Moduletrace/wireguard-ui
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Iptables restrictions bugfix: #3: Restrict inter-host access

Browse Source
This commit is contained in:
tben
2026-09-27 16:07:55 +01:00
parent 5560567143
commit 3d0ef98385
1 changed files with 32 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/functions/backend/setup/build-host-iptables-scripts.ts
+32 -3
View File
@@ -127,12 +127,14 @@ function acceptLines({
source,
protocol,
ports,
host_wg_ip,
}: {
forward_chain: string;
input_chain: string;
source: string;
protocol?: string;
ports: string[];
host_wg_ip?: string;
}) {
const lines: string[] = [];
const protocols = protocolsForRule({
@@ -150,7 +152,7 @@ function acceptLines({
? portMatch({ ports: chunk })
: undefined;
// 1. FORWARD chain: Allows routed traffic (including Docker bridges/DNAT)
// FORWARD: Forwarded ports / Docker containers / WAN
lines.push(
joinArgs([
`iptables -A ${forward_chain}`,
@@ -161,16 +163,39 @@ function acceptLines({
]),
);
// 2. INPUT chain: Allows traffic bound directly for host OS services
// INPUT: Only allow matching requests bound for THIS interface's host IP
lines.push(
joinArgs([
`iptables -A ${input_chain}`,
`-s ${source}`,
host_wg_ip ? `-d ${host_wg_ip}` : undefined,
proto ? `-p ${proto}` : undefined,
port_match_str,
`-j ACCEPT`,
]),
);
// // 1. FORWARD chain: Allows routed traffic (including Docker bridges/DNAT)
// lines.push(
// joinArgs([
// `iptables -A ${forward_chain}`,
// `-s ${source}`,
// proto ? `-p ${proto}` : undefined,
// port_match_str,
// `-j ACCEPT`,
// ]),
// );
// // 2. INPUT chain: Allows traffic bound directly for host OS services
// lines.push(
// joinArgs([
// `iptables -A ${input_chain}`,
// `-s ${source}`,
// proto ? `-p ${proto}` : undefined,
// port_match_str,
// `-j ACCEPT`,
// ]),
// );
}
}
@@ -282,7 +307,10 @@ export default function buildHostIptablesScripts({
if (rule.rule_type == "all") {
accept_lines.push(
`iptables -A ${forward} -s ${source} -j ACCEPT`,
`iptables -A ${input} -s ${source} -j ACCEPT`,
// `iptables -A ${input} -s ${source} -j ACCEPT`,
scoped_subnet
? `iptables -A ${input} -s ${source} -d ${scoped_subnet} -j ACCEPT`
: `iptables -A ${input} -s ${source} -j ACCEPT`,
);
continue;
@@ -317,6 +345,7 @@ export default function buildHostIptablesScripts({
source,
protocol: rule.protocol || "any",
ports: parsed_ports.ports,
host_wg_ip: scoped_subnet,
}),
);
}