mirror of
https://github.com/Andre-Bzk/tunnler.git
synced 2026-11-15 06:23:04 +01:00
100 lines
3.0 KiB
YAML
100 lines
3.0 KiB
YAML
# wstunnel-Server: Zugriffsregeln (wird bei Aenderung automatisch neu geladen).
|
|
# Vorlage: Platzhalter im PathPrefix durch das Secret ersetzen, als restrictions.yaml speichern.
|
|
#
|
|
# Wirkung:
|
|
# - Nur Clients mit dem geheimen Pfad-Praefix werden akzeptiert.
|
|
# - Nur Forward-Tunnel (keine Reverse-Tunnel), nur TCP, nur Ziel-Port 80/443.
|
|
# - Hostnamen: mindestens ein Punkt, TLD aus Buchstaben, nie *.localhost.
|
|
# Lokale Namen (pi.hole, *.home, Container-Namen) loest der Server nicht auf,
|
|
# weil er per --dns-resolver nur oeffentliches DNS fragt (siehe docker-compose.yml).
|
|
# - IP-Adressen als Ziel: nur oeffentliche IPv4-Bereiche (privat, Loopback,
|
|
# Link-Local, CGNAT, Multicast ausgeschlossen) und globales IPv6.
|
|
restrictions:
|
|
- name: "tunnler"
|
|
description: "Forward-Tunnel mit Secret, TCP 80/443, keine privaten Ziele"
|
|
match:
|
|
- !PathPrefix "^__SECRET__$"
|
|
allow:
|
|
- !Tunnel
|
|
protocol:
|
|
- Tcp
|
|
port:
|
|
- 80
|
|
- 443
|
|
host: '(?i)^([a-z0-9_-]+\.)+([a-z]{2,8}|[a-z]{10,63}|[a-km-z][a-z]{8}|l[a-np-z][a-z]{7}|lo[a-bd-z][a-z]{6}|loc[b-z][a-z]{5}|loca[a-km-z][a-z]{4}|local[a-gi-z][a-z]{3}|localh[a-np-z][a-z]{2}|localho[a-rt-z][a-z]|localhos[a-su-z]|xn--[a-z0-9-]+)$'
|
|
cidr:
|
|
- 1.0.0.0/8
|
|
- 2.0.0.0/7
|
|
- 4.0.0.0/6
|
|
- 8.0.0.0/7
|
|
- 11.0.0.0/8
|
|
- 12.0.0.0/6
|
|
- 16.0.0.0/4
|
|
- 32.0.0.0/3
|
|
- 64.0.0.0/3
|
|
- 96.0.0.0/6
|
|
- 100.0.0.0/10
|
|
- 100.128.0.0/9
|
|
- 101.0.0.0/8
|
|
- 102.0.0.0/7
|
|
- 104.0.0.0/5
|
|
- 112.0.0.0/5
|
|
- 120.0.0.0/6
|
|
- 124.0.0.0/7
|
|
- 126.0.0.0/8
|
|
- 128.0.0.0/3
|
|
- 160.0.0.0/5
|
|
- 168.0.0.0/8
|
|
- 169.0.0.0/9
|
|
- 169.128.0.0/10
|
|
- 169.192.0.0/11
|
|
- 169.224.0.0/12
|
|
- 169.240.0.0/13
|
|
- 169.248.0.0/14
|
|
- 169.252.0.0/15
|
|
- 169.255.0.0/16
|
|
- 170.0.0.0/7
|
|
- 172.0.0.0/12
|
|
- 172.32.0.0/11
|
|
- 172.64.0.0/10
|
|
- 172.128.0.0/9
|
|
- 173.0.0.0/8
|
|
- 174.0.0.0/7
|
|
- 176.0.0.0/4
|
|
- 192.0.1.0/24
|
|
- 192.0.2.0/23
|
|
- 192.0.4.0/22
|
|
- 192.0.8.0/21
|
|
- 192.0.16.0/20
|
|
- 192.0.32.0/19
|
|
- 192.0.64.0/18
|
|
- 192.0.128.0/17
|
|
- 192.1.0.0/16
|
|
- 192.2.0.0/15
|
|
- 192.4.0.0/14
|
|
- 192.8.0.0/13
|
|
- 192.16.0.0/12
|
|
- 192.32.0.0/11
|
|
- 192.64.0.0/10
|
|
- 192.128.0.0/11
|
|
- 192.160.0.0/13
|
|
- 192.169.0.0/16
|
|
- 192.170.0.0/15
|
|
- 192.172.0.0/14
|
|
- 192.176.0.0/12
|
|
- 192.192.0.0/10
|
|
- 193.0.0.0/8
|
|
- 194.0.0.0/7
|
|
- 196.0.0.0/7
|
|
- 198.0.0.0/12
|
|
- 198.16.0.0/15
|
|
- 198.20.0.0/14
|
|
- 198.24.0.0/13
|
|
- 198.32.0.0/11
|
|
- 198.64.0.0/10
|
|
- 198.128.0.0/9
|
|
- 199.0.0.0/8
|
|
- 200.0.0.0/5
|
|
- 208.0.0.0/4
|
|
- 2000::/3
|