GRIN/nym
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WG exit policy scripts update (#5921)

Browse Source 
* add NIP-3 ports to WG manager script

* add monero ports to local testing script

* console output snippet update
This commit is contained in:
import this
2025-07-30 09:43:39 +00:00
committed by GitHub
parent 917f391948
commit 314a37cabe
8 changed files with 850 additions and 805 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/docs/components/operators/snippets/wg-exit-policy-install-output.mdx
+39 -7
View File
@@ -7,20 +7,32 @@ net.ipv6.conf.all.forwarding = 1
net.ipv4.ip_forward = 1
IP forwarding configured successfully.
Creating Nym exit policy chain...
Creating chain NYM-EXIT...
Creating chain NYM-EXIT in ip6tables...
Linking NYM-EXIT to FORWARD chain...
Linking NYM-EXIT to IPv6 FORWARD chain...
Chain NYM-EXIT already exists. Flushing it...
Chain NYM-EXIT already exists in ip6tables. Flushing it...
NYM-EXIT all opt -- in * out nymwg 0.0.0.0/0 -> 0.0.0.0/0
NYM-EXIT all opt in * out nymwg ::/0 -> ::/0
Setting up NAT rules...
MASQUERADE all opt -- in * out ens3 0.0.0.0/0 -> 0.0.0.0/0
IPv4 NAT rule already exists.
MASQUERADE all opt in * out ens3 ::/0 -> ::/0
IPv6 NAT rule already exists.
ACCEPT all opt -- in nymwg out ens3 0.0.0.0/0 -> 0.0.0.0/0
ACCEPT all opt -- in ens3 out nymwg 0.0.0.0/0 -> 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT all opt in nymwg out ens3 ::/0 -> ::/0
ACCEPT all opt in ens3 out nymwg ::/0 -> ::/0 state RELATED,ESTABLISHED
Configuring DNS and ICMP rules...
Added IPv6 ICMP rule (allow ping6).
Added IPv6 DNS rule (UDP).
Added IPv6 DNS rule (TCP).
ACCEPT icmp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 icmptype 8
ACCEPT icmp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 icmptype 0
ACCEPT icmpv6 opt in * out * ::/0 -> ::/0
ACCEPT udp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 udp dpt:53
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpt:53
ACCEPT udp opt in * out * ::/0 -> ::/0 udp dpt:53
ACCEPT tcp opt in * out * ::/0 -> ::/0 tcp dpt:53
Applying Spamhaus blocklist...
Downloading exit policy from https://nymtech.net/.wellknown/network-requester/exit-policy.txt
Processing 429 blocklist rules...
REJECT all opt -- in * out * 0.0.0.0/0 -> 205.189.71.0/24 reject-with icmp-port-unreachable
REJECT all opt -- in * out * 0.0.0.0/0 -> 205.189.72.0/23 reject-with icmp-port-unreachable
Blocklist applied successfully.
Applying allowed ports...
Adding rules for SILC (Port: 706)
@@ -103,6 +115,11 @@ Adding rules for POP3OverTLS (Port: 995)
Added: NYM-EXIT tcp port 995
Added: NYM-EXIT udp port 995
Added: NYM-EXIT udp port 995
Adding rules for DarkFiTor (Port: 25551)
Added: NYM-EXIT tcp port 25551
Added: NYM-EXIT tcp port 25551
Added: NYM-EXIT udp port 25551
Added: NYM-EXIT udp port 25551
Adding rules for MMCC (Port: 5050)
Added: NYM-EXIT tcp port 5050
Added: NYM-EXIT tcp port 5050
@@ -268,6 +285,11 @@ Adding rules for Mumble (Port: 64738)
Added: NYM-EXIT tcp port 64738
Added: NYM-EXIT udp port 64738
Added: NYM-EXIT udp port 64738
Adding rules for DarkFi (Port: 26661)
Added: NYM-EXIT tcp port 26661
Added: NYM-EXIT tcp port 26661
Added: NYM-EXIT udp port 26661
Added: NYM-EXIT udp port 26661
Adding rules for PPTP (Port: 1723)
Added: NYM-EXIT tcp port 1723
Added: NYM-EXIT tcp port 1723
@@ -333,6 +355,11 @@ Adding rules for Kpasswd (Port: 464)
Added: NYM-EXIT tcp port 464
Added: NYM-EXIT udp port 464
Added: NYM-EXIT udp port 464
Adding rules for MoneroRPC (Port: 18089)
Added: NYM-EXIT tcp port 18089
Added: NYM-EXIT tcp port 18089
Added: NYM-EXIT udp port 18089
Added: NYM-EXIT udp port 18089
Adding rules for RemoteHTTPS (Port: 981)
Added: NYM-EXIT tcp port 981
Added: NYM-EXIT tcp port 981
@@ -398,6 +425,11 @@ Adding rules for GroupWise (Port: 1677)
Added: NYM-EXIT tcp port 1677
Added: NYM-EXIT udp port 1677
Added: NYM-EXIT udp port 1677
Adding rules for Monero (Port: 18080-18081)
Added: NYM-EXIT tcp port range 18080:18081
Added: NYM-EXIT tcp port range 18080:18081
Added: NYM-EXIT udp port range 18080:18081
Added: NYM-EXIT udp port range 18080:18081
Adding rules for EnsimControlPanel (Port: 19638)
Added: NYM-EXIT tcp port 19638
Added: NYM-EXIT tcp port 19638
documentation/docs/components/operators/snippets/wg-exit-policy-status-output.mdx
+779 -791
View File
File diff suppressed because it is too large Load Diff
documentation/docs/components/operators/snippets/wg-exit-policy-test-output.mdx
+21 -1
View File
@@ -2,41 +2,61 @@
