From ef25480c201048ae031f29dc269daaf788f8be2b Mon Sep 17 00:00:00 2001 From: benedettadavico Date: Mon, 17 Nov 2025 17:05:34 +0100 Subject: [PATCH 1/3] fix --- .../nym-node-setup/network-tunnel-manager.sh | 53 +++++++++---------- 1 file changed, 24 insertions(+), 29 deletions(-) diff --git a/scripts/nym-node-setup/network-tunnel-manager.sh b/scripts/nym-node-setup/network-tunnel-manager.sh index acd0186366..71e31e5c9f 100644 --- a/scripts/nym-node-setup/network-tunnel-manager.sh +++ b/scripts/nym-node-setup/network-tunnel-manager.sh @@ -296,20 +296,20 @@ apply_iptables_rules() { iptables -t nat -A POSTROUTING -o "$NETWORK_DEVICE" -j MASQUERADE iptables -C FORWARD -i "$interface" -o "$NETWORK_DEVICE" -j ACCEPT 2>/dev/null || \ - iptables -A FORWARD -i "$interface" -o "$NETWORK_DEVICE" -j ACCEPT + iptables -I FORWARD 1 -i "$interface" -o "$NETWORK_DEVICE" -j ACCEPT iptables -C FORWARD -i "$NETWORK_DEVICE" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \ - iptables -A FORWARD -i "$NETWORK_DEVICE" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT + iptables -I FORWARD 2 -i "$NETWORK_DEVICE" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT # ipv6 nat and forwarding ip6tables -t nat -C POSTROUTING -o "$NETWORK_DEVICE" -j MASQUERADE 2>/dev/null || \ ip6tables -t nat -A POSTROUTING -o "$NETWORK_DEVICE" -j MASQUERADE ip6tables -C FORWARD -i "$interface" -o "$NETWORK_DEVICE" -j ACCEPT 2>/dev/null || \ - ip6tables -A FORWARD -i "$interface" -o "$NETWORK_DEVICE" -j ACCEPT + ip6tables -I FORWARD 1 -i "$interface" -o "$NETWORK_DEVICE" -j ACCEPT ip6tables -C FORWARD -i "$NETWORK_DEVICE" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \ - ip6tables -A FORWARD -i "$NETWORK_DEVICE" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT + ip6tables -I FORWARD 2 -i "$NETWORK_DEVICE" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT save_iptables_rules } @@ -507,45 +507,40 @@ setup_nat_rules() { fi if ! iptables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j ACCEPT 2>/dev/null; then - iptables -A FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j ACCEPT + iptables -I FORWARD 1 -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j ACCEPT fi if ! iptables -C FORWARD -i "$NETWORK_DEVICE" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; then - iptables -A FORWARD -i "$NETWORK_DEVICE" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT + iptables -I FORWARD 2 -i "$NETWORK_DEVICE" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT fi if ! ip6tables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j ACCEPT 2>/dev/null; then - ip6tables -A FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j ACCEPT + ip6tables -I FORWARD 1 -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j ACCEPT fi if ! ip6tables -C FORWARD -i "$NETWORK_DEVICE" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; then - ip6tables -A FORWARD -i "$NETWORK_DEVICE" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT + ip6tables -I FORWARD 2 -i "$NETWORK_DEVICE" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT fi } configure_exit_dns_and_icmp() { echo "ensuring dns and icmp are allowed inside nym exit chain" - if ! iptables -C "$NYM_CHAIN" -p udp --dport 53 -j ACCEPT 2>/dev/null; then - iptables -A "$NYM_CHAIN" -p udp --dport 53 -j ACCEPT - fi - if ! iptables -C "$NYM_CHAIN" -p tcp --dport 53 -j ACCEPT 2>/dev/null; then - iptables -A "$NYM_CHAIN" -p tcp --dport 53 -j ACCEPT - fi - if ! ip6tables -C "$NYM_CHAIN" -p udp --dport 53 -j ACCEPT 2>/dev/null; then - ip6tables -A "$NYM_CHAIN" -p udp --dport 53 -j ACCEPT - fi - if ! ip6tables -C "$NYM_CHAIN" -p tcp --dport 53 -j ACCEPT 2>/dev/null; then - ip6tables -A "$NYM_CHAIN" -p tcp --dport 53 -j ACCEPT - fi + # Remove any existing DNS/ICMP rules first to avoid duplicates + iptables -D "$NYM_CHAIN" -p udp --dport 53 -j ACCEPT 2>/dev/null || true + iptables -D "$NYM_CHAIN" -p tcp --dport 53 -j ACCEPT 2>/dev/null || true + iptables -D "$NYM_CHAIN" -p icmp --icmp-type echo-request -j ACCEPT 2>/dev/null || true + iptables -D "$NYM_CHAIN" -p icmp --icmp-type echo-reply -j ACCEPT 2>/dev/null || true + ip6tables -D "$NYM_CHAIN" -p udp --dport 53 -j ACCEPT 2>/dev/null || true + ip6tables -D "$NYM_CHAIN" -p tcp --dport 53 -j ACCEPT 2>/dev/null || true + ip6tables -D "$NYM_CHAIN" -p ipv6-icmp -j ACCEPT 2>/dev/null || true - if ! iptables -C "$NYM_CHAIN" -p icmp --icmp-type echo-request -j ACCEPT 2>/dev/null; then - iptables -A "$NYM_CHAIN" -p icmp --icmp-type echo-request -j ACCEPT - fi - if ! iptables -C "$NYM_CHAIN" -p icmp --icmp-type echo-reply -j ACCEPT 2>/dev/null; then - iptables -A "$NYM_CHAIN" -p icmp --icmp-type echo-reply -j ACCEPT - fi - if ! ip6tables -C "$NYM_CHAIN" -p ipv6-icmp -j ACCEPT 2>/dev/null; then - ip6tables -A "$NYM_CHAIN" -p ipv6-icmp -j ACCEPT - fi + # Insert rules at the beginning in correct order: DNS first, then ICMP + iptables -I "$NYM_CHAIN" 1 -p udp --dport 53 -j ACCEPT + iptables -I "$NYM_CHAIN" 2 -p tcp --dport 53 -j ACCEPT + iptables -I "$NYM_CHAIN" 3 -p icmp --icmp-type echo-request -j ACCEPT + iptables -I "$NYM_CHAIN" 4 -p icmp --icmp-type echo-reply -j ACCEPT + ip6tables -I "$NYM_CHAIN" 1 -p udp --dport 53 -j ACCEPT + ip6tables -I "$NYM_CHAIN" 2 -p tcp --dport 53 -j ACCEPT + ip6tables -I "$NYM_CHAIN" 3 -p ipv6-icmp -j ACCEPT } apply_port_allowlist() { From 82a9563ca0cbe7c7441abf8699f44750f9b14322 Mon Sep 17 00:00:00 2001 From: benedettadavico Date: Tue, 18 Nov 2025 13:12:35 +0100 Subject: [PATCH 2/3] add a checker script --- .../nym-node-setup/check-firewall-setup.sh | 99 +++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 scripts/nym-node-setup/check-firewall-setup.sh diff --git a/scripts/nym-node-setup/check-firewall-setup.sh b/scripts/nym-node-setup/check-firewall-setup.sh new file mode 100644 index 0000000000..713750b65e --- /dev/null +++ b/scripts/nym-node-setup/check-firewall-setup.sh @@ -0,0 +1,99 @@ +#!/bin/bash +# helper script to verify firewall ordering +set -euo pipefail + +bold() { printf '\033[1m%s\033[0m\n' "$*"; } +warn() { printf '\033[31m⚠ %s\033[0m\n' "$*"; } +ok() { printf '\033[32m✓ %s\033[0m\n' "$*"; } + +RULE_OFFSET=2 # this is because thefirst rule appears on line 3 + +get_rule_line() { + local chain=$1 + local rule_idx=$2 + iptables -L "$chain" -n --line-numbers | sed -n "$((rule_idx + RULE_OFFSET))p" +} + +check_forward_chain() { + local output + output=$(iptables -L FORWARD -n --line-numbers) + + if echo "$output" | grep -q "^1[[:space:]]\+NYM-EXIT"; then + ok "FORWARD rule 1 jumps to NYM-EXIT" + else + warn "FORWARD rule 1 is not NYM-EXIT; re-run network-tunnel-manager.sh exit_policy_install" + return 1 + fi + + if echo "$output" | grep -q "ACCEPT.