mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 06:04:30 +00:00
42 lines
1.0 KiB
Django/Jinja
42 lines
1.0 KiB
Django/Jinja
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
CHAIN="{{ k3s_firewall_svc_allow_chain | default('PROLE-SVC-ALLOW') }}"
|
|
PORTS="{{ (k3s_firewall_svc_allow_tcp_ports | default([80, 443])) | join(' ') }}"
|
|
|
|
log() {
|
|
echo "[prole-svc-iptables-allow] $*" >&2
|
|
}
|
|
|
|
apply_rules() {
|
|
local ipt="$1"
|
|
|
|
command -v "$ipt" >/dev/null 2>&1 || return 0
|
|
|
|
# Ensure chain exists.
|
|
"$ipt" -t filter -N "$CHAIN" 2>/dev/null || true
|
|
"$ipt" -t filter -F "$CHAIN" || true
|
|
|
|
# Populate chain with port accepts.
|
|
for p in $PORTS; do
|
|
if [[ ! "$p" =~ ^[0-9]+$ ]]; then
|
|
log "Skipping non-numeric port: $p"
|
|
continue
|
|
fi
|
|
"$ipt" -t filter -A "$CHAIN" -p tcp --dport "$p" -j ACCEPT
|
|
done
|
|
|
|
# Ensure we jump to our chain at the very top of INPUT.
|
|
# Delete any existing jumps (wherever they are), then insert at position 1.
|
|
while "$ipt" -t filter -D INPUT -j "$CHAIN" 2>/dev/null; do
|
|
:
|
|
done
|
|
"$ipt" -t filter -I INPUT 1 -j "$CHAIN"
|
|
}
|
|
|
|
apply_rules iptables
|
|
apply_rules ip6tables
|
|
|
|
log "Applied ACCEPT rules for TCP ports: $PORTS"
|