safebox/firewall_containers
7
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Creating nsenter specific lines for setting firewall rules.

Browse Source
This commit is contained in:
Gyorgy Berenyi
2021-06-15 11:57:40 +00:00
parent 2cefb52334
commit 1dd887adb4
1 changed files with 22 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
firewall/firewall-add
View File

@@ -1,5 +1,5 @@
#!/bin/sh #!/bin/sh
NSENTER=$NSENTER
CHAIN=$CHAIN CHAIN=$CHAIN
COMMENT=$COMMENT COMMENT=$COMMENT
PROTOCOL=$TYPE PROTOCOL=$TYPE
@@ -10,12 +10,26 @@ echo 1 > /proc/sys/net/ipv4/ip_forward
############################## ##############################
# #############################
if /sbin/iptables-legacy --list $CHAIN |grep ESTABLISHED |grep RELATED|grep ACCEPT ;
then : ; # NSENTER Specific settings #
else /sbin/iptables-legacy -I $CHAIN -m state --state established,related -j ACCEPT;
if [[ "$NSENTER" == "true" ]] ; then
iptables="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- /sbin/iptables-legacy -t nat";
if $iptables --list POSTROUTING |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then
else $iptables -I POSTROUTING -m state --state established,related -j ACCEPT;
fi fi
else
iptables="/sbin/iptables-legacy"
if $iptables --list $CHAIN |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then
else $iptables -I $CHAIN -m state --state established,related -j ACCEPT;
fi
#
############################### ###############################
COUNT_SOURCE_IP=$(set |grep SOURCE_IP |wc -l) COUNT_SOURCE_IP=$(set |grep SOURCE_IP |wc -l)
@@ -39,16 +53,16 @@ for source_ip_index in $(seq 1 $COUNT_SOURCE_IP) ; do
fi fi
# DELETE UNECESSARY LINES FROM PREVIOUS RULES # DELETE UNECESSARY LINES FROM PREVIOUS RULES
LINES=$(/sbin/iptables-legacy --line-number -n --list $CHAIN | grep $SOURCE_IP |grep $TARGET_IP |grep $PROTOCOL |grep $TARGET_PORT | awk '{print $1}'| tac) LINES=$($iptables --line-number -n --list $CHAIN | grep $SOURCE_IP |grep $TARGET_IP |grep $PROTOCOL |grep $TARGET_PORT | awk '{print $1}'| tac)
if [ -n "$LINES" ] ; then if [ -n "$LINES" ] ; then
for i in $LINES; do for i in $LINES; do
/sbin/iptables-legacy -D $CHAIN $i $iptables -D $CHAIN $i
sleep 0.1 sleep 0.1
done done
fi fi
/sbin/iptables-legacy -I $CHAIN -s $SOURCE_IP -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT $iptables -I $CHAIN -s $SOURCE_IP -d $TARGET_IP -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT
done done
done done
done done