:-}"
63 +
64 + fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
65 + || iptables -A FORWARD -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"
66 +
67 + fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j DROP \
68 + || iptables -A FORWARD -s "$client_ip" -d "$target_subnet" -j DROP
69 +
70 + log::wg_block "Blocked ${client_ip} → subnet ${target_subnet}"
71 + }
72 +
73 + function fw::unblock_subnet() {
74 + local client_ip="${1:-}" target_subnet="${2:-}"
75 +
76 + fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
77 + && iptables -D FORWARD -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" 2>/dev/null || true
78 +
79 + fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j DROP \
80 + && iptables -D FORWARD -s "$client_ip" -d "$target_subnet" -j DROP 2>/dev/null || true
81 +
82 + log::wg_unblock "Unblocked ${client_ip} → subnet ${target_subnet}"
83 + }
84 +
85 + function fw::allow_subnet() {
86 + local client_ip="${1:-}" target_subnet="${2:-}"
87 +
88 + fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j ACCEPT \
89 + || iptables -I FORWARD 1 -s "$client_ip" -d "$target_subnet" -j ACCEPT
90 + }
91 +
92 + function fw::unallow_subnet() {
93 + local client_ip="${1:-}" target_subnet="${2:-}"
94 +
95 + fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j ACCEPT \
96 + && iptables -D FORWARD -s "$client_ip" -d "$target_subnet" -j ACCEPT 2>/dev/null || true
97 + }
98 +
99 + function fw::allow_ip() {
100 + local client_ip="${1:-}" target_ip="${2:-}"
101 +
102 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -j ACCEPT \
103 + || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j ACCEPT
104 + }
105 +
106 + function fw::unallow_ip() {
107 + local client_ip="${1:-}" target_ip="${2:-}"
108 +
109 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -j ACCEPT \
110 + && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j ACCEPT 2>/dev/null || true
111 + }
112 +
113 + function fw::allow_port() {
114 + local client_ip="${1:-}" target_ip="${2:-}" port="${3:-}" proto="${4:-tcp}"
115 +
116 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT \
117 + || iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT
118 + }
119 +
120 + function fw::unallow_port() {
121 + local client_ip="${1:-}" target_ip="${2:-}" port="${3:-}" proto="${4:-tcp}"
122 +
123 + fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT \
124 + && iptables -D FORWARD -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT 2>/dev/null || true
125 + }
126 +
127 + function fw::flush_peer() {
128 + local client_ip="${1:?client_ip required}"
129 + log::debug "flush_peer: starting for $client_ip"
130 +
131 + # Collect line numbers into array
132 + local linenums=()
133 + while IFS= read -r linenum; do
134 + [[ -n "$linenum" ]] && linenums+=("$linenum")
135 + done < <(iptables -L FORWARD -n --line-numbers | grep -F "$client_ip" | awk '{print $1}')
136 +
137 + # Delete in reverse order (highest number first)
138 + local count=0
139 + local i
140 + for (( i=${#linenums[@]}-1; i>=0; i-- )); do
141 + iptables -D FORWARD "${linenums[$i]}" 2>/dev/null || true
142 + (( count++ )) || true
143 + done
144 +
145 + log::debug "flush_peer: removed $count FORWARD rules for: $client_ip"
146 + }
147 +
148 + function fw::apply_dns_redirect() {
149 + if iptables -t nat -C PREROUTING -s "$(config::subnet_for guest).0/24" -p udp --dport 53 -j DNAT --to-destination "$(config::dns):53" 2>/dev/null; then
150 + log::wg "Guest DNS redirect already applied"
151 + return 0
152 + fi
153 +
154 + local guest_subnet dns
155 + guest_subnet="$(config::subnet_for "guest").0/24"
156 + dns="$(config::dns)"
157 +
158 + # Log DNS bypass attempts (queries not directed at Pi-hole)
159 + iptables -t nat -A PREROUTING -s "$guest_subnet" -p udp --dport 53 \
160 + ! -d "$dns" \
161 + -j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4
162 + iptables -t nat -A PREROUTING -s "$guest_subnet" -p tcp --dport 53 \
163 + ! -d "$dns" \
164 + -j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4
165 +
166 + # Redirect all DNS to Pi-hole
167 + iptables -t nat -A PREROUTING -s "$guest_subnet" -p udp --dport 53 -j DNAT --to-destination "${dns}:53"
168 + iptables -t nat -A PREROUTING -s "$guest_subnet" -p tcp --dport 53 -j DNAT --to-destination "${dns}:53"
169 +
170 + log::wg_block "Guest DNS redirected to Pi-hole (${dns}), bypass attempts will be logged"
171 + }
172 +
173 + function fw::remove_dns_redirect() {
174 + local guest_subnet dns
175 + guest_subnet="$(config::subnet_for "guest").0/24"
176 + dns="$(config::dns)"
177 +
178 + iptables -t nat -D PREROUTING -s "$guest_subnet" -p udp --dport 53 \
179 + ! -d "$dns" \
180 + -j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4 2>/dev/null || true
181 + iptables -t nat -D PREROUTING -s "$guest_subnet" -p tcp --dport 53 \
182 + ! -d "$dns" \
183 + -j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4 2>/dev/null || true
184 + iptables -t nat -D PREROUTING -s "$guest_subnet" -p udp --dport 53 -j DNAT --to-destination "${dns}:53" 2>/dev/null || true
185 + iptables -t nat -D PREROUTING -s "$guest_subnet" -p tcp --dport 53 -j DNAT --to-destination "${dns}:53" 2>/dev/null || true
186 +
187 + log::debug "Removed guest DNS redirect"
188 + }
189 + function fw::nat_add_dns_redirect() {
190 + local subnet="${1:-}" dns="${2:-}" interface="${3:-wg0}"
191 + iptables -t nat -A PREROUTING -i "$interface" -s "$subnet" \
192 + -p udp --dport 53 ! -d "$dns" \
193 + -j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4
194 + iptables -t nat -A PREROUTING -i "$interface" -s "$subnet" \
195 + -p udp --dport 53 -j DNAT --to-destination "${dns}:53"
196 + iptables -t nat -A PREROUTING -i "$interface" -s "$subnet" \
197 + -p tcp --dport 53 -j DNAT --to-destination "${dns}:53"
198 + }
199 +
200 + function fw::nat_remove_dns_redirect() {
201 + local subnet="${1:-}" dns="${2:-}" interface="${3:-wg0}"
202 + iptables -t nat -D PREROUTING -i "$interface" -s "$subnet" \
203 + -p udp --dport 53 ! -d "$dns" \
204 + -j LOG --log-prefix "wgctl-dns-redirect: " \
205 + --log-level 4 2>/dev/null || true
206 + iptables -t nat -D PREROUTING -i "$interface" -s "$subnet" \
207 + -p udp --dport 53 -j DNAT \
208 + --to-destination "${dns}:53" 2>/dev/null || true
209 + iptables -t nat -D PREROUTING -i "$interface" -s "$subnet" \
210 + -p tcp --dport 53 -j DNAT \
211 + --to-destination "${dns}:53" 2>/dev/null || true
212 + }
Újabb Régebbi

Ez az oldal Opengist alapú ⋅ Load: 11ms⋅

Magyar
⋅ KrilHub