Rewizja gistfile1.txt - KrilHub Gist

1

+

function fw::block_ip() {

2

+

local client_ip="${1:-}" target_ip="${2:-}"

3

+

4

+

fw::_forward_exists -s "$client_ip" -d "$target_ip" -j DROP \

5

+

|| iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j DROP

6

+

7

+

fw::_forward_exists -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \

8

+

|| iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"

9

+

}

10

+

11

+

function fw::unblock_ip() {

12

+

local client_ip="${1:-}" target_ip="${2:-}"

13

+

14

+

fw::_forward_exists -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \

15

+

&& iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" 2>/dev/null || true

16

+

17

+

fw::_forward_exists -s "$client_ip" -d "$target_ip" -j DROP \

18

+

&& iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j DROP 2>/dev/null || true

19

+

}

20

+

21

+

function fw::block_port() {

22

+

local client_ip="${1:-}" target_ip="${2:-}" port="${3:-}" proto="${4:-tcp}"

23

+

24

+

fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP \

25

+

|| iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP

26

+

27

+

fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \

28

+

|| iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"

29

+

30

+

}

31

+

32

+

function fw::unblock_port() {

33

+

local client_ip="${1:-}" target_ip="${2:-}" port="${3:-}" proto="${4:-tcp}"

34

+

35

+

fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \

36

+

&& iptables -D FORWARD -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" 2>/dev/null || true

37

+

38

+

fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP \

39

+

&& iptables -D FORWARD -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP 2>/dev/null || true

40

+

}

41

+

42

+

function fw::block_all() {

43

+

local client_ip="${1:-}" client_name="${2:-}"

44

+

45

+

fw::_forward_exists -s "$client_ip" -j DROP \

46

+

|| iptables -A FORWARD -s "$client_ip" -j DROP

47

+

48

+

log::debug "Blocked all traffic from: ${client_ip}"

49

+

}

50

+

51

+

function fw::unblock_all() {

52

+

local client_ip="${1:-}"

53

+

54

+

fw::_forward_exists -s "$client_ip" -j DROP \

55

+

&& iptables -D FORWARD -s "$client_ip" -j DROP 2>/dev/null || true

56

+

57

+

monitor::unwatch "$client_ip"

58

+

log::debug "Unblocked all traffic from: ${client_ip}"

59

+

}

60

+

61

+

function fw::block_subnet() {

62

+

local client_ip="${1:-}" target_subnet="${2:-}"

63

+

64

+

fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \

65

+

|| iptables -A FORWARD -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"

66

+

67

+

fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j DROP \

68

+

|| iptables -A FORWARD -s "$client_ip" -d "$target_subnet" -j DROP

69

+

70

+

log::wg_block "Blocked ${client_ip} → subnet ${target_subnet}"

71

+

}

72

+

73

+

function fw::unblock_subnet() {

74

+

local client_ip="${1:-}" target_subnet="${2:-}"

75

+

76

+

fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \

77

+

&& iptables -D FORWARD -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" 2>/dev/null || true

78

+

79

+

fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j DROP \

80

+

&& iptables -D FORWARD -s "$client_ip" -d "$target_subnet" -j DROP 2>/dev/null || true

81

+

82

+

log::wg_unblock "Unblocked ${client_ip} → subnet ${target_subnet}"

83

+

}

84

+

85

+

function fw::allow_subnet() {

86

+

local client_ip="${1:-}" target_subnet="${2:-}"

87

+

88

+

fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j ACCEPT \

89

+

|| iptables -I FORWARD 1 -s "$client_ip" -d "$target_subnet" -j ACCEPT

90

+

}

91

+

92

+

function fw::unallow_subnet() {

93

+

local client_ip="${1:-}" target_subnet="${2:-}"

94

+

95

+

fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j ACCEPT \

96

+

&& iptables -D FORWARD -s "$client_ip" -d "$target_subnet" -j ACCEPT 2>/dev/null || true

97

+

}

98

+

99

+

function fw::allow_ip() {

100

+

local client_ip="${1:-}" target_ip="${2:-}"

