andre/tunnler
1
0
Fork 0
mirror of https://github.com/Andre-Bzk/tunnler.git synced 2026-11-15 18:36:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

git init

Browse Source
This commit is contained in:
Andre
2026-10-22 21:00:05 +02:00
commit 9c278f49b6
20 changed files with 909 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/firewall/tunnler-firewall.sh
+27
View File
@@ -0,0 +1,27 @@
#!/bin/sh
# Trennt den wstunnel-Container (feste IP, TUNNEL_IP aus /etc/default/tunnler-firewall) vom Heimnetz
# und vom Pi selbst. Hostnamen, die per oeffentlichem DNS auf private IPs zeigen
# (z. B. 192-168-0-1.nip.io), kann wstunnel selbst nicht abfangen.
# tunnler-firewall.sh Regeln setzen (idempotent)
# tunnler-firewall.sh --remove Regeln entfernen
set -e
SRC=${TUNNEL_IP:-172.20.250.250}
for chain in DOCKER-USER INPUT; do
while iptables -D "$chain" -s "$SRC" -j TUNNLER 2>/dev/null; do :; done
done
if [ "$1" = "--remove" ]; then
iptables -F TUNNLER 2>/dev/null || true
iptables -X TUNNLER 2>/dev/null || true
exit 0
fi
iptables -N TUNNLER 2>/dev/null || iptables -F TUNNLER
iptables -A TUNNLER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
for net in 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16; do
iptables -A TUNNLER -d "$net" -j DROP
done
iptables -N DOCKER-USER 2>/dev/null || true
iptables -I DOCKER-USER -s "$SRC" -j TUNNLER
iptables -I INPUT -s "$SRC" -j TUNNLER