*state RELATED,ESTABLISHED"; then + ok "FORWARD chain contains RELATED,ESTABLISHED accepts (WG return path)" + else + warn "FORWARD chain missing RELATED,ESTABLISHED accepts; re-run network-tunnel-manager.sh apply_iptables_rules_wg" + return 1 + fi + + return 0 +} + +check_nym_exit_chain() { + local errors=0 + local patterns=( + "udp.*dpt:53" + "tcp.*dpt:53" + "icmp.*type 8" + "icmp.*type 0" + ) + + for idx in "${!patterns[@]}"; do + local rule_no=$((idx + 1)) + local line + line=$(get_rule_line "NYM-EXIT" "$rule_no") + if [[ "$line" =~ ${patterns[$idx]} ]]; then + ok "NYM-EXIT rule $rule_no matches ${patterns[$idx]}" + else + warn "NYM-EXIT rule $rule_no is not ${patterns[$idx]}; re-run network-tunnel-manager.sh exit_policy_install" + errors=1 + fi + done + + local last_rule + last_rule=$(iptables -L NYM-EXIT -n --line-numbers | awk 'NR>2 {line=$0} END {print line}') + if [[ -z "${last_rule:-}" ]]; then + warn "NYM-EXIT chain is empty; re-run network-tunnel-manager.sh exit_policy_install" + errors=1 + elif [[ "$last_rule" =~ REJECT ]] && [[ "$last_rule" =~ 0\.0\.0\.0/0 ]]; then + ok "NYM-EXIT ends with REJECT all" + else + warn "NYM-EXIT final rule is not a REJECT all (got: $last_rule)" + errors=1 + fi + + return $errors +} + +main() { + bold "Checking IPv4 firewall ordering…" + local errors=0 + check_forward_chain || errors=1 + check_nym_exit_chain || errors=1 + + if command -v ip6tables >/dev/null 2>&1; then + bold "Checking IPv6 firewall ordering…" + if ip6tables -L NYM-EXIT -n --line-numbers >/dev/null 2>&1; then + if ! ip6tables -L NYM-EXIT -n --line-numbers | sed -n '3p' | grep -q "udp.*dpt:53"; then + warn "ip6tables NYM-EXIT rule 1 is not UDP 53" + errors=1 + fi + fi + fi + + if [[ $errors -ne 0 ]]; then + warn "There may be some problems, it's recommended to re-run network-tunnel-manager.sh exit_policy_install after configuring UFW." + exit 1 + else + ok "It's looking good!" + fi +} + +main "$@" + From b742ace7e0f7278f538598fa667841f0dcd3f464 Mon Sep 17 00:00:00 2001 From: benedettadavico Date: Tue, 18 Nov 2025 14:24:19 +0100 Subject: [PATCH 3/3] add firewall check to the main script --- .../nym-node-setup/check-firewall-setup.sh | 99 ------------------- .../nym-node-setup/network-tunnel-manager.sh | 97 +++++++++++++++++- 2 files changed, 95 insertions(+), 101 deletions(-) delete mode 100644 scripts/nym-node-setup/check-firewall-setup.sh diff --git a/scripts/nym-node-setup/check-firewall-setup.sh b/scripts/nym-node-setup/check-firewall-setup.sh deleted file mode 100644 index 713750b65e..0000000000 --- a/scripts/nym-node-setup/check-firewall-setup.sh +++ /dev/null @@ -1,99 +0,0 @@ -#!/bin/bash -# helper script to verify firewall ordering -set -euo pipefail - -bold() { printf '\033[1m%s\033[0m\n' "$*"; } -warn() { printf '\033[31m⚠ %s\033[0m\n' "$*"; } -ok() { printf '\033[32m✓ %s\033[0m\n' "$*"; } - -RULE_OFFSET=2 # this is because thefirst rule appears on line 3 - -get_rule_line() { - local chain=$1 - local rule_idx=$2 - iptables -L "$chain" -n --line-numbers | sed -n "$((rule_idx + RULE_OFFSET))p" -} - -check_forward_chain() { - local output - output=$(iptables -L FORWARD -n --line-numbers) - - if echo "$output" | grep -q "^1[[:space:]]\+NYM-EXIT"; then - ok "FORWARD rule 1 jumps to NYM-EXIT" - else - warn "FORWARD rule 1 is not NYM-EXIT; re-run network-tunnel-manager.sh exit_policy_install" - return 1 - fi - - if echo "$output" | grep -q "ACCEPT.