101

+

102

+

fw::_forward_exists -s "$client_ip" -d "$target_ip" -j ACCEPT \

103

+

|| iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j ACCEPT

104

+

}

105

+

106

+

function fw::unallow_ip() {

107

+

local client_ip="${1:-}" target_ip="${2:-}"

108

+

109

+

fw::_forward_exists -s "$client_ip" -d "$target_ip" -j ACCEPT \

110

+

&& iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j ACCEPT 2>/dev/null || true

111

+

}

112

+

113

+

function fw::allow_port() {

114

+

local client_ip="${1:-}" target_ip="${2:-}" port="${3:-}" proto="${4:-tcp}"

115

+

116

+

fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT \

117

+

|| iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT

118

+

}

119

+

120

+

function fw::unallow_port() {

121

+

local client_ip="${1:-}" target_ip="${2:-}" port="${3:-}" proto="${4:-tcp}"

122

+

123

+

fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT \

124

+

&& iptables -D FORWARD -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT 2>/dev/null || true

125

+

}

126

+

127

+

function fw::flush_peer() {

128

+

local client_ip="${1:?client_ip required}"

129

+

log::debug "flush_peer: starting for $client_ip"

130

+

131

+

# Collect line numbers into array

132

+

local linenums=()

133

+

while IFS= read -r linenum; do

134

+

[[ -n "$linenum" ]] && linenums+=("$linenum")

135

+

done < <(iptables -L FORWARD -n --line-numbers | grep -F "$client_ip" | awk '{print $1}')

136

+

137

+

# Delete in reverse order (highest number first)

138

+

local count=0

139

+

local i

140

+

for (( i=${#linenums[@]}-1; i>=0; i-- )); do

141

+

iptables -D FORWARD "${linenums[$i]}" 2>/dev/null || true

142

+

(( count++ )) || true

143

+

done

144

+

145

+

log::debug "flush_peer: removed $count FORWARD rules for: $client_ip"

146

+

}

147

+

148

+

function fw::apply_dns_redirect() {

149

+

if iptables -t nat -C PREROUTING -s "$(config::subnet_for guest).0/24" -p udp --dport 53 -j DNAT --to-destination "$(config::dns):53" 2>/dev/null; then

150

+

log::wg "Guest DNS redirect already applied"

151

+

return 0

152

+

fi

153

+

154

+

local guest_subnet dns

155

+

guest_subnet="$(config::subnet_for "guest").0/24"

156

+

dns="$(config::dns)"

157

+

158

+

# Log DNS bypass attempts (queries not directed at Pi-hole)

159

+

iptables -t nat -A PREROUTING -s "$guest_subnet" -p udp --dport 53 \

160

+

! -d "$dns" \

161

+

-j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4

162

+

iptables -t nat -A PREROUTING -s "$guest_subnet" -p tcp --dport 53 \

163

+

! -d "$dns" \

164

+

-j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4

165

+

166

+

# Redirect all DNS to Pi-hole

167

+

iptables -t nat -A PREROUTING -s "$guest_subnet" -p udp --dport 53 -j DNAT --to-destination "${dns}:53"

168

+

iptables -t nat -A PREROUTING -s "$guest_subnet" -p tcp --dport 53 -j DNAT --to-destination "${dns}:53"

169

+

170

+

log::wg_block "Guest DNS redirected to Pi-hole (${dns}), bypass attempts will be logged"

171

+

}

172

+

173

+

function fw::remove_dns_redirect() {

174

+

local guest_subnet dns

175

+

guest_subnet="$(config::subnet_for "guest").0/24"

176

+

dns="$(config::dns)"

177

+

178

+

iptables -t nat -D PREROUTING -s "$guest_subnet" -p udp --dport 53 \

179

+

! -d "$dns" \

180

+

-j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4 2>/dev/null || true

181

+

iptables -t nat -D PREROUTING -s "$guest_subnet" -p tcp --dport 53 \

182

+

! -d "$dns" \

183

+

-j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4 2>/dev/null || true

184

+

iptables -t nat -D PREROUTING -s "$guest_subnet" -p udp --dport 53 -j DNAT --to-destination "${dns}:53" 2>/dev/null || true

185

+

iptables -t nat -D PREROUTING -s "$guest_subnet" -p tcp --dport 53 -j DNAT --to-destination "${dns}:53" 2>/dev/null || true

