diff --git a/run/root/iptable.sh b/run/root/iptable.sh index d02bb5e..8992a16 100644 --- a/run/root/iptable.sh +++ b/run/root/iptable.sh @@ -42,22 +42,10 @@ if [[ $iptable_mangle_exit_code == 0 ]]; then echo "[info] iptable_mangle support detected, adding fwmark for tables" - # setup route for rutorrent http using set-mark to route traffic for port 80 to eth0 - echo "9080 rutorrent_http" >> /etc/iproute2/rt_tables - ip rule add fwmark 1 table rutorrent_http - ip route add default via $DEFAULT_GATEWAY table rutorrent_http - - # setup route for rutorrent https using set-mark to route traffic for port 443 to eth0 - echo "9443 rutorrent_https" >> /etc/iproute2/rt_tables - ip rule add fwmark 2 table rutorrent_https - ip route add default via $DEFAULT_GATEWAY table rutorrent_https - - # setup route for flood using set-mark to route traffic for port 3000 to eth0 - if [[ $ENABLE_FLOOD == "yes" || $ENABLE_FLOOD == "both" ]]; then - echo "3000 flood" >> /etc/iproute2/rt_tables - ip rule add fwmark 3 table flood - ip route add default via $DEFAULT_GATEWAY table flood - fi + # setup route for qbittorrent http using set-mark to route traffic for port 8080 to eth0 + echo "8080 qbittorrent_http" >> /etc/iproute2/rt_tables + ip rule add fwmark 1 table qbittorrent_http + ip route add default via $DEFAULT_GATEWAY table qbittorrent_http fi @@ -101,19 +89,9 @@ iptables -A INPUT -s "${docker_network_cidr}" -d "${docker_network_cidr}" -j ACC # accept input to vpn gateway iptables -A INPUT -i eth0 -p $VPN_PROTOCOL --sport $VPN_PORT -j ACCEPT -# accept input to rutorrent port 9080 -iptables -A INPUT -i eth0 -p tcp --dport 9080 -j ACCEPT -iptables -A INPUT -i eth0 -p tcp --sport 9080 -j ACCEPT - -# accept input to rutorrent port 9443 -iptables -A INPUT -i eth0 -p tcp --dport 9443 -j ACCEPT -iptables -A INPUT -i eth0 -p tcp --sport 9443 -j ACCEPT - -# accept input to flood port 3000 if enabled -if [[ $ENABLE_FLOOD == "yes" || $ENABLE_FLOOD == "both" ]]; then - iptables -A INPUT -i eth0 -p tcp --dport 3000 -j ACCEPT - iptables -A INPUT -i eth0 -p tcp --sport 3000 -j ACCEPT -fi +# accept input to qbittorrent port 8080 +iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT +iptables -A INPUT -i eth0 -p tcp --sport 8080 -j ACCEPT # process lan networks in the list for lan_network_item in "${lan_network_list[@]}"; do @@ -121,8 +99,8 @@ for lan_network_item in "${lan_network_list[@]}"; do # strip whitespace from start and end of lan_network_item lan_network_item=$(echo "${lan_network_item}" | sed -e 's~^[ \t]*~~;s~[ \t]*$~~') - # accept input to rtorrent scgi - used for lan access - iptables -A INPUT -i eth0 -s "${lan_network_item}" -p tcp --dport 5000 -j ACCEPT + # accept input to qbittorrent api - used for lan access + iptables -A INPUT -i eth0 -s "${lan_network_item}" -p tcp --dport 8080 -j ACCEPT # accept input to privoxy if enabled if [[ $ENABLE_PRIVOXY == "yes" ]]; then @@ -158,35 +136,15 @@ iptables -A OUTPUT -o eth0 -p $VPN_PROTOCOL --dport $VPN_PORT -j ACCEPT # if iptable mangle is available (kernel module) then use mark if [[ $iptable_mangle_exit_code == 0 ]]; then - # accept output from rutorrent port 9080 - used for external access - iptables -t mangle -A OUTPUT -p tcp --dport 9080 -j MARK --set-mark 1 - iptables -t mangle -A OUTPUT -p tcp --sport 9080 -j MARK --set-mark 1 - - # accept output from rutorrent port 9443 - used for external access - iptables -t mangle -A OUTPUT -p tcp --dport 9443 -j MARK --set-mark 2 - iptables -t mangle -A OUTPUT -p tcp --sport 9443 -j MARK --set-mark 2 - - # accept output from flood port 3000 if enabled - used for external access - if [[ $ENABLE_FLOOD == "yes" || $ENABLE_FLOOD == "both" ]]; then - iptables -t mangle -A OUTPUT -p tcp --dport 3000 -j MARK --set-mark 3 - iptables -t mangle -A OUTPUT -p tcp --sport 3000 -j MARK --set-mark 3 - fi + # accept output from qbittorrent port 8080 - used for external access + iptables -t mangle -A OUTPUT -p tcp --dport 8080 -j MARK --set-mark 1 + iptables -t mangle -A OUTPUT -p tcp --sport 8080 -j MARK --set-mark 1 fi -# accept output from rutorrent port 9080 - used for lan access -iptables -A OUTPUT -o eth0 -p tcp --dport 9080 -j ACCEPT -iptables -A OUTPUT -o eth0 -p tcp --sport 9080 -j ACCEPT - -# accept output from rutorrent port 9443 - used for lan access -iptables -A OUTPUT -o eth0 -p tcp --dport 9443 -j ACCEPT -iptables -A OUTPUT -o eth0 -p tcp --sport 9443 -j ACCEPT - -# accept output from flood port 3000 if enabled - used for lan access -if [[ $ENABLE_FLOOD == "yes" || $ENABLE_FLOOD == "both" ]]; then - iptables -A OUTPUT -o eth0 -p tcp --dport 3000 -j ACCEPT - iptables -A OUTPUT -o eth0 -p tcp --sport 3000 -j ACCEPT -fi +# accept output from qbittorrent port 8080 - used for lan access +iptables -A OUTPUT -o eth0 -p tcp --dport 8080 -j ACCEPT +iptables -A OUTPUT -o eth0 -p tcp --sport 8080 -j ACCEPT # process lan networks in the list for lan_network_item in "${lan_network_list[@]}"; do @@ -194,8 +152,8 @@ for lan_network_item in "${lan_network_list[@]}"; do # strip whitespace from start and end of lan_network_item lan_network_item=$(echo "${lan_network_item}" | sed -e 's~^[ \t]*~~;s~[ \t]*$~~') - # accept output to rtorrent scgi - used for lan access - iptables -A OUTPUT -o eth0 -d "${lan_network_item}" -p tcp --sport 5000 -j ACCEPT + # accept output to qbittorrent api - used for lan access + iptables -A OUTPUT -o eth0 -d "${lan_network_item}" -p tcp --sport 8080 -j ACCEPT # accept output from privoxy if enabled - used for lan access if [[ $ENABLE_PRIVOXY == "yes" ]]; then