*state RELATED,ESTABLISHED"; then - ok "FORWARD chain contains RELATED,ESTABLISHED accepts (WG return path)" - else - warn "FORWARD chain missing RELATED,ESTABLISHED accepts; re-run network-tunnel-manager.sh apply_iptables_rules_wg" - return 1 - fi - - return 0 -} - -check_nym_exit_chain() { - local errors=0 - local patterns=( - "udp.*dpt:53" - "tcp.*dpt:53" - "icmp.*type 8" - "icmp.*type 0" - ) - - for idx in "${!patterns[@]}"; do - local rule_no=$((idx + 1)) - local line - line=$(get_rule_line "NYM-EXIT" "$rule_no") - if [[ "$line" =~ ${patterns[$idx]} ]]; then - ok "NYM-EXIT rule $rule_no matches ${patterns[$idx]}" - else - warn "NYM-EXIT rule $rule_no is not ${patterns[$idx]}; re-run network-tunnel-manager.sh exit_policy_install" - errors=1 - fi - done - - local last_rule - last_rule=$(iptables -L NYM-EXIT -n --line-numbers | awk 'NR>2 {line=$0} END {print line}') - if [[ -z "${last_rule:-}" ]]; then - warn "NYM-EXIT chain is empty; re-run network-tunnel-manager.sh exit_policy_install" - errors=1 - elif [[ "$last_rule" =~ REJECT ]] && [[ "$last_rule" =~ 0\.0\.0\.0/0 ]]; then - ok "NYM-EXIT ends with REJECT all" - else - warn "NYM-EXIT final rule is not a REJECT all (got: $last_rule)" - errors=1 - fi - - return $errors -} - -main() { - bold "Checking IPv4 firewall ordering…" - local errors=0 - check_forward_chain || errors=1 - check_nym_exit_chain || errors=1 - - if command -v ip6tables >/dev/null 2>&1; then - bold "Checking IPv6 firewall ordering…" - if ip6tables -L NYM-EXIT -n --line-numbers >/dev/null 2>&1; then - if ! ip6tables -L NYM-EXIT -n --line-numbers | sed -n '3p' | grep -q "udp.*dpt:53"; then - warn "ip6tables NYM-EXIT rule 1 is not UDP 53" - errors=1 - fi - fi - fi - - if [[ $errors -ne 0 ]]; then - warn "There may be some problems, it's recommended to re-run network-tunnel-manager.sh exit_policy_install after configuring UFW." - exit 1 - else - ok "It's looking good!" - fi -} - -main "$@" - diff --git a/scripts/nym-node-setup/network-tunnel-manager.sh b/scripts/nym-node-setup/network-tunnel-manager.sh index 71e31e5c9f..883c068f4b 100644 --- a/scripts/nym-node-setup/network-tunnel-manager.sh +++ b/scripts/nym-node-setup/network-tunnel-manager.sh @@ -800,8 +800,95 @@ test_exit_policy_connectivity() { echo "connectivity tests finished" } + ############################################################################### -# part 3: exit policy verification tests +# part 3: check the firewall setup +############################################################################### + +firewall_rule_line() { + local chain=$1 + local rule_idx=$2 + # this is because thefirst rule appears on line 3 + iptables -L "$chain" -n --line-numbers | sed -n "$((rule_idx + 2))p" +} + +check_forward_chain() { + local output + output=$(iptables -L FORWARD -n --line-numbers) + + if ! echo "$output" | grep -q "^1[[:space:]]\+$NYM_CHAIN"; then + echo "FORWARD rule 1 is not ${NYM_CHAIN}; re-run network-tunnel-manager.sh exit_policy_install" + return 1 + fi + + if ! echo "$output" | grep -q "ACCEPT.