Iptables hardening and dev server bind fix

2026-09-22 13:59:56 +01:00
parent 782727bc44
commit dc8700feaa
3 changed files with 122 additions and 14 deletions
@@ -128,7 +128,11 @@ export default function buildHostIptablesScripts({
    host_subnet,
    clients,
 }: Params) {
-    if (!Number.isInteger(host_id) || host_id < 0) {
+    if (
+        !Number.isSafeInteger(host_id) ||
+        host_id < 0 ||
+        host_id > 999999999
+    ) {
        return {
            success: false,
            msg: `Invalid host id`,
@@ -159,6 +163,10 @@ export default function buildHostIptablesScripts({
    }

    const { forward, input } = deriveIptablesChainNames({ host_id });
+
+    const masquerade_match = scoped_subnet
+        ? `-s ${scoped_subnet} -o ${target_interface}`
+        : `-o ${target_interface}`;
    const accept_lines: string[] = [];
    const host_clients = clients || [];

@@ -208,7 +216,6 @@ export default function buildHostIptablesScripts({
                if (scoped_subnet) {
                    accept_lines.push(
                        `iptables -A ${forward} -s ${source} -d ${scoped_subnet} -j ACCEPT`,
-                        `iptables -A ${forward} -s ${source} -o ${target_interface} -j ACCEPT`,
                        `iptables -A ${input} -s ${source} -j ACCEPT`,
                    );
                } else {
@@ -241,13 +248,6 @@ export default function buildHostIptablesScripts({
                    protocol: rule.protocol || "any",
                    ports: parsed_ports.ports,
                }),
-                ...acceptLines({
-                    chain: input,
-                    source,
-                    destination,
-                    protocol: rule.protocol || "any",
-                    ports: parsed_ports.ports,
-                }),
            );
        }
    }
@@ -280,7 +280,7 @@ export default function buildHostIptablesScripts({
        `iptables -C FORWARD -o ${interface_name} -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || iptables -I FORWARD 1 -o ${interface_name} -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT`,
        `iptables -C INPUT -i ${interface_name} -j ${input} 2>/dev/null || iptables -I INPUT 1 -i ${interface_name} -j ${input}`,
        ``,
-        `iptables -t nat -C POSTROUTING -o ${target_interface} -j MASQUERADE 2>/dev/null || iptables -t nat -A POSTROUTING -o ${target_interface} -j MASQUERADE`,
+        `iptables -t nat -C POSTROUTING ${masquerade_match} -j MASQUERADE 2>/dev/null || iptables -t nat -A POSTROUTING ${masquerade_match} -j MASQUERADE`,
        ``,
    ].join("\n");

@@ -298,7 +298,7 @@ export default function buildHostIptablesScripts({
        `iptables -X ${forward} 2>/dev/null || true`,
        `iptables -F ${input} 2>/dev/null || true`,
        `iptables -X ${input} 2>/dev/null || true`,
-        `iptables -t nat -D POSTROUTING -o ${target_interface} -j MASQUERADE 2>/dev/null || true`,
+        `iptables -t nat -D POSTROUTING ${masquerade_match} -j MASQUERADE 2>/dev/null || true`,
        ``,
    ].join("\n");