From 0a67817bc3de79fdc4f4d4625ad991f63fcf5919 Mon Sep 17 00:00:00 2001 From: binhex Date: Mon, 22 Feb 2021 17:04:24 +0000 Subject: [PATCH] move iptables.sh to intermediate --- Dockerfile | 3 - run/root/iptable.sh | 267 -------------------------------------------- 2 files changed, 270 deletions(-) delete mode 100644 run/root/iptable.sh diff --git a/Dockerfile b/Dockerfile index 892fa17..e56b06f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,9 +10,6 @@ ADD build/*.conf /etc/supervisor/conf.d/ # add bash scripts to install app ADD build/root/*.sh /root/ -# add run bash scripts -ADD run/root/*.sh /root/ - # add run bash scripts ADD run/nobody/*.sh /home/nobody/ diff --git a/run/root/iptable.sh b/run/root/iptable.sh deleted file mode 100644 index b1b0e10..0000000 --- a/run/root/iptable.sh +++ /dev/null @@ -1,267 +0,0 @@ -#!/bin/bash - -# identify docker bridge interface name by looking at defult route -docker_interface=$(ip -4 route ls | grep default | xargs | grep -o -P '[^\s]+$') -if [[ "${DEBUG}" == "true" ]]; then - echo "[debug] Docker interface defined as ${docker_interface}" -fi - -# identify ip for local gateway (eth0) -default_gateway=$(ip route show default | awk '/default/ {print $3}') -echo "[info] Default route for container is ${default_gateway}" - -# identify ip for docker bridge interface -docker_ip=$(ifconfig "${docker_interface}" | grep -P -o -m 1 '(?<=inet\s)[^\s]+') -if [[ "${DEBUG}" == "true" ]]; then - echo "[debug] Docker IP defined as ${docker_ip}" -fi - -# identify netmask for docker bridge interface -docker_mask=$(ifconfig "${docker_interface}" | grep -P -o -m 1 '(?<=netmask\s)[^\s]+') -if [[ "${DEBUG}" == "true" ]]; then - echo "[debug] Docker netmask defined as ${docker_mask}" -fi - -# convert netmask into cidr format -docker_network_cidr=$(ipcalc "${docker_ip}" "${docker_mask}" | grep -P -o -m 1 "(?<=Network:)\s+[^\s]+") -echo "[info] Docker network defined as ${docker_network_cidr}" - -# split comma separated string into list from LAN_NETWORK env variable -IFS=',' read -ra lan_network_list <<< "${LAN_NETWORK}" - -# split comma separated string into array from VPN_REMOTE_PORT env var -IFS=',' read -ra vpn_remote_port_list <<< "${VPN_REMOTE_PORT}" - -# split comma separated string into array for tcp and udp protocols (both required) -IFS=',' read -ra vpn_remote_endpoint_protocol_list <<< "tcp,udp" - -# split comma separated string into list from ADDITIONAL_PORTS env variable -IFS=',' read -ra additional_port_list <<< "${ADDITIONAL_PORTS}" - -# split comma separated string into array for tcp and udp protocols (both required) -IFS=',' read -ra additional_port_protocol_list <<< "tcp,udp" - -# ip route -### - -# process lan networks in the list -for lan_network_item in "${lan_network_list[@]}"; do - - # strip whitespace from start and end of lan_network_item - lan_network_item=$(echo "${lan_network_item}" | sed -e 's~^[ \t]*~~;s~[ \t]*$~~') - - echo "[info] Adding ${lan_network_item} as route via docker ${docker_interface}" - ip route add "${lan_network_item}" via "${default_gateway}" dev "${docker_interface}" - -done - -echo "[info] ip route defined as follows..." -echo "--------------------" -ip route -echo "--------------------" - -# setup iptables marks to allow routing of defined ports via lan -### - -if [[ "${DEBUG}" == "true" ]]; then - echo "[debug] Modules currently loaded for kernel" ; lsmod -fi - -# check we have iptable_mangle, if so setup fwmark -lsmod | grep iptable_mangle -iptable_mangle_exit_code="${?