186

+

187

+

log::debug "Removed guest DNS redirect"

188

+

}

189

+

function fw::nat_add_dns_redirect() {

190

+

local subnet="${1:-}" dns="${2:-}" interface="${3:-wg0}"

191

+

iptables -t nat -A PREROUTING -i "$interface" -s "$subnet" \

192

+

-p udp --dport 53 ! -d "$dns" \

193

+

-j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4

194

+

iptables -t nat -A PREROUTING -i "$interface" -s "$subnet" \

195

+

-p udp --dport 53 -j DNAT --to-destination "${dns}:53"

196

+

iptables -t nat -A PREROUTING -i "$interface" -s "$subnet" \

197

+

-p tcp --dport 53 -j DNAT --to-destination "${dns}:53"

198

+

}

199

+

200

+

function fw::nat_remove_dns_redirect() {

201

+

local subnet="${1:-}" dns="${2:-}" interface="${3:-wg0}"

202

+

iptables -t nat -D PREROUTING -i "$interface" -s "$subnet" \

203

+

-p udp --dport 53 ! -d "$dns" \

204

+

-j LOG --log-prefix "wgctl-dns-redirect: " \

205

+

--log-level 4 2>/dev/null || true

206

+

iptables -t nat -D PREROUTING -i "$interface" -s "$subnet" \

207

+

-p udp --dport 53 -j DNAT \

208

+

--to-destination "${dns}:53" 2>/dev/null || true

209

+

iptables -t nat -D PREROUTING -i "$interface" -s "$subnet" \

210

+

-p tcp --dport 53 -j DNAT \

211

+

--to-destination "${dns}:53" 2>/dev/null || true

212

+

}

nuno / gistfile1.txt

nuno zrewidował ten Gist 1 month ago. Przejdź do rewizji

		@@ -0,0 +1,212 @@
1	+	function fw::block_ip() {
2	+	local client_ip="${1:-}" target_ip="${2:-}"
3	+
4	+	fw::_forward_exists -s "$client_ip" -d "$target_ip" -j DROP \
5	+	\|\| iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j DROP
6	+
7	+	fw::_forward_exists -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
8	+	\|\| iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"
9	+	}
10	+
11	+	function fw::unblock_ip() {
12	+	local client_ip="${1:-}" target_ip="${2:-}"
13	+
14	+	fw::_forward_exists -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
15	+	&& iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" 2>/dev/null \|\| true
16	+
17	+	fw::_forward_exists -s "$client_ip" -d "$target_ip" -j DROP \
18	+	&& iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j DROP 2>/dev/null \|\| true
19	+	}
20	+
21	+	function fw::block_port() {
22	+	local client_ip="${1:-}" target_ip="${2:-}" port="${3:-}" proto="${4:-tcp}"
23	+
24	+	fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP \
25	+	\|\| iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP
26	+
27	+	fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
28	+	\|\| iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"
29	+
30	+	}
31	+
32	+	function fw::unblock_port() {
33	+	local client_ip="${1:-}" target_ip="${2:-}" port="${3:-}" proto="${4:-tcp}"
34	+
35	+	fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
36	+	&& iptables -D FORWARD -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" 2>/dev/null \|\| true
37	+
38	+	fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP \
39	+	&& iptables -D FORWARD -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j DROP 2>/dev/null \|\| true
40	+	}
41	+
42	+	function fw::block_all() {
43	+	local client_ip="${1:-}" client_name="${2:-}"
44	+
45	+	fw::_forward_exists -s "$client_ip" -j DROP \
46	+	\|\| iptables -A FORWARD -s "$client_ip" -j DROP
47	+
48	+	log::debug "Blocked all traffic from: ${client_ip}"
49	+	}
50	+
51	+	function fw::unblock_all() {
52	+	local client_ip="${1:-}"
53	+
