Moduletrace/wireguard-ui
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Iptables restrictions bugfix: #1

Browse Source
This commit is contained in:
tben
2026-09-27 15:40:05 +01:00
parent dbae73a746
commit 65b321f73b
1 changed files with 98 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/functions/backend/setup/build-host-iptables-scripts.ts
+94 -25
View File
@@ -79,16 +79,58 @@ function chunkPorts({ ports }: { ports: string[] }) {
return chunks;
}
// function acceptLines({
// chain,
// source,
// destination,
// protocol,
// ports,
// }: {
// chain: string;
// source: string;
// destination?: string;
// protocol?: string;
// ports: string[];
// }) {
// const lines: string[] = [];
// const protocols = protocolsForRule({
// protocol,
// has_ports: Boolean(ports[0]),
// });
// const port_chunks = ports[0] ? chunkPorts({ ports }) : [[]];
// for (let p = 0; p < protocols.length; p++) {
// const proto = protocols[p];
// for (let c = 0; c < port_chunks.length; c++) {
// const chunk = port_chunks[c] || [];
// lines.push(
// joinArgs([
// `iptables -A ${chain}`,
// `-s ${source}`,
// destination ? `-d ${destination}` : undefined,
// proto ? `-p ${proto}` : undefined,
// proto ? portMatch({ ports: chunk }) : undefined,
// `-j ACCEPT`,
// ]),
// );
// }
// }
// return lines;
// }
function acceptLines({
chain,
forward_chain,
input_chain,
source,
destination,
protocol,
ports,
}: {
chain: string;
forward_chain: string;
input_chain: string;
source: string;
destination?: string;
protocol?: string;
ports: string[];
}) {
@@ -104,14 +146,28 @@ function acceptLines({
for (let c = 0; c < port_chunks.length; c++) {
const chunk = port_chunks[c] || [];
const port_match_str = proto
? portMatch({ ports: chunk })
: undefined;
// 1. FORWARD chain: Allows routed traffic (including Docker bridges/DNAT)
lines.push(
joinArgs([
`iptables -A ${chain}`,
`iptables -A ${forward_chain}`,
`-s ${source}`,
destination ? `-d ${destination}` : undefined,
proto ? `-p ${proto}` : undefined,
proto ? portMatch({ ports: chunk }) : undefined,
port_match_str,
`-j ACCEPT`,
]),
);
// 2. INPUT chain: Allows traffic bound directly for host OS services
lines.push(
joinArgs([
`iptables -A ${input_chain}`,
`-s ${source}`,
proto ? `-p ${proto}` : undefined,
port_match_str,
`-j ACCEPT`,
]),
);
@@ -128,11 +184,7 @@ export default function buildHostIptablesScripts({
host_subnet,
clients,
}: Params) {
if (
!Number.isSafeInteger(host_id) ||
host_id < 0 ||
host_id > 999999999
) {
if (!Number.isSafeInteger(host_id) || host_id < 0 || host_id > 999999999) {
return {
success: false,
msg: `Invalid host id`,
@@ -164,9 +216,7 @@ export default function buildHostIptablesScripts({
const { forward, input } = deriveIptablesChainNames({ host_id });
const masquerade_match = scoped_subnet
? `-s ${scoped_subnet} -o ${target_interface}`
: `-o ${target_interface}`;
const masquerade_match = scoped_subnet ? `-s ${scoped_subnet} ` : ``;
const accept_lines: string[] = [];
const host_clients = clients || [];
@@ -212,19 +262,28 @@ export default function buildHostIptablesScripts({
};
}
// if (rule.rule_type == "all") {
// if (scoped_subnet) {
// accept_lines.push(
// `iptables -A ${forward} -s ${source} -d ${scoped_subnet} -j ACCEPT`,
// `iptables -A ${forward} -s ${source} -o ${target_interface} -j ACCEPT`,
// `iptables -A ${input} -s ${source} -j ACCEPT`,
// );
// } else {
// accept_lines.push(
// `iptables -A ${forward} -s ${source} -j ACCEPT`,
// `iptables -A ${input} -s ${source} -j ACCEPT`,
// );
// }
// continue;
// }
if (rule.rule_type == "all") {
if (scoped_subnet) {
accept_lines.push(
`iptables -A ${forward} -s ${source} -d ${scoped_subnet} -j ACCEPT`,
`iptables -A ${forward} -s ${source} -o ${target_interface} -j ACCEPT`,
`iptables -A ${input} -s ${source} -j ACCEPT`,
);
} else {
accept_lines.push(
`iptables -A ${forward} -s ${source} -j ACCEPT`,
`iptables -A ${input} -s ${source} -j ACCEPT`,
);
}
continue;
}
@@ -241,11 +300,21 @@ export default function buildHostIptablesScripts({
};
}
// accept_lines.push(
// ...acceptLines({
// chain: forward,
// source,
// destination,
// protocol: rule.protocol || "any",
// ports: parsed_ports.ports,
// }),
// );
accept_lines.push(
...acceptLines({
chain: forward,
forward_chain: forward,
input_chain: input,
source,
destination,
protocol: rule.protocol || "any",
ports: parsed_ports.ports,
}),