}" - -if [[ "${iptable_mangle_exit_code}" == 0 ]]; then - - echo "[info] iptable_mangle support detected, adding fwmark for tables" - - # setup route for qbittorrent http using set-mark to route traffic for port WEBUI_PORT to lan - echo "${WEBUI_PORT} qbittorrent_http" >> /etc/iproute2/rt_tables - ip rule add fwmark 1 table qbittorrent_http - ip route add default via "${default_gateway}" table qbittorrent_http - - -fi - -# input iptable rules -### - -# set policy to drop ipv4 for input -iptables -P INPUT DROP - -# set policy to drop ipv6 for input -ip6tables -P INPUT DROP 1>&- 2>&- - -# accept input to/from docker containers (172.x range is internal dhcp) -iptables -A INPUT -s "${docker_network_cidr}" -d "${docker_network_cidr}" -j ACCEPT - -# iterate over array and add all remote vpn ports and protocols -for vpn_remote_port_item in "${vpn_remote_port_list[@]}"; do - - for vpn_remote_protocol_item in "${vpn_remote_endpoint_protocol_list[@]}"; do - - # note grep -e is required to indicate no flags follow to prevent -A from being incorrectly picked up - rule_exists=$(iptables -S | grep -e "-A INPUT -i "${docker_interface}" -p "${vpn_remote_protocol_item}" -m "${vpn_remote_protocol_item}" --sport "${vpn_remote_port_item}" -j ACCEPT") - if [[ -z "${rule_exists}" ]]; then - # accept input to vpn gateway - iptables -A INPUT -i "${docker_interface}" -p "${vpn_remote_protocol_item}" --sport "${vpn_remote_port_item}" -j ACCEPT - fi - - done - -done -# accept input to qbittorrent port WEBUI_PORT -iptables -A INPUT -i "${docker_interface}" -p tcp --dport "${WEBUI_PORT}" -j ACCEPT -iptables -A INPUT -i "${docker_interface}" -p tcp --sport "${WEBUI_PORT}" -j ACCEPT - -# additional port list for scripts or container linking -if [[ ! -z "${ADDITIONAL_PORTS}" ]]; then - - # process additional ports in the list - for additional_port_item in "${additional_port_list[@]}"; do - - # strip whitespace from start and end of additional_port_item - additional_port_item=$(echo "${additional_port_item}" | sed -e 's~^[ \t]*~~;s~[ \t]*$~~') - - echo "[info] Adding additional incoming port ${additional_port_item} for ${docker_interface}" - - for additional_port_protocol_item in "${additional_port_protocol_list[@]}"; do - - # accept input to additional port for "${docker_interface}" - iptables -A INPUT -i "${docker_interface}" -p "${additional_port_protocol_item}" --dport "${additional_port_item}" -j ACCEPT - iptables -A INPUT -i "${docker_interface}" -p "${additional_port_protocol_item}" --sport "${additional_port_item}" -j ACCEPT - - done - - done - -fi - -# process lan networks in the list -for lan_network_item in "${lan_network_list[@]}"; do - - # strip whitespace from start and end of lan_network_item - lan_network_item=$(echo "${lan_network_item}" | sed -e 's~^[ \t]*~~;s~[ \t]*$~~') - - # accept input to qbittorrent api - used for lan access - iptables -A INPUT -i "${docker_interface}" -s "${lan_network_item}" -p tcp --dport "${WEBUI_PORT}" -j ACCEPT - - # accept input to privoxy if enabled - if [[ "${ENABLE_PRIVOXY}" == "yes" ]]; then - iptables -A INPUT -i "${docker_interface}" -p tcp -s "${lan_network_item}" -d "${docker_network_cidr}" -j ACCEPT - fi - -done - -# accept input icmp (ping) -iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT - -# accept input to local loopback -iptables -A INPUT -i lo -j ACCEPT - -# accept input to tunnel adapter -iptables -A INPUT -i "${VPN_DEVICE_TYPE}" -j ACCEPT - -# forward iptable rules -### - -# set policy to drop ipv4 for forward -iptables -P FORWARD DROP - -# set policy to drop ipv6 for forward -ip6tables -P FORWARD DROP 1>&- 2>&- - -# output iptable rules -### - -# set policy to drop