*state RELATED,ESTABLISHED"; then + echo "FORWARD chain missing RELATED,ESTABLISHED accepts; re-run network-tunnel-manager.sh apply_iptables_rules_wg" + return 1 + fi + + echo "FORWARD chain ordering looks good" + return 0 +} + +check_nym_exit_chain() { + local errors=0 + local patterns=("udp.*dpt:53" "tcp.*dpt:53" "icmp.*type 8" "icmp.*type 0") + + for idx in "${!patterns[@]}"; do + local line + line=$(firewall_rule_line "$NYM_CHAIN" $((idx + 1))) + if [[ "$line" =~ ${patterns[$idx]} ]]; then + echo "${NYM_CHAIN} rule $((idx + 1)) ok (${patterns[$idx]})" + else + echo "${NYM_CHAIN} rule $((idx + 1)) is not ${patterns[$idx]}; re-run network-tunnel-manager.sh exit_policy_install" + errors=1 + fi + done + + local last_rule + last_rule=$(iptables -L "$NYM_CHAIN" -n --line-numbers | awk 'NR>2 {line=$0} END {print line}') + if [[ -z "${last_rule:-}" ]]; then + echo "${NYM_CHAIN} chain is empty; re-run network-tunnel-manager.sh exit_policy_install" + errors=1 + elif [[ "$last_rule" =~ REJECT ]] && [[ "$last_rule" =~ 0\.0\.0\.0/0 ]]; then + echo "${NYM_CHAIN} ends with the catch-all REJECT" + else + echo "${NYM_CHAIN} final rule is not the catch-all REJECT (got: $last_rule)" + errors=1 + fi + + return $errors +} + +check_firewall_setup() { + echo "checking ipv4 firewall ordering…" + local errors=0 + + check_forward_chain || errors=1 + check_nym_exit_chain || errors=1 + + if command -v ip6tables >/dev/null 2>&1; then + echo "checking ipv6 firewall ordering…" + if ip6tables -L "$NYM_CHAIN" -n --line-numbers >/dev/null 2>&1; then + if ! ip6tables -L "$NYM_CHAIN" -n --line-numbers | sed -n '3p' | grep -q "udp.*dpt:53"; then + echo "ip6tables ${NYM_CHAIN} rule 1 is not UDP 53" + errors=1 + fi + fi + fi + + if [[ $errors -ne 0 ]]; then + echo "There may be some ordering issues, it is recommended to re-run network-tunnel-manager.sh exit_policy_install after configuring UFW." + return 1 + fi + + echo "It's looking good!" + return 0 +} + + +############################################################################### +# part 4: full exit policy verification tests ############################################################################### test_port_range_rules() { @@ -945,7 +1032,7 @@ exit_policy_run_tests() { } ############################################################################### -# part 4: high level workflows +# part 5: high level workflows ############################################################################### full_tunnel_setup() { @@ -992,6 +1079,7 @@ complete_networking_configuration() { full_tunnel_setup exit_policy_install + check_firewall_setup || echo "firewall order checks reported problems, please review output" exit_policy_run_tests || echo "exit policy tests reported problems, please review output" echo "complete networking configuration finished" @@ -1080,6 +1168,10 @@ case "$cmd" in show_exit_policy_status status=$? ;; + check_firewall_setup) + check_firewall_setup + status=$? + ;; exit_policy_test_connectivity) test_exit_policy_connectivity status=$? @@ -1121,6 +1213,7 @@ tunnel and nat helpers: exit policy manager: exit_policy_install install exit policy (iptables rules and blocklist) + check_firewall_setup run ordering sanity check (dns/icmp + FORWARD jump) exit_policy_status show status of exit policy and forwarding exit_policy_test_connectivity test connectivity via ${WG_INTERFACE} exit_policy_clear remove ${NYM_CHAIN} chains and hooks