mirror of
https://github.com/Andre-Bzk/tunnler.git
synced 2026-11-15 06:23:04 +01:00
28 lines
1.0 KiB
Bash
28 lines
1.0 KiB
Bash
#!/bin/sh
|
|
# Trennt den wstunnel-Container (feste IP, TUNNEL_IP aus /etc/default/tunnler-firewall) vom Heimnetz
|
|
# und vom Pi selbst. Hostnamen, die per oeffentlichem DNS auf private IPs zeigen
|
|
# (z. B. 192-168-0-1.nip.io), kann wstunnel selbst nicht abfangen.
|
|
# tunnler-firewall.sh Regeln setzen (idempotent)
|
|
# tunnler-firewall.sh --remove Regeln entfernen
|
|
set -e
|
|
SRC=${TUNNEL_IP:-172.20.250.250}
|
|
|
|
for chain in DOCKER-USER INPUT; do
|
|
while iptables -D "$chain" -s "$SRC" -j TUNNLER 2>/dev/null; do :; done
|
|
done
|
|
if [ "$1" = "--remove" ]; then
|
|
iptables -F TUNNLER 2>/dev/null || true
|
|
iptables -X TUNNLER 2>/dev/null || true
|
|
exit 0
|
|
fi
|
|
|
|
iptables -N TUNNLER 2>/dev/null || iptables -F TUNNLER
|
|
iptables -A TUNNLER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
|
|
for net in 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16; do
|
|
iptables -A TUNNLER -d "$net" -j DROP
|
|
done
|
|
|
|
iptables -N DOCKER-USER 2>/dev/null || true
|
|
iptables -I DOCKER-USER -s "$SRC" -j TUNNLER
|
|
iptables -I INPUT -s "$SRC" -j TUNNLER
|