54	+	fw::_forward_exists -s "$client_ip" -j DROP \
55	+	&& iptables -D FORWARD -s "$client_ip" -j DROP 2>/dev/null \|\| true
56	+
57	+	monitor::unwatch "$client_ip"
58	+	log::debug "Unblocked all traffic from: ${client_ip}"
59	+	}
60	+
61	+	function fw::block_subnet() {
62	+	local client_ip="${1:-}" target_subnet="${2:-}"
63	+
64	+	fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
65	+	\|\| iptables -A FORWARD -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:"
66	+
67	+	fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j DROP \
68	+	\|\| iptables -A FORWARD -s "$client_ip" -d "$target_subnet" -j DROP
69	+
70	+	log::wg_block "Blocked ${client_ip} → subnet ${target_subnet}"
71	+	}
72	+
73	+	function fw::unblock_subnet() {
74	+	local client_ip="${1:-}" target_subnet="${2:-}"
75	+
76	+	fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" \
77	+	&& iptables -D FORWARD -s "$client_ip" -d "$target_subnet" -j NFLOG --nflog-group 1 --nflog-prefix "wgctl-drop:" 2>/dev/null \|\| true
78	+
79	+	fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j DROP \
80	+	&& iptables -D FORWARD -s "$client_ip" -d "$target_subnet" -j DROP 2>/dev/null \|\| true
81	+
82	+	log::wg_unblock "Unblocked ${client_ip} → subnet ${target_subnet}"
83	+	}
84	+
85	+	function fw::allow_subnet() {
86	+	local client_ip="${1:-}" target_subnet="${2:-}"
87	+
88	+	fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j ACCEPT \
89	+	\|\| iptables -I FORWARD 1 -s "$client_ip" -d "$target_subnet" -j ACCEPT
90	+	}
91	+
92	+	function fw::unallow_subnet() {
93	+	local client_ip="${1:-}" target_subnet="${2:-}"
94	+
95	+	fw::_forward_exists -s "$client_ip" -d "$target_subnet" -j ACCEPT \
96	+	&& iptables -D FORWARD -s "$client_ip" -d "$target_subnet" -j ACCEPT 2>/dev/null \|\| true
97	+	}
98	+
99	+	function fw::allow_ip() {
100	+	local client_ip="${1:-}" target_ip="${2:-}"
101	+
102	+	fw::_forward_exists -s "$client_ip" -d "$target_ip" -j ACCEPT \
103	+	\|\| iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -j ACCEPT
104	+	}
105	+
106	+	function fw::unallow_ip() {
107	+	local client_ip="${1:-}" target_ip="${2:-}"
108	+
109	+	fw::_forward_exists -s "$client_ip" -d "$target_ip" -j ACCEPT \
110	+	&& iptables -D FORWARD -s "$client_ip" -d "$target_ip" -j ACCEPT 2>/dev/null \|\| true
111	+	}
112	+
113	+	function fw::allow_port() {
114	+	local client_ip="${1:-}" target_ip="${2:-}" port="${3:-}" proto="${4:-tcp}"
115	+
116	+	fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT \
117	+	\|\| iptables -I FORWARD 1 -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT
118	+	}
119	+
120	+	function fw::unallow_port() {
121	+	local client_ip="${1:-}" target_ip="${2:-}" port="${3:-}" proto="${4:-tcp}"
122	+
123	+	fw::_forward_exists -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT \
124	+	&& iptables -D FORWARD -s "$client_ip" -d "$target_ip" -p "$proto" --dport "$port" -j ACCEPT 2>/dev/null \|\| true
125	+	}
126	+
127	+	function fw::flush_peer() {
128	+	local client_ip="${1:?client_ip required}"
129	+	log::debug "flush_peer: starting for $client_ip"
130	+
131	+	# Collect line numbers into array
132	+	local linenums=()
133	+	while IFS= read -r linenum; do
134	+	[[ -n "$linenum" ]] && linenums+=("$linenum")
135	+	done < <(iptables -L FORWARD -n --line-numbers \| grep -F "$client_ip" \| awk '{print $1}')
136	+
137	+	# Delete in reverse order (highest number first)
138	+	local count=0
139	+	local i