ipv4 for output -iptables -P OUTPUT DROP - -# set policy to drop ipv6 for output -ip6tables -P OUTPUT DROP 1>&- 2>&- - -# accept output to/from docker containers (172.x range is internal dhcp) -iptables -A OUTPUT -s "${docker_network_cidr}" -d "${docker_network_cidr}" -j ACCEPT - -# iterate over array and add all remote vpn ports and protocols -for vpn_remote_port_item in "${vpn_remote_port_list[@]}"; do - - for vpn_remote_protocol_item in "${vpn_remote_endpoint_protocol_list[@]}"; do - - # note grep -e is required to indicate no flags follow to prevent -A from being incorrectly picked up - rule_exists=$(iptables -S | grep -e "-A OUTPUT -o "${docker_interface}" -p "${vpn_remote_protocol_item}" -m "${vpn_remote_protocol_item}" --dport "${vpn_remote_port_item}" -j ACCEPT") - if [[ -z "${rule_exists}" ]]; then - # accept output to vpn gateway - iptables -A OUTPUT -o "${docker_interface}" -p "${vpn_remote_protocol_item}" --dport "${vpn_remote_port_item}" -j ACCEPT - fi - - done - -done - -# if iptable mangle is available (kernel module) then use mark -if [[ "${iptable_mangle_exit_code}" == 0 ]]; then - - # accept output from qbittorrent port WEBUI_PORT - used for external access - iptables -t mangle -A OUTPUT -p tcp --dport "${WEBUI_PORT}" -j MARK --set-mark 1 - iptables -t mangle -A OUTPUT -p tcp --sport "${WEBUI_PORT}" -j MARK --set-mark 1 - -fi - -# accept output from qbittorrent port WEBUI_PORT - used for lan access -iptables -A OUTPUT -o "${docker_interface}" -p tcp --dport "${WEBUI_PORT}" -j ACCEPT -iptables -A OUTPUT -o "${docker_interface}" -p tcp --sport "${WEBUI_PORT}" -j ACCEPT - -# additional port list for scripts or container linking -if [[ ! -z "${ADDITIONAL_PORTS}" ]]; then - - # process additional ports in the list - for additional_port_item in "${additional_port_list[@]}"; do - - # strip whitespace from start and end of additional_port_item - additional_port_item=$(echo "${additional_port_item}" | sed -e 's~^[ \t]*~~;s~[ \t]*$~~') - - echo "[info] Adding additional outgoing port ${additional_port_item} for ${docker_interface}" - - for additional_port_protocol_item in "${additional_port_protocol_list[@]}"; do - - # accept output to additional port for lan interface - iptables -A OUTPUT -o "${docker_interface}" -p "${additional_port_protocol_item}" --dport "${additional_port_item}" -j ACCEPT - iptables -A OUTPUT -o "${docker_interface}" -p "${additional_port_protocol_item}" --sport "${additional_port_item}" -j ACCEPT - - done - - done - -fi - -# process lan networks in the list -for lan_network_item in "${lan_network_list[@]}"; do - - # strip whitespace from start and end of lan_network_item - lan_network_item=$(echo "${lan_network_item}" | sed -e 's~^[ \t]*~~;s~[ \t]*$~~') - - # accept output to qbittorrent api - used for lan access - iptables -A OUTPUT -o "${docker_interface}" -d "${lan_network_item}" -p tcp --sport "${WEBUI_PORT}" -j ACCEPT - - # accept output from privoxy if enabled - used for lan access - if [[ "${ENABLE_PRIVOXY}" == "yes" ]]; then - iptables -A OUTPUT -o "${docker_interface}" -p tcp -s "${docker_network_cidr}" -d "${lan_network_item}" -j ACCEPT - fi - -done - -# accept output for icmp (ping) -iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT - -# accept output from local loopback adapter -iptables -A OUTPUT -o lo -j ACCEPT - -# accept output from tunnel adapter -iptables -A OUTPUT -o "${VPN_DEVICE_TYPE}" -j ACCEPT - -echo "[info] iptables defined as follows..." -echo "--------------------" -iptables -S 2>&1 | tee /tmp/getiptables -chmod +r /tmp/getiptables -echo "--------------------"