Running Nym Exit Policy Verification Tests...
Testing Port Range Rules...
Testing FTP tcp port range 20-21
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpts:20:21
✓ Rule exists: NYM-EXIT tcp port range 20:21
Testing HTTP tcp port range 80-81
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpts:80:81
✓ Rule exists: NYM-EXIT tcp port range 80:81
Testing CPanel tcp port range 2082-2083
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpts:2082:2083
✓ Rule exists: NYM-EXIT tcp port range 2082:2083
Testing XMPP tcp port range 5222-5223
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpts:5222:5223
✓ Rule exists: NYM-EXIT tcp port range 5222:5223
Testing Steam (sampling) tcp port range 27000-27050
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpts:27000:27050
✓ Rule exists: NYM-EXIT tcp port range 27000:27050
Testing FTP over TLS tcp port range 989-990
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpts:989:990
✓ Rule exists: NYM-EXIT tcp port range 989:990
Testing RTP/VoIP tcp port range 5000-5005
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpts:5000:5005
✓ Rule exists: NYM-EXIT tcp port range 5000:5005
Testing Simplify Media tcp port range 8087-8088
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpts:8087:8088
✓ Rule exists: NYM-EXIT tcp port range 8087:8088
Testing Zcash tcp port range 8232-8233
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpts:8232:8233
✓ Rule exists: NYM-EXIT tcp port range 8232:8233
Testing Bitcoin tcp port range 8332-8333
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpts:8332:8333
✓ Rule exists: NYM-EXIT tcp port range 8332:8333
Testing Monero tcp port range 18080-18081
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpts:18080:18081
✓ Rule exists: NYM-EXIT tcp port range 18080:18081
Test test_port_range_rules PASSED
Testing Critical Service Rules...
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpt:22
✓ Rule exists: NYM-EXIT tcp port 22
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpt:53
✓ Rule exists: NYM-EXIT tcp port 53
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpt:443
✓ Rule exists: NYM-EXIT tcp port 443
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpt:853
✓ Rule exists: NYM-EXIT tcp port 853
ACCEPT tcp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 tcp dpt:1194
✓ Rule exists: NYM-EXIT tcp port 1194
ACCEPT udp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 udp dpt:53
✓ Rule exists: NYM-EXIT udp port 53
ACCEPT udp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 udp dpt:123
✓ Rule exists: NYM-EXIT udp port 123
ACCEPT udp opt -- in * out * 0.0.0.0/0 -> 0.0.0.0/0 udp dpt:1194
✓ Rule exists: NYM-EXIT udp port 1194
Relevant existing rules for HTTP (port 80):
Test test_critical_services PASSED
This test takes some time, do not quit the process
Testing Default Reject Rule...
✓ Default REJECT rule exists
Test test_default_reject_rule PASSED
documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/nyx-percent-stake.md
+1 -1
View File
@@ -1 +1 @@
0.80%
0.73%
documentation/docs/components/outputs/api-scraping-outputs/nyx-outputs/nyx-total-stake.md
+1 -1
View File
@@ -1 +1 @@
35.841
39.437
documentation/docs/components/outputs/api-scraping-outputs/time-now.md
+1 -1
View File
@@ -1 +1 @@
Tuesday, July 22nd 2025, 11:37:27 UTC
Wednesday, July 30th 2025, 09:32:50 UTC
scripts/wireguard-exit-policy/exit-policy-tests.sh
+3 -2
View File
@@ -47,6 +47,7 @@ test_port_range_rules() {
"8087-8088:tcp:Simplify Media"
"8232-8233:tcp:Zcash"
"8332-8333:tcp:Bitcoin"
"18080-18081:tcp:Monero"
)
local total_failures=0
@@ -148,7 +149,7 @@ test_critical_services() {
# Verify default reject rule exists
test_default_reject_rule() {
echo -e "${YELLOW}This test takes some time, do not quit the process${NC}"
echo
echo
echo -e "${YELLOW}Testing Default Reject Rule...${NC}"
# Try different patterns to detect the reject rule
@@ -236,4 +237,4 @@ if [[ $EUID -ne 0 ]]; then
fi
# Run the tests
run_all_tests "$@"
run_all_tests "$@"
scripts/wireguard-exit-policy/wireguard-exit-policy-manager.sh
+5 -1
View File
@@ -357,9 +357,13 @@ apply_port_allowlist() {
["Lightning"]="9735"
["NDMP"]="10000"
["OpenPGP"]="11371"
["Monero"]="18080-18081"
["MoneroRPC"]="18089"
["GoogleVoice"]="19294"
["EnsimControlPanel"]="19638"
["DarkFiTor"]="25551"
["Minecraft"]="25565"
["DarkFi"]="26661"
["Steam"]="27000-27050"
["ElectrumSSL"]="50002"
["MOSH"]="60000-61000"
@@ -672,4 +676,4 @@ main() {
esac
}
main "$@"
main "$@"