140	+	for (( i=${#linenums[@]}-1; i>=0; i-- )); do
141	+	iptables -D FORWARD "${linenums[$i]}" 2>/dev/null \|\| true
142	+	(( count++ )) \|\| true
143	+	done
144	+
145	+	log::debug "flush_peer: removed $count FORWARD rules for: $client_ip"
146	+	}
147	+
148	+	function fw::apply_dns_redirect() {
149	+	if iptables -t nat -C PREROUTING -s "$(config::subnet_for guest).0/24" -p udp --dport 53 -j DNAT --to-destination "$(config::dns):53" 2>/dev/null; then
150	+	log::wg "Guest DNS redirect already applied"
151	+	return 0
152	+	fi
153	+
154	+	local guest_subnet dns
155	+	guest_subnet="$(config::subnet_for "guest").0/24"
156	+	dns="$(config::dns)"
157	+
158	+	# Log DNS bypass attempts (queries not directed at Pi-hole)
159	+	iptables -t nat -A PREROUTING -s "$guest_subnet" -p udp --dport 53 \
160	+	! -d "$dns" \
161	+	-j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4
162	+	iptables -t nat -A PREROUTING -s "$guest_subnet" -p tcp --dport 53 \
163	+	! -d "$dns" \
164	+	-j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4
165	+
166	+	# Redirect all DNS to Pi-hole
167	+	iptables -t nat -A PREROUTING -s "$guest_subnet" -p udp --dport 53 -j DNAT --to-destination "${dns}:53"
168	+	iptables -t nat -A PREROUTING -s "$guest_subnet" -p tcp --dport 53 -j DNAT --to-destination "${dns}:53"
169	+
170	+	log::wg_block "Guest DNS redirected to Pi-hole (${dns}), bypass attempts will be logged"
171	+	}
172	+
173	+	function fw::remove_dns_redirect() {
174	+	local guest_subnet dns
175	+	guest_subnet="$(config::subnet_for "guest").0/24"
176	+	dns="$(config::dns)"
177	+
178	+	iptables -t nat -D PREROUTING -s "$guest_subnet" -p udp --dport 53 \
179	+	! -d "$dns" \
180	+	-j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4 2>/dev/null \|\| true
181	+	iptables -t nat -D PREROUTING -s "$guest_subnet" -p tcp --dport 53 \
182	+	! -d "$dns" \
183	+	-j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4 2>/dev/null \|\| true
184	+	iptables -t nat -D PREROUTING -s "$guest_subnet" -p udp --dport 53 -j DNAT --to-destination "${dns}:53" 2>/dev/null \|\| true
185	+	iptables -t nat -D PREROUTING -s "$guest_subnet" -p tcp --dport 53 -j DNAT --to-destination "${dns}:53" 2>/dev/null \|\| true
186	+
187	+	log::debug "Removed guest DNS redirect"
188	+	}
189	+	function fw::nat_add_dns_redirect() {
190	+	local subnet="${1:-}" dns="${2:-}" interface="${3:-wg0}"
191	+	iptables -t nat -A PREROUTING -i "$interface" -s "$subnet" \
192	+	-p udp --dport 53 ! -d "$dns" \
193	+	-j LOG --log-prefix "wgctl-dns-redirect: " --log-level 4
194	+	iptables -t nat -A PREROUTING -i "$interface" -s "$subnet" \
195	+	-p udp --dport 53 -j DNAT --to-destination "${dns}:53"
196	+	iptables -t nat -A PREROUTING -i "$interface" -s "$subnet" \
197	+	-p tcp --dport 53 -j DNAT --to-destination "${dns}:53"
198	+	}
199	+
200	+	function fw::nat_remove_dns_redirect() {
201	+	local subnet="${1:-}" dns="${2:-}" interface="${3:-wg0}"
202	+	iptables -t nat -D PREROUTING -i "$interface" -s "$subnet" \
203	+	-p udp --dport 53 ! -d "$dns" \
204	+	-j LOG --log-prefix "wgctl-dns-redirect: " \
205	+	--log-level 4 2>/dev/null \|\| true
206	+	iptables -t nat -D PREROUTING -i "$interface" -s "$subnet" \
207	+	-p udp --dport 53 -j DNAT \
208	+	--to-destination "${dns}:53" 2>/dev/null \|\| true
209	+	iptables -t nat -D PREROUTING -i "$interface" -s "$subnet" \
210	+	-p tcp --dport 53 -j DNAT \
211	+	--to-destination "${dns}:53" 2>/dev/null \|\| true
212	+	}