21-firewall.sh
44 lines
| 1.5 KiB
| application/x-sh
|
BashLexer
/ bootstrap.d / 21-firewall.sh
Filip Pytloun
|
r56 | # | ||
Jan Wagner
|
r67 | # Setup Firewall | ||
Filip Pytloun
|
r56 | # | ||
Jan Wagner
|
r67 | # Load utility functions | ||
Filip Pytloun
|
r56 | . ./functions.sh | ||
if [ "$ENABLE_IPTABLES" = true ] ; then | ||||
# Create iptables configuration directory | ||||
mkdir -p "$R/etc/iptables" | ||||
Jan Wagner
|
r71 | # Install iptables systemd service | ||
Jan Wagner
|
r75 | install_readonly files/iptables/iptables.service "$R/etc/systemd/system/iptables.service" | ||
Filip Pytloun
|
r56 | |||
Jan Wagner
|
r71 | # Install flush-table script called by iptables service | ||
Jan Wagner
|
r75 | install_exec files/iptables/flush-iptables.sh "$R/etc/iptables/flush-iptables.sh" | ||
Filip Pytloun
|
r56 | |||
Jan Wagner
|
r71 | # Install iptables rule file | ||
Jan Wagner
|
r75 | install_readonly files/iptables/iptables.rules "$R/etc/iptables/iptables.rules" | ||
Filip Pytloun
|
r56 | |||
# Reload systemd configuration and enable iptables service | ||||
chroot_exec systemctl daemon-reload | ||||
chroot_exec systemctl enable iptables.service | ||||
if [ "$ENABLE_IPV6" = true ] ; then | ||||
Jan Wagner
|
r71 | # Install ip6tables systemd service | ||
Jan Wagner
|
r75 | install_readonly files/iptables/ip6tables.service "$R/etc/systemd/system/ip6tables.service" | ||
Filip Pytloun
|
r56 | |||
Jan Wagner
|
r71 | # Install ip6tables file | ||
Jan Wagner
|
r75 | install_exec files/iptables/flush-ip6tables.sh "$R/etc/iptables/flush-ip6tables.sh" | ||
Filip Pytloun
|
r56 | |||
Jan Wagner
|
r75 | install_readonly files/iptables/ip6tables.rules "$R/etc/iptables/ip6tables.rules" | ||
Filip Pytloun
|
r56 | |||
# Reload systemd configuration and enable iptables service | ||||
chroot_exec systemctl daemon-reload | ||||
chroot_exec systemctl enable ip6tables.service | ||||
fi | ||||
fi | ||||
if [ "$ENABLE_SSHD" = false ] ; then | ||||
Jan Wagner
|
r70 | # Remove SSHD related iptables rules | ||
Jan Wagner
|
r75 | sed -i "/^#/! {/SSH/ s/^/# /}" "$R/etc/iptables/iptables.rules" 2> /dev/null | ||
sed -i "/^#/! {/SSH/ s/^/# /}" "$R/etc/iptables/ip6tables.rules" 2> /dev/null | ||||
Filip Pytloun
|
r56 | fi | ||