From c2f588857fecfb8fc03075795b56b092cc56f6bf Mon Sep 17 00:00:00 2001 From: benedettadavico Date: Mon, 17 Nov 2025 16:21:49 +0100 Subject: [PATCH] dns and icmp rules go to the top --- scripts/nym-node-setup/network-tunnel-manager.sh | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/scripts/nym-node-setup/network-tunnel-manager.sh b/scripts/nym-node-setup/network-tunnel-manager.sh index acd0186366..a21b6df018 100644 --- a/scripts/nym-node-setup/network-tunnel-manager.sh +++ b/scripts/nym-node-setup/network-tunnel-manager.sh @@ -525,26 +525,26 @@ configure_exit_dns_and_icmp() { echo "ensuring dns and icmp are allowed inside nym exit chain" if ! iptables -C "$NYM_CHAIN" -p udp --dport 53 -j ACCEPT 2>/dev/null; then - iptables -A "$NYM_CHAIN" -p udp --dport 53 -j ACCEPT + iptables -I "$NYM_CHAIN" -p udp --dport 53 -j ACCEPT fi if ! iptables -C "$NYM_CHAIN" -p tcp --dport 53 -j ACCEPT 2>/dev/null; then - iptables -A "$NYM_CHAIN" -p tcp --dport 53 -j ACCEPT + iptables -I "$NYM_CHAIN" -p tcp --dport 53 -j ACCEPT fi if ! ip6tables -C "$NYM_CHAIN" -p udp --dport 53 -j ACCEPT 2>/dev/null; then - ip6tables -A "$NYM_CHAIN" -p udp --dport 53 -j ACCEPT + ip6tables -I "$NYM_CHAIN" -p udp --dport 53 -j ACCEPT fi if ! ip6tables -C "$NYM_CHAIN" -p tcp --dport 53 -j ACCEPT 2>/dev/null; then - ip6tables -A "$NYM_CHAIN" -p tcp --dport 53 -j ACCEPT + ip6tables -I "$NYM_CHAIN" -p tcp --dport 53 -j ACCEPT fi if ! iptables -C "$NYM_CHAIN" -p icmp --icmp-type echo-request -j ACCEPT 2>/dev/null; then - iptables -A "$NYM_CHAIN" -p icmp --icmp-type echo-request -j ACCEPT + iptables -I "$NYM_CHAIN" -p icmp --icmp-type echo-request -j ACCEPT fi if ! iptables -C "$NYM_CHAIN" -p icmp --icmp-type echo-reply -j ACCEPT 2>/dev/null; then - iptables -A "$NYM_CHAIN" -p icmp --icmp-type echo-reply -j ACCEPT + iptables -I "$NYM_CHAIN" -p icmp --icmp-type echo-reply -j ACCEPT fi if ! ip6tables -C "$NYM_CHAIN" -p ipv6-icmp -j ACCEPT 2>/dev/null; then - ip6tables -A "$NYM_CHAIN" -p ipv6-icmp -j ACCEPT + ip6tables -I "$NYM_CHAIN" -p ipv6-icmp -j